8 ms·
"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (whi
by swang 14y ago
"Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts."
The part where it says, "answer to the personal security question" were accessed should be EXTREMELY ALARMING. This combined with an email addresses is usually enough to get your password reset on lots of sites. I believe this will reset your password on Google (assuming you're not using 2 factor).
- revx 14y agoThis is why you never use the actual answer to that question, but actually a separate password for those.
- csallen 14y agoThat wouldn't help. For example, let's assume your question was, "Who was your favorite teacher growing up?" and your answer was "fish123jellybean456". If that answer is stored in plaintext (no encryption) in a database that's compromised, then it won't matter that it's not the "real" answer. Attackers will see it, and then use it to answer your security questions on other sites. The only way to protect against this is to ensure you use different answers on different sites. Using a password instead of the correct answer to the question can be helpful, but in a totally different way. Specifically, it eliminates the risk that someone can guess (or research) the answer to your security questions.
- notJim 14y agoPresumably you would use a different answer on every site.
- drucken 14y agoFor most people savy enough to use an arbitrary answer, it is because you can use a different one each time (with the very few exceptions where you may not be able, e.g. banks). Offline portable password managers like Keepass/Password Safe/etc. are immense help for these non-bank services.
- famousactress 14y agoDo these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext?
- bithive123 14y agoI think a good balance between usability and security is to normalize the answer (discard case, punctuation, etc) and then hash it.
- pestaa 14y agoMy favorite security answer is "@#¤ß$ä#$&%^$" so please don't discard case or punctuation. (Yes, I design these answers virtually impossible to brute-force even for myself.)
- cookiecaper 14y agoI too use a random and unique Secret Answer each time I am prompted for one. The Rackspace people, who require the account's SQ/SA before they push you through to the real support people, think I'm weird.
- gizzlon 14y agoI just mash my keyboard for 10 seconds if I have to supply one. But now I wonder if "A bunch of random characters" would be accepted as the answer.. >(
- tterrace 14y agoI've called before to recover an account and the tech support guy asked for the answer to my security question.
- elithrar 14y ago> Do these have to be human-confirmable? Wondering why they're stored in plaintext.. I've been curious about this before. Do you-folks store your challenge-question-answers in plaintext? I would hazard a guess that most sites store "Secret Questions/Answers" in plain text, or a two-way hash (that their support app reverses), as they are used to confirm identity along with the basics (DOB, address, email, etc).
- andthejets 14y agoReset your password via your original email...
- RKearney 14y agoI believe Blizzard makes you supply a scanned copy of your state issued identification in order to get a password reset.
- Shank 14y agoThis is only to remove an authenticator. I just changed my password and it didn't even send a confirmation email to confirm the change - it just changed it and sent me a notification email.
- larrik 14y agoReset password, not change password.
- mattdeboard 14y agoThis is true. Blizzard is unbelievably strict about their account reclamation process. Several years ago I tried to access an account that had been in my ex-wife's name. When I told them that the ex-wife and I weren't in contact, they asked for a copy of the divorce decree, or separation paperwork, or whatever. Seriously. Of course this was in the 2008 timeframe so maybe things have changed/loosened up since then.
- lawnchair_larry 14y agoNo, that is only if you fail the hint question. If you don't know the hint question, they revert to scanned ID. Tried it a few weeks ago.
- Splines 14y agoThis sort of thing kind of bothers me. Is Blizzard in the business of verifying state-issued identification? What prevents me from photoshopping my target's name on top of my own ID?
- riffraff 14y agoI'm not sure how ID cards work across the globe but usually they have some code on them that is supposed to be unique. So you would have to scan your name _and_ the other data, which you would not trivially know. (Yes, I understand that there are ways to get those too)
- deleted 14y ago[deleted]
- notJim 14y agoWow, my secret question is "Who was your first employer?" How is the answer to that even a secret?! Did I pick that or did they?
- HannibalLecter 14y agoYou're supposed to randomize characters and put them in so that more than 32 chars are there. Am I the only person in the world who does this?
- Bloodwine 14y agoWhen storing data on my server I always treat secret questions and answers the same as passwords, because that is exactly what they are. What use is a strong password if a weak secret answer can unlock the account? I salt and hash the secret answers just as I would passwords themselves.
- coldarchon 14y agoI haven't even found a link to change my personal security question, if it was hacked, my account is doomed now no matter if I change my password ..
- Evernoob 14y agoAgreed. I really dislike the "security question" feature a lot of sites force you to enter. In my opinion they make my account much less secure than it would be without this feature. There are plenty of people around who know my email address and have the means to find out my mother's maiden name, or what car I first had or whatever ridiculous information I'm forced to provide to "secure" my account.
- T-zex 14y agoThese shouldn't be genuine answers. Put your grandmothers maiden name instead of your mothers, your first car could be Apollo 11.
- zmb_ 14y agoSecret questions are extreme bad security practice. They're essentially a way to trade off a large amount of user security for reduced customer support costs. It's the same as telling your users to pick a weak password (one that's very likely to be in a dictionary) and then give the attacker a hint what it is. On top of that, many providers (apparently Blizzard included) do not treat the answer to the security question as carefully as a password, e.g., they store it in plain text.