4 ms·

They don't (or didn't, I haven't checked in the last few months) allow special characters, either. Seriously - what? (Then again, my bank does the same thing.)

nodata 14y ago
So use a long password without them: password strength is what counts, not funny rules about special characters and minimum characters.
- nsmartt 14y ago
  This is not the point. Users are put at risk because Blizzard fails to adequately impose security. Tech savvy users can just use a stronger password, but the others are put at risk by what I can only call negligence.
  - Jare 14y ago
    (based on my anecdotal evidence) Most "normal" people do not use caps letters in their passwords. If you force them to do it, they'll capitalize the first letter and that's it. Compared to this, the lower amount of password-related troubles and customer service probably results in better overall password security. Phishing, keyloggers and various social hacks are the real problem. Blizzard has always been very active in this regard with their constant and visible reminders that "Blizzard will NEVER ask for your password", but most users disregard even that.
    - nsmartt 14y ago
      My fault. I didn't explain properly. I didn't mean it in the normal way- to require strict passwords. I meant in the sense that users who do add a capital in order to up their account security don't get that security added. Only users who know about this bug and go the extra mile then will benefit from the view of "So just make a better password without." I apologize if this is worded badly. I'm not feeling up to my usual ritual of rewording my post until I'm convinced it makes perfect sense to those who don't have magical insight into my mind.
      - chc 14y ago
        I think the point here is that if goofy capitalization is the only thing that kept your password from being trivially guessable, your password was only a little bit harder to guess. If your password isn't guessable, then it doesn't really matter if you have additional entropy, because the server smacks down brute-force attempts before they even get off the ground. In other words, it doesn't seem like capital letters make your password appreciably more secure in this context.
        nsmartt 14y ago
        That's exactly the problem here. A typical user who adds capitalization to make her password more difficult to guess is basically screwed over by Blizzard who has decided that passwords don't need to be case-sensitive. Users who opt to (I'm not talking about forcing users to use capitalization here) to use capitalization for a more secure password are unaware that their efforts are in vain. Also, it isn't only trivially more guessable. That's nonsense. If you're using a password list and you capitalize only the first letter of every password in that list, that list is still double the size of the first list.
- duaneb 14y ago
  They also restrict it to <= 16 characters.... Yea, that's still decently secure, but there's nothing like a 50 character password that's pretty much impossible to break. I don't get why they put these restrictions on. Probably some brainless dev decided to make a SQL column 16-bytes wide. EDIT: That doesn't even make sense, unless they're storing plain-text passwords.
  - Steko 14y ago
    If you're at the point of needing a 50 character passcode for your blizzard game maybe you should just download the free authenticator.
    - icebraining 14y ago
      OK, where can I download that free authenticator for my Nokia S60?
      - Steko 14y ago
        Run java? http://arenabooster.marisil.org/bma.htm http://arenabooster.marisil.org/bma.htm
        icebraining 14y ago
        Nope: The Java-based (J2ME) versions of the Battle.net Mobile Authenticator previously available through this website have been discontinued. http://eu.blizzard.com/en-gb/mobile/ http://eu.blizzard.com/en-gb/mobile/
      - estel 14y ago
        Well, they do offer http://us.battle.net/support/en/article/battlenet-sms-protect http://us.battle.net/support/en/article/battlenet-sms-protec... which provides an extra (but different) layer of security.
        icebraining 14y ago
elithrar 14y ago
> They don't (or didn't, I haven't checked in the last few months) allow special characters, either. Seriously - what? (Then again, my bank does the same thing.) This is not entirely correct. They do allow some types of punctuation, and have done for a very long while. I haven't tested characters like #, @, & (etc) though, but periods and the like have worked.
- electrichead 14y ago
  Fun fact: most banks don't enforce case-sensitivity for passwords either
rjv 14y ago
Not true at all. My password is long and complex, complete with many different special characters.

nodata 14y ago

So use a long password without them: password strength is what counts, not funny rules about special characters and minimum characters.

nsmartt 14y ago
This is not the point. Users are put at risk because Blizzard fails to adequately impose security. Tech savvy users can just use a stronger password, but the others are put at risk by what I can only call negligence.
- Jare 14y ago
  (based on my anecdotal evidence) Most "normal" people do not use caps letters in their passwords. If you force them to do it, they'll capitalize the first letter and that's it. Compared to this, the lower amount of password-related troubles and customer service probably results in better overall password security. Phishing, keyloggers and various social hacks are the real problem. Blizzard has always been very active in this regard with their constant and visible reminders that "Blizzard will NEVER ask for your password", but most users disregard even that.
  - nsmartt 14y ago
    My fault. I didn't explain properly. I didn't mean it in the normal way- to require strict passwords. I meant in the sense that users who do add a capital in order to up their account security don't get that security added. Only users who know about this bug and go the extra mile then will benefit from the view of "So just make a better password without." I apologize if this is worded badly. I'm not feeling up to my usual ritual of rewording my post until I'm convinced it makes perfect sense to those who don't have magical insight into my mind.
    - chc 14y ago
      I think the point here is that if goofy capitalization is the only thing that kept your password from being trivially guessable, your password was only a little bit harder to guess. If your password isn't guessable, then it doesn't really matter if you have additional entropy, because the server smacks down brute-force attempts before they even get off the ground. In other words, it doesn't seem like capital letters make your password appreciably more secure in this context.
      - nsmartt 14y ago
        That's exactly the problem here. A typical user who adds capitalization to make her password more difficult to guess is basically screwed over by Blizzard who has decided that passwords don't need to be case-sensitive. Users who opt to (I'm not talking about forcing users to use capitalization here) to use capitalization for a more secure password are unaware that their efforts are in vain. Also, it isn't only trivially more guessable. That's nonsense. If you're using a password list and you capitalize only the first letter of every password in that list, that list is still double the size of the first list.
duaneb 14y ago
They also restrict it to <= 16 characters.... Yea, that's still decently secure, but there's nothing like a 50 character password that's pretty much impossible to break. I don't get why they put these restrictions on. Probably some brainless dev decided to make a SQL column 16-bytes wide. EDIT: That doesn't even make sense, unless they're storing plain-text passwords.
- Steko 14y ago
  If you're at the point of needing a 50 character passcode for your blizzard game maybe you should just download the free authenticator.
  - icebraining 14y ago
    OK, where can I download that free authenticator for my Nokia S60?
    - Steko 14y ago
      Run java? http://arenabooster.marisil.org/bma.htm http://arenabooster.marisil.org/bma.htm
      - icebraining 14y ago
        Nope: The Java-based (J2ME) versions of the Battle.net Mobile Authenticator previously available through this website have been discontinued. http://eu.blizzard.com/en-gb/mobile/ http://eu.blizzard.com/en-gb/mobile/
    - estel 14y ago
      Well, they do offer http://us.battle.net/support/en/article/battlenet-sms-protect http://us.battle.net/support/en/article/battlenet-sms-protec... which provides an extra (but different) layer of security.
      - icebraining 14y ago

elithrar 14y ago

> They don't (or didn't, I haven't checked in the last few months) allow special characters, either. Seriously - what? (Then again, my bank does the same thing.) This is not entirely correct. They do allow some types of punctuation, and have done for a very long while. I haven't tested characters like #, @, & (etc) though, but periods and the like have worked.

electrichead 14y ago
Fun fact: most banks don't enforce case-sensitivity for passwords either

rjv 14y ago

Not true at all. My password is long and complex, complete with many different special characters.