3 ms·
Not a bug. If you're worried about security as a user, d/l the free authenticator. If you're worried about Blizzard, don't -- they're big kids. You can run
by Steko 14y ago
Not a bug.
If you're worried about security as a user, d/l the free authenticator.
If you're worried about Blizzard, don't -- they're big kids. You can run your 10+ million user game platform the way you want, Blizzard will run theirs the way they want.
- rcgs 14y agoJust like how we shouldn't worry about big kids Sony and their 70+ million network being compromised? Telling people not to worry about security works until they, inevitably, have their data compromised. Technically aware consumers have a responsibility to put pressure on companies to be secure with information.
- Steko 14y agoDid Sony offer a free authenticator? At any rate I'm not shedding tears for Sony if that's what you're asking. "Technically aware consumers have a responsibility to put pressure on companies to be secure with information." No one's shown that Blizzard has been unsecure with anyone's information. I see a lot of people running around like the sky is falling when it's not.
- Groxx 14y agoPrecisely the same way, yes. Sony's network being compromised had absolutely nothing to do with password case sensitivity, and absolutely everything to do with shoddy practices elsewhere that opened a massive hole into their database, allowing them to download millions of accounts worth of data. Millions of accounts from a single breach somewhere. Not millions of accounts individually brute forced because their case-insensitive passwords made them trivially guessable. We should be worried that Blizzard will get hacked like PSN was. That would be potentially catastrophic. But case sensitivity has almost no effect on password security unless your users ALL use random passwords.
- Zarathust 14y agoSo I need to buy a smartphone to enjoy basic security features.
- Steko 14y agoI wouldn't call the authenticator "basic security"; it's a very high level of additional security. For a video game. And if you don't have a smartphone (spoilers you probably do) and you wanted an authenticator you could buy the token or emulate it on the OS of your choice... http://developer.android.com/guide/developing/tools/emulator.html http://developer.android.com/guide/developing/tools/emulator... or on any java device apparently: http://arenabooster.marisil.org/bma.htm http://arenabooster.marisil.org/bma.htm
- estel 14y agoI believe that they also now allow authentication over SMS. Edit: it's not quite an authenticator: http://us.battle.net/support/en/article/battlenet-sms-protect http://us.battle.net/support/en/article/battlenet-sms-protec...
- DrJokepu 14y agoedit: I said something stupid here. Nothing to see here, move along.
- rmc 14y agoPasswords being case insensitive implies that they are storing passwords as clear text. What? No it doesn't. They could just lower case all the password submissions and store the hashed version of that. When someone tries to log in, lower case what they enter, hash it, and compare to hash (or whatever the specifics are)
- deleted 14y ago[deleted]
- papsosouid 14y agoYeah, blizzard are big kids, they would never be so astoundingly incompetent as to do something like say, trust the client to decide whether or not a character is realm. Oh wait, yeah they did that didn't they? But surely they would never be so incompetent as to trust the client to tell the server the clients co-ords right? Oh no, they did they too (and still do!). Seriously, blizzard's demonstrated repeatedly that they either do not understand security, or do not care about security. Either way, "trust them because they have lots of users" is ridiculous.