4 ms·

Paypal passwords are 20 characters max. Also Paypal doesn't support any form of secure OTP. Also, Paypal forces security questions on the user. In other news

Paypal passwords are 20 characters max. Also Paypal doesn't support any form of secure OTP. Also, Paypal forces security questions on the user. In other news, my Hearthstone account has better security than my money.

shawnz 9y ago
I've been locked out of my Hearthstone account for the last few weeks because I lost my 2fa authenticator and they've refused to remove it due to my driver's license being expired.
- scrollaway 9y ago
  BTW, Battle.net Authenticators look nonstandard at first glance, but they are actually 8-digit TOTP. I wrote a Python library and command line utility which can create new Battle.net authenticators as well as generate codes and QR URIs: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna See the README for usage :) This should help you to have a backup next time you get locked out!
  - stryk 9y ago
    This just saved my ass. I only play Diablo 3 occasionally, but Blizzard doesn't offer their client on Windows Phone, which would have been great to know prior to switching over from Android. Fortunately I didn't have the same issues getting it taken off of my account as the parent comment , but I was stuck using SMS as a 2FA after that, which is no beuno. I just used your python script, imported the 'secret' into Microsoft Authenticator via the generated QR code, and now it is working just as if I was using one of their auth dongle doohickies. Fantastic, thank you sir/madam!
    - scrollaway 9y ago
      Glad it helped!
  - ZoFreX 9y ago
    > This should help you to have a backup next time you get locked out! The official authenticator also displays a backup code which it tells you to keep a copy of somewhere safe...
  - shawnz 9y ago
    I actually did use a system like this previously, but somehow the site just stopped accepting the codes from my TOTP app one day. I restored the official blizzard authenticator app from a backup but that wasn't working any longer either.
    - scrollaway 9y ago
      Sounds like time shift to be honest.
      - shawnz 9y ago
        I vaguely recall checking the clock but it's possible. I've since deleted the backups anyway.
- sgarman 9y ago
  Sounds like it's working at intended then? I imagine your reaction to losing everything in your account would amount to much more then a minor annoyance.
  - Nullabillity 9y ago
    That makes sense for WoW or Diablo. Hearthstone doesn't have any trading system, so there would be nothing to steal.
    - scrollaway 9y ago
      It's all the same account.
Angostura 9y ago
You think that's bad. Virgin Media - a major ISP/Broadband supplier has these restrictions on is e-mail passwords (effectively the key to many kingdoms) Be between 8 and 10 characters long (with no spaces) Contain only numbers and letters (no characters like @*? etc). Start with a letter. Not contain 3 numbers in a row.
- diggan 9y ago
  You think that's bad? Banc Sabadell, a bank in Spain, requires the users of online banking to have a 4 digit number as their password. Although, they also have 2 factor for doing things involving moving money. But still...
- mrweasel 9y ago
  > Start with a letter. That is a requirement in a ton of places. Try creating an Oracle database user, and have the password start with a number. To be fair it's documented that it won't work, but Oracle won't stop you from doing it, so you end up with an unusable account.
  - tempay 9y ago
    This shouldn't be an issue. You should always be storing a hash of the password, making the content of the password irrelevant. The hash might start with a number, but then you can just make a versioning scheme for the hash which is identified by the first character being a letter. I don't understand how this is still a common issue.
    - bradleyjg 9y ago
      Every password hashing library I've worked with has output starting with a $. It's use a deliminator to separate the id, strength, salt, and hash (sometimes the last two are not separated). So for example, a bcrypt output might look like: $2a$12$2zuYZPvIlfC.L84k0oWZR.8yGd62dPkhoyg4aEC6TzGl7aASTw5F.

shawnz 9y ago

I've been locked out of my Hearthstone account for the last few weeks because I lost my 2fa authenticator and they've refused to remove it due to my driver's license being expired.

scrollaway 9y ago
BTW, Battle.net Authenticators look nonstandard at first glance, but they are actually 8-digit TOTP. I wrote a Python library and command line utility which can create new Battle.net authenticators as well as generate codes and QR URIs: https://github.com/jleclanche/python-bna https://github.com/jleclanche/python-bna See the README for usage :) This should help you to have a backup next time you get locked out!
- stryk 9y ago
  This just saved my ass. I only play Diablo 3 occasionally, but Blizzard doesn't offer their client on Windows Phone, which would have been great to know prior to switching over from Android. Fortunately I didn't have the same issues getting it taken off of my account as the parent comment , but I was stuck using SMS as a 2FA after that, which is no beuno. I just used your python script, imported the 'secret' into Microsoft Authenticator via the generated QR code, and now it is working just as if I was using one of their auth dongle doohickies. Fantastic, thank you sir/madam!
  - scrollaway 9y ago
    Glad it helped!
- ZoFreX 9y ago
  > This should help you to have a backup next time you get locked out! The official authenticator also displays a backup code which it tells you to keep a copy of somewhere safe...
- shawnz 9y ago
  I actually did use a system like this previously, but somehow the site just stopped accepting the codes from my TOTP app one day. I restored the official blizzard authenticator app from a backup but that wasn't working any longer either.
  - scrollaway 9y ago
    Sounds like time shift to be honest.
    - shawnz 9y ago
      I vaguely recall checking the clock but it's possible. I've since deleted the backups anyway.
sgarman 9y ago
Sounds like it's working at intended then? I imagine your reaction to losing everything in your account would amount to much more then a minor annoyance.
- Nullabillity 9y ago
  That makes sense for WoW or Diablo. Hearthstone doesn't have any trading system, so there would be nothing to steal.
  - scrollaway 9y ago
    It's all the same account.

Angostura 9y ago

You think that's bad. Virgin Media - a major ISP/Broadband supplier has these restrictions on is e-mail passwords (effectively the key to many kingdoms) Be between 8 and 10 characters long (with no spaces) Contain only numbers and letters (no characters like @*? etc). Start with a letter. Not contain 3 numbers in a row.

diggan 9y ago
You think that's bad? Banc Sabadell, a bank in Spain, requires the users of online banking to have a 4 digit number as their password. Although, they also have 2 factor for doing things involving moving money. But still...
mrweasel 9y ago
> Start with a letter. That is a requirement in a ton of places. Try creating an Oracle database user, and have the password start with a number. To be fair it's documented that it won't work, but Oracle won't stop you from doing it, so you end up with an unusable account.
- tempay 9y ago
  This shouldn't be an issue. You should always be storing a hash of the password, making the content of the password irrelevant. The hash might start with a number, but then you can just make a versioning scheme for the hash which is identified by the first character being a letter. I don't understand how this is still a common issue.
  - bradleyjg 9y ago
    Every password hashing library I've worked with has output starting with a $. It's use a deliminator to separate the id, strength, salt, and hash (sometimes the last two are not separated). So for example, a bcrypt output might look like: $2a$12$2zuYZPvIlfC.L84k0oWZR.8yGd62dPkhoyg4aEC6TzGl7aASTw5F.