4 ms·

I'm nearly positive the US code salted the hashes (it's been a long time since I was in that code :). I say US code because (again, memory is dim) I think they

I'm nearly positive the US code salted the hashes (it's been a long time since I was in that code :). I say US code because (again, memory is dim) I think they had a partnership with a company in the EU and that (might have) included authentication. The platform guys at Riot were the sharpest group of engineers I've worked with. Smart and able to get stuff done without bike shedding. They did stuff right.

cpeterso 14y ago
Why would the US and EU installations have different code or database schemas?
- arkem 14y ago
  Due to the strange syndication/franchise model that Riot has used in the past when setting up in regions other than North America. If I remember correctly the franchisee gets source access and can write their own game lobby code if they like.
  - SoftwareMaven 14y ago
    Exactly this. They did the same thing with Ten Cent in China, I believe.
  - tetha 14y ago
    which is a terrible decision for users that registered before EU exists, just in case you have similar buisness plans.
K2h 14y ago
I forgot what bike shed was. It is focusing on trivial things http://en.wikipedia.org/wiki/Parkinsons_Law_of_Triviality http://en.wikipedia.org/wiki/Parkinsons_Law_of_Triviality
- yesyes 14y ago
  http://bikeshed.org http://bikeshed.org
mrb 14y ago
It is possible to tell the passwords were unsalted because: "We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each" and one of the points of salting is to make impossible to identify identical passwords from the hashes.
- deleted 14y ago
  [deleted]
- arkem 14y ago
  Parent is talking about the League of Legends North American region which does not necessarily share its authentication code base with the European regions which were the ones compromised.
  - mrb 14y ago
    Ok. That would make sense. The parent seemed to claim the leaked passwords were salted.
- chc 14y ago
  Not really. You get that with per-password salting, but having a single salt for your whole database is not uncommon. Since the main point of salting AFAIK is to ward off rainbow tables, it's better than nothing. EDIT: As noted in the comments, the way I put this originally was kind of flip and misleading and I apologize for creating confusion. My point was that I've seen a number of places do it that way, so just throwing at at your problems doesn't necessarily fix everything.
  - mrb 14y ago
    A single salt for the whole DB is not salting. It is no different than a (custom) hash function, which does not prevent identifying identical passwords, and which does not prevent rainbow table cracking.
    - FreakLegion 14y ago
3143 14y ago
Really? They always seemed quite incompetent to me. Upgrades frequently took 3 to 4 times as long as planned. Unscheduled downtimes happened at least once a week. Matchmaking took forever even when servers were busy, and when asked about it on the forums, the developers described their matchmaking algorithm as one that ran in n!! time on the numbers of players looking for a game.

cpeterso 14y ago

Why would the US and EU installations have different code or database schemas?

arkem 14y ago
Due to the strange syndication/franchise model that Riot has used in the past when setting up in regions other than North America. If I remember correctly the franchisee gets source access and can write their own game lobby code if they like.
- SoftwareMaven 14y ago
  Exactly this. They did the same thing with Ten Cent in China, I believe.
- tetha 14y ago
  which is a terrible decision for users that registered before EU exists, just in case you have similar buisness plans.

K2h 14y ago

I forgot what bike shed was. It is focusing on trivial things http://en.wikipedia.org/wiki/Parkinsons_Law_of_Triviality http://en.wikipedia.org/wiki/Parkinsons_Law_of_Triviality

yesyes 14y ago
http://bikeshed.org http://bikeshed.org

mrb 14y ago

It is possible to tell the passwords were unsalted because: "We compared encrypted password hashes and discovered that 11 passwords were shared by over 10,000 players each" and one of the points of salting is to make impossible to identify identical passwords from the hashes.

deleted 14y ago
[deleted]
arkem 14y ago
Parent is talking about the League of Legends North American region which does not necessarily share its authentication code base with the European regions which were the ones compromised.
- mrb 14y ago
  Ok. That would make sense. The parent seemed to claim the leaked passwords were salted.
chc 14y ago
Not really. You get that with per-password salting, but having a single salt for your whole database is not uncommon. Since the main point of salting AFAIK is to ward off rainbow tables, it's better than nothing. EDIT: As noted in the comments, the way I put this originally was kind of flip and misleading and I apologize for creating confusion. My point was that I've seen a number of places do it that way, so just throwing at at your problems doesn't necessarily fix everything.
- mrb 14y ago
  A single salt for the whole DB is not salting. It is no different than a (custom) hash function, which does not prevent identifying identical passwords, and which does not prevent rainbow table cracking.
  - FreakLegion 14y ago

3143 14y ago

Really? They always seemed quite incompetent to me. Upgrades frequently took 3 to 4 times as long as planned. Unscheduled downtimes happened at least once a week. Matchmaking took forever even when servers were busy, and when asked about it on the forums, the developers described their matchmaking algorithm as one that ran in n!! time on the numbers of players looking for a game.