4 ms·

So I went to update my password for my World of Warcraft account after I saw this. And guess what I discovered, my current password is more secure than their c

So I went to update my password for my World of Warcraft account after I saw this. And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them) I was wondering why even after you discovered a security breach you have not updated your password policy to actually allow secure passwords. Your current password policy only allows password that will take a day or two to brute force crack. see http://xkcd.com/936/ http://xkcd.com/936/ These two rules totally nullify any security of your passwords "Your password must be between 8–16 characters in length. Your password may only contain alphabetic characters (A–Z), numeric characters (0–9), and punctuation." In fact my current password is better since I apparently created it before your policy changed to not allow non alpha-numeric characters. The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely. Please update your password policy to "Your password must be at least 20 characters long." That is it, let me make a 400 character password if I want, let me use cyrillic, chinese, or whatever other unicode characters I want to use. If you truly care about security you will fix your broken password policy!

elithrar 14y ago
> "The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely." That is certainly not the only reason to have those rules; in fact, it's probably one of the least popular reasons. It's done to keep customers creating short-ish passwords, which are likely to be more memorable, and therefore reduce the support load for password resets. Whether this is actually effective or not is another thing entirely.
- Digitalxero 14y ago
  they have a "I am an idiot and forgot my password" button so people forgetting their passwords is no additional support, and if they allow longer password it actually makes them easier for people to remember and harder to crack, win win.
Steko 14y ago
You can't brute force Blizzard passwords because they have server side limits.
- lwat 14y ago
  But in this case the server was compromised, so they can sit at home and brute force the hashes all day long.
jcase 14y ago
Note that e.g. BCrypt has a maximum passphrase length of 56 characters. http://bcrypt.sourceforge.net/ http://bcrypt.sourceforge.net/

elithrar 14y ago

> "The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely." That is certainly not the only reason to have those rules; in fact, it's probably one of the least popular reasons. It's done to keep customers creating short-ish passwords, which are likely to be more memorable, and therefore reduce the support load for password resets. Whether this is actually effective or not is another thing entirely.

Digitalxero 14y ago
they have a "I am an idiot and forgot my password" button so people forgetting their passwords is no additional support, and if they allow longer password it actually makes them easier for people to remember and harder to crack, win win.

Steko 14y ago

You can't brute force Blizzard passwords because they have server side limits.

lwat 14y ago
But in this case the server was compromised, so they can sit at home and brute force the hashes all day long.

jcase 14y ago

Note that e.g. BCrypt has a maximum passphrase length of 56 characters. http://bcrypt.sourceforge.net/ http://bcrypt.sourceforge.net/