4 ms·

This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A compan

This is ridiculous. Maybe the world is ending, because it feels like every major website/provider of some popular service is getting hacked these days. A company of Blizzard's stature and wallet size has no excuse for this kind of thing happening, no excuse at all. If you're charging people exorbitant amounts of cash to buy your games and then charging some of your customers a fee for the privilege of using your so-called "secure" servers every month then you should be providing a certain level of security in return, it's not rocket science - employ someone who knows how to secure a server. This is certainly not limited to Blizzard, it seems like everyday there is a new story about some kind of security breach and then we're told to change our passwords and some details may have been stolen. As an owner of both Starcraft 2 and Diablo III and I am heavily disappointed especially considering how much I paid for both of those games here in Australia (bought digitally as well).

zheng 14y ago
Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.
- Steko 14y ago
  Security seems like a priority at Blizzard based on everything I know. Priority =/= invulnerability.
  - DrStalker 14y ago
    I was able to get an authenticator from Blizzrd years before my bank made it possible to do the same. They care about security if only because they lose a lot of money spending time to fix up hacked accounts, and this will be even worse now they have a real-money auction house. In WoW they can just rollback items and if they duplicate some that were sold off by attackers it's no big deal. If they start duplicating real money then they need to pay out on it.
- colanderman 14y ago
  Blizzard doesn't exactly target "average consumers". Many WoW players are very serious gamers, and StarCraft is played for $$$.
StavrosK 14y ago
Well, they're using SRP for authentication, which I didn't know about (and I don't consider myself especially illiterate when it comes to security), so it doesn't sound like they don't care about it.
alanfalcon 14y ago
Blizzard is _literally_ under _constant_ attack and has an incredible security team in place. Obviously the only acceptable result is 100% attack deflection, but the idea that this could be or could have been anything short of an absolute top priority for the company is a ridiculous assertion that I'd expect on any other site, but not HN. I'm a former Blizzard employee with knowledge of the situation and internal workings. EDIT: I am, of course, not remotely qualified to speak for Blizzard or the security team.
- DigitalSea 14y ago
  Security has nothing to do with preventing the attack, it's more so protecting the data much like a bank protects it's assets. It's pretty easy to break into a bank (they're merely glass and brick after all), but there is no way you're getting into that vault once inside and even so, if you get into the vault there are secondary security procedures in place to ensure that nothing is easily taken. So regardless of whether or not Blizzard is under constant attack, just because someone can get in doesn't mean they should be able to take anything.. I really do hope Blizzard don't go into the banking industry because everyone will be lining up to steal what they can from the easily penetrable building and vault inside. There is no excuse. If Blizzard is under constant attack, you'd think they'd be smarter about how data is stored and just what an attacker could see if they gained access to a database of any kind. So once again, my point was not about deflecting attacks because that's impossible, it's about making it almost impossible for the hacker to use any of the information he can access.
  - Steko 14y ago
    Did you really just insinuate that banks never get robbed?
    - DigitalSea 14y ago
      I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors. A database is a vault. It's for storing things you don't want anyone to be able to access and even if a hacker can access it, they shouldn't be able to do anything with the data that they can see. Banks get robbed all of the time, but the damage is minimal because the cash available over a counter is a write-down for a bank that keeps most of it's wealth in a vault onsite or offsite.
dagrz 14y ago
You are pointing your anger in the wrong direction. The reality is that security is a hard problem, much too hard for Blizzard, much too hard for RSA, much too hard for banks, and much too hard for governments. Major companies being hacked is not a new phenomenon. What's new is them (a) detecting the hacks and (b) disclosing them. It's unfortunate but true; you should be happy that they are telling you.
- DigitalSea 14y ago
  You misunderstood my entire comment, but I can see why you would think I was angry. I'm disappointed, not angry. Disappointed that in this day and age, companies like Blizzard are making record profits and fall prey to attacks that are sometimes as simple as an SQL injection attack. While I am grateful they have told us about the attack, I'd much prefer the situation went like this: "We've been attacked, our database was compromised but because everything important is encrypted all they have is your email address"

zheng 14y ago

Blizzard operates in a free market. Average consumers don't care that much about security until something happens, then they forget. Therefore, security isn't a priority to Blizzard. It is really as simple as that.

Steko 14y ago
Security seems like a priority at Blizzard based on everything I know. Priority =/= invulnerability.
- DrStalker 14y ago
  I was able to get an authenticator from Blizzrd years before my bank made it possible to do the same. They care about security if only because they lose a lot of money spending time to fix up hacked accounts, and this will be even worse now they have a real-money auction house. In WoW they can just rollback items and if they duplicate some that were sold off by attackers it's no big deal. If they start duplicating real money then they need to pay out on it.
colanderman 14y ago
Blizzard doesn't exactly target "average consumers". Many WoW players are very serious gamers, and StarCraft is played for $$$.

StavrosK 14y ago

Well, they're using SRP for authentication, which I didn't know about (and I don't consider myself especially illiterate when it comes to security), so it doesn't sound like they don't care about it.

alanfalcon 14y ago

Blizzard is _literally_ under _constant_ attack and has an incredible security team in place. Obviously the only acceptable result is 100% attack deflection, but the idea that this could be or could have been anything short of an absolute top priority for the company is a ridiculous assertion that I'd expect on any other site, but not HN. I'm a former Blizzard employee with knowledge of the situation and internal workings. EDIT: I am, of course, not remotely qualified to speak for Blizzard or the security team.

DigitalSea 14y ago
Security has nothing to do with preventing the attack, it's more so protecting the data much like a bank protects it's assets. It's pretty easy to break into a bank (they're merely glass and brick after all), but there is no way you're getting into that vault once inside and even so, if you get into the vault there are secondary security procedures in place to ensure that nothing is easily taken. So regardless of whether or not Blizzard is under constant attack, just because someone can get in doesn't mean they should be able to take anything.. I really do hope Blizzard don't go into the banking industry because everyone will be lining up to steal what they can from the easily penetrable building and vault inside. There is no excuse. If Blizzard is under constant attack, you'd think they'd be smarter about how data is stored and just what an attacker could see if they gained access to a database of any kind. So once again, my point was not about deflecting attacks because that's impossible, it's about making it almost impossible for the hacker to use any of the information he can access.
- Steko 14y ago
  Did you really just insinuate that banks never get robbed?
  - DigitalSea 14y ago
    I didn't say that at all. I said it's easy to break into a bank but getting into a vault in this day and age is impossible. And if you somehow by luck or knowledge get into the vault there are secondary, third, etc security procedures in place such as alarms, self-locking doors, cameras and heat/movement detectors. A database is a vault. It's for storing things you don't want anyone to be able to access and even if a hacker can access it, they shouldn't be able to do anything with the data that they can see. Banks get robbed all of the time, but the damage is minimal because the cash available over a counter is a write-down for a bank that keeps most of it's wealth in a vault onsite or offsite.

dagrz 14y ago

You are pointing your anger in the wrong direction. The reality is that security is a hard problem, much too hard for Blizzard, much too hard for RSA, much too hard for banks, and much too hard for governments. Major companies being hacked is not a new phenomenon. What's new is them (a) detecting the hacks and (b) disclosing them. It's unfortunate but true; you should be happy that they are telling you.

DigitalSea 14y ago
You misunderstood my entire comment, but I can see why you would think I was angry. I'm disappointed, not angry. Disappointed that in this day and age, companies like Blizzard are making record profits and fall prey to attacks that are sometimes as simple as an SQL injection attack. While I am grateful they have told us about the attack, I'd much prefer the situation went like this: "We've been attacked, our database was compromised but because everything important is encrypted all they have is your email address"