7 ms·

Battle.net authentication misconceptions

60 points by icehawk 14y ago

tzaman 14y ago
Hopefully this lay some of the paranoid guys to rest.
- Auguste 14y ago
  It's alright to be paranoid, but most of the security-related posts on the Diablo 3 forums I've seen have been pure FUD.
VikingCoder 14y ago
"Yes, the passwords are converted to uppercase before hashing. That's probably a bad idea - especially in the modern world - but it really dates back to their first Battle.net game - Diablo - from 1996." Yup, that's probably a bad idea. Thank goodness you didn't disagree that it's probably a bad idea, like I've seen a ton of nut-jobs do. That said, I think it's only "probably a bad idea" in terms of protecting people who use the same password on multiple sites, which is "without question a bad idea."
- davis_m 14y ago
  Why is it worse to uppercase the password before hashing for people who use the same password on multiple sites? It doesn't matter if it is a 24 character password using every character set possible, if it is the same password they use somewhere else, and that place is compromised, the attacker will be able to use that password to login to the Battle.net account.
  - lawnchair_larry 14y ago
    The reason is because lowering the entropy of the password makes the blizzard version easier to crack. If blizzard is compromised, the passwords won't be disclosed - just the hashes will be, so re-use isn't immediately an issue. It becomes an issue when the hash is cracked and the attacker can now see which password is being reused, and then reuse it. Of course if the reused password is something like "hunter2", the cracked version will look like "HUNTER2", but the original case can be guessed in a few tries once the case-insensitive version is discovered. Very roughly, case sensitivity provides about a half bit of entropy. For reference, one bit of entropy takes twice as long to crack. And say what you want about password reuse, but 99% of users re-use passwords at least somewhat, so site owners have an obligation to protect user passwords.
    - falcolas 14y ago
      And the random salt used for hashes, and the minimum length of 8 for your password, all but eliminates their database compromise as being a plausible vector of attack. Plus, caps doesn't add that many bits of entropy, when used as people use it (first letter, alternating letters, etc).
- lnanek 14y ago
  Put me in as a nut job then. I've seen plenty of users who make no distinction whatsoever re case of characters in passwords. One day their password is working, the next day it isn't, and the organization ends up spending the custom care money to deal with it just because they started typing "af" at the end of their password instead of "Af" or whatever. If you need more complexity in a password, better to just encourage them to use a phrase with the words being the individual complexity rather than the characters. Like it or not, we live in a world where 80% of end users can't turn their wifi radio on and off on their phone, and we need to make systems that are a pleasure to use for them.
  - TillE 14y ago
    Condescension about idiot users is never a very persuasive way to make a point. > we live in a world where 80% of end users can't turn their wifi radio on and off on their phone But they still manage to properly enter their case-sensitive password to buy new apps.
    - Jare 14y ago
      > But they still manage to properly enter their case-sensitive password to buy new apps. Because they never use uppercase in their case-sensitive passwords.
      - nsmartt 14y ago
        This attitude makes me very angry. Even if 80% of users don't use capitals in their passwords, the 20% who want that added security don't get it. Even if you believe this made-up statistic due to your condescending attitude towards "normal" users, the password should be case sensitive. A (very stupid) alternative would be to notify the users that their password isn't case sensitive so that those who mind can use a more secure password. The argument that "most" users won't be affected is absolutely negated by the fact that some are.
        plorkyeran 14y ago
- TillE 14y ago
  Er, wow. That's horrendous. How in the world can they still blame the first Diablo when they made such a big deal about "Battle.net 2.0" recently? Why do they need to lump the new stuff together with legacy systems using broken security practices?
  - cube13 14y ago
    Most likely because the authentication codebase started with Starcraft, was integrated with Diablo 2, then was basically ported to WoW. After that, WoW's system was basically integrated into the current Battle.net 2.0 system.
- nmb 14y ago
  Seems to be a spreading practice for services with huge userbases; Facebook does it: http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612 http://www.zdnet.com/blog/facebook/facebook-passwords-are-no...
  - biafra 14y ago
    facebook does a different thing. It does not allow any casing(sp?). It allows only the right and the reverse and first letter in uppercase. Blizzard seems to uppercase the given password and hashes that. This method makes a lot of wrong passwords work. In facebooks case only two more passwords than the original are accepted.
  - ianburrell 14y ago
    Facebook does something different. They accept two extra variants of the password (first letter capitalized and case reversed). They don't uppercase the password before hashing or checking. This reduces the security slightly as opposed to uppercasing passwords which reduces the search space significantly.
- jsabo 14y ago
  If they ever compromise the bnet database of hashed passwords though it may be a benefit, as the password they re-use may contain uppercase and lowercase letters, which the bnet database has no way of representing.
- nknight 14y ago
  He's actually wrong. Starcraft introduced usernames/passwords and unique names to Battle.net in early 1998. The support was then patched into Diablo 1.05. Diablo I's Battle.net functionality did not originally include usernames/passwords at all. It was quite a strange little architecture, initially. Your displayed name was whatever you'd named your character, with the distinguishing feature being an "account number" that could be re-generated by deleting a file in your Diablo directory (the corollary being if you didn't back the file up, your account number would change upon a reformat or migration to a new computer).
  - ohashi 14y ago
    Or you used a tool to change your account to 1537 and nobody could ever find you because hundreds, if not thousands, of people all used that same shared account.
  - timewasted 14y ago
    Ultra minor nit-pick, but your account number was stored in a registry entry (HKEY_LOCAL_MACHINE\SOFTWARE\Battle.net\Configuration), not a file. The account number consisted of four parts: Registration Version: This was always 1 for all the account numbers that I still have lying around. Registration Authority: I don't actually remember what this was used for. Client ID: The actual account number. Client Token: Random number used to verify the validity of the Client ID.
- Confusion 14y ago
  If the passwords are stored using proper key stretching techniques and salting, they don't need to have much entropy to withstand brute-forcing. It's not necessarily a problem that lowercase letters do not contribute. However, it is a completely unnecessary lowering of entropy. My lesson from this is: it always pays to think about and understand even the seemingly most trivial decision. You may be stuck with it for decades.
bicknergseng 14y ago
Warning: somewhat unrelated and probably a rant: Can I just say that Blizzard's handling of the Diablo 3 launch was a travesty on so many levels? First of all, nothing worked. No one could login to play, despite their stress testing beta and having a large percentage of players sign up and predownload far before launch. Their response was the now internet famous "Error 37," an absolutely useless message for users. If everything was going to be completely broken, they could have at least provided a useful error message saying "We're getting more traffic than anticipated and will notify you when the servers are ready." or something. Seriously one of the most disappointing end user experiences I have ever had, and there's no way for me to return my $60 download.
- rmassie 14y ago
  It was one day. Get over it. The game has worked very well since.
  - ubercore 14y ago
    Not totally well. I still get lag spikes in a _single player game_. It's really confusing to me why they make the client rely on the server, especially when I've turned off "quick join" mode.
    - thehermit 14y ago
      Diablo 3 isn't a single player game with an online component, it is an online game you can choose to play solo. I agree with this choice, especially with games like Diablo. Yes there are that subset of players who will only play through the campaign alone and never touch it again but the majority are going to play on battlenet and there would be no reason to even play offline.
      - algorias 14y ago
        That's just not true. most people who buy Starcraft 2, for example, only use it to play the single player mode, even thought SC2 is even closer to a pure multiplayer game than Diablo. Forcing you to be online at all times leads to terrible user experience (it is strictly worse than just disabling some features when you lose the connection like SC2 does), so I believe Blizzard is purely motivated by DRM in this matter.
ralfd 14y ago
I don't get what the problem is? It doesn't really make bruteforcing an account feasible, that there are only a lower Quadrillion number of combinations instead of Quintillion. Quote: > If you fail a certain number of logins against Battle.net, your IP address is temporarily banned. This makes it fairly difficult to bruteforce most accounts.
alexrp 14y ago
I'm just going to interject here: http://xtzgzorex.wordpress.com/2012/05/26/grunt-auth-misconceptions/ http://xtzgzorex.wordpress.com/2012/05/26/grunt-auth-misconc...

60 points by icehawk 14y ago

tzaman 14y ago

Hopefully this lay some of the paranoid guys to rest.

Auguste 14y ago
It's alright to be paranoid, but most of the security-related posts on the Diablo 3 forums I've seen have been pure FUD.

VikingCoder 14y ago

"Yes, the passwords are converted to uppercase before hashing. That's probably a bad idea - especially in the modern world - but it really dates back to their first Battle.net game - Diablo - from 1996." Yup, that's probably a bad idea. Thank goodness you didn't disagree that it's probably a bad idea, like I've seen a ton of nut-jobs do. That said, I think it's only "probably a bad idea" in terms of protecting people who use the same password on multiple sites, which is "without question a bad idea."

davis_m 14y ago
Why is it worse to uppercase the password before hashing for people who use the same password on multiple sites? It doesn't matter if it is a 24 character password using every character set possible, if it is the same password they use somewhere else, and that place is compromised, the attacker will be able to use that password to login to the Battle.net account.
- lawnchair_larry 14y ago
  The reason is because lowering the entropy of the password makes the blizzard version easier to crack. If blizzard is compromised, the passwords won't be disclosed - just the hashes will be, so re-use isn't immediately an issue. It becomes an issue when the hash is cracked and the attacker can now see which password is being reused, and then reuse it. Of course if the reused password is something like "hunter2", the cracked version will look like "HUNTER2", but the original case can be guessed in a few tries once the case-insensitive version is discovered. Very roughly, case sensitivity provides about a half bit of entropy. For reference, one bit of entropy takes twice as long to crack. And say what you want about password reuse, but 99% of users re-use passwords at least somewhat, so site owners have an obligation to protect user passwords.
  - falcolas 14y ago
    And the random salt used for hashes, and the minimum length of 8 for your password, all but eliminates their database compromise as being a plausible vector of attack. Plus, caps doesn't add that many bits of entropy, when used as people use it (first letter, alternating letters, etc).
lnanek 14y ago
Put me in as a nut job then. I've seen plenty of users who make no distinction whatsoever re case of characters in passwords. One day their password is working, the next day it isn't, and the organization ends up spending the custom care money to deal with it just because they started typing "af" at the end of their password instead of "Af" or whatever. If you need more complexity in a password, better to just encourage them to use a phrase with the words being the individual complexity rather than the characters. Like it or not, we live in a world where 80% of end users can't turn their wifi radio on and off on their phone, and we need to make systems that are a pleasure to use for them.
- TillE 14y ago
  Condescension about idiot users is never a very persuasive way to make a point. > we live in a world where 80% of end users can't turn their wifi radio on and off on their phone But they still manage to properly enter their case-sensitive password to buy new apps.
  - Jare 14y ago
    > But they still manage to properly enter their case-sensitive password to buy new apps. Because they never use uppercase in their case-sensitive passwords.
    - nsmartt 14y ago
      This attitude makes me very angry. Even if 80% of users don't use capitals in their passwords, the 20% who want that added security don't get it. Even if you believe this made-up statistic due to your condescending attitude towards "normal" users, the password should be case sensitive. A (very stupid) alternative would be to notify the users that their password isn't case sensitive so that those who mind can use a more secure password. The argument that "most" users won't be affected is absolutely negated by the fact that some are.
      - plorkyeran 14y ago
TillE 14y ago
Er, wow. That's horrendous. How in the world can they still blame the first Diablo when they made such a big deal about "Battle.net 2.0" recently? Why do they need to lump the new stuff together with legacy systems using broken security practices?
- cube13 14y ago
  Most likely because the authentication codebase started with Starcraft, was integrated with Diablo 2, then was basically ported to WoW. After that, WoW's system was basically integrated into the current Battle.net 2.0 system.
nmb 14y ago
Seems to be a spreading practice for services with huge userbases; Facebook does it: http://www.zdnet.com/blog/facebook/facebook-passwords-are-not-case-sensitive-update/3612 http://www.zdnet.com/blog/facebook/facebook-passwords-are-no...
- biafra 14y ago
  facebook does a different thing. It does not allow any casing(sp?). It allows only the right and the reverse and first letter in uppercase. Blizzard seems to uppercase the given password and hashes that. This method makes a lot of wrong passwords work. In facebooks case only two more passwords than the original are accepted.
- ianburrell 14y ago
  Facebook does something different. They accept two extra variants of the password (first letter capitalized and case reversed). They don't uppercase the password before hashing or checking. This reduces the security slightly as opposed to uppercasing passwords which reduces the search space significantly.
jsabo 14y ago
If they ever compromise the bnet database of hashed passwords though it may be a benefit, as the password they re-use may contain uppercase and lowercase letters, which the bnet database has no way of representing.
nknight 14y ago
He's actually wrong. Starcraft introduced usernames/passwords and unique names to Battle.net in early 1998. The support was then patched into Diablo 1.05. Diablo I's Battle.net functionality did not originally include usernames/passwords at all. It was quite a strange little architecture, initially. Your displayed name was whatever you'd named your character, with the distinguishing feature being an "account number" that could be re-generated by deleting a file in your Diablo directory (the corollary being if you didn't back the file up, your account number would change upon a reformat or migration to a new computer).
- ohashi 14y ago
  Or you used a tool to change your account to 1537 and nobody could ever find you because hundreds, if not thousands, of people all used that same shared account.
- timewasted 14y ago
  Ultra minor nit-pick, but your account number was stored in a registry entry (HKEY_LOCAL_MACHINE\SOFTWARE\Battle.net\Configuration), not a file. The account number consisted of four parts: Registration Version: This was always 1 for all the account numbers that I still have lying around. Registration Authority: I don't actually remember what this was used for. Client ID: The actual account number. Client Token: Random number used to verify the validity of the Client ID.
Confusion 14y ago
If the passwords are stored using proper key stretching techniques and salting, they don't need to have much entropy to withstand brute-forcing. It's not necessarily a problem that lowercase letters do not contribute. However, it is a completely unnecessary lowering of entropy. My lesson from this is: it always pays to think about and understand even the seemingly most trivial decision. You may be stuck with it for decades.

bicknergseng 14y ago

Warning: somewhat unrelated and probably a rant: Can I just say that Blizzard's handling of the Diablo 3 launch was a travesty on so many levels? First of all, nothing worked. No one could login to play, despite their stress testing beta and having a large percentage of players sign up and predownload far before launch. Their response was the now internet famous "Error 37," an absolutely useless message for users. If everything was going to be completely broken, they could have at least provided a useful error message saying "We're getting more traffic than anticipated and will notify you when the servers are ready." or something. Seriously one of the most disappointing end user experiences I have ever had, and there's no way for me to return my $60 download.

rmassie 14y ago
It was one day. Get over it. The game has worked very well since.
- ubercore 14y ago
  Not totally well. I still get lag spikes in a _single player game_. It's really confusing to me why they make the client rely on the server, especially when I've turned off "quick join" mode.
  - thehermit 14y ago
    Diablo 3 isn't a single player game with an online component, it is an online game you can choose to play solo. I agree with this choice, especially with games like Diablo. Yes there are that subset of players who will only play through the campaign alone and never touch it again but the majority are going to play on battlenet and there would be no reason to even play offline.
    - algorias 14y ago
      That's just not true. most people who buy Starcraft 2, for example, only use it to play the single player mode, even thought SC2 is even closer to a pure multiplayer game than Diablo. Forcing you to be online at all times leads to terrible user experience (it is strictly worse than just disabling some features when you lose the connection like SC2 does), so I believe Blizzard is purely motivated by DRM in this matter.

ralfd 14y ago

I don't get what the problem is? It doesn't really make bruteforcing an account feasible, that there are only a lower Quadrillion number of combinations instead of Quintillion. Quote: > If you fail a certain number of logins against Battle.net, your IP address is temporarily banned. This makes it fairly difficult to bruteforce most accounts.

alexrp 14y ago

I'm just going to interject here: http://xtzgzorex.wordpress.com/2012/05/26/grunt-auth-misconceptions/ http://xtzgzorex.wordpress.com/2012/05/26/grunt-auth-misconc...