3 ms·

Just curious, are you actually a data security professional? Because while you have a very nice metaphor with the whole bank vault thing, you haven't offered an

Just curious, are you actually a data security professional? Because while you have a very nice metaphor with the whole bank vault thing, you haven't offered any actual examples, or any specific criticisms of Blizzard's setup (not that we know what it was), or even examples of what you're talking about. I know nothing about data security myself, but I'm not exactly learning anything about it from your posts. Sorry to be rudely blunt, but I've seen a lot of people who have no idea what Blizzard is up against, the difficulty/feasibility of protecting digital data, what Blizzard has in place, or even what Blizzard could/should have in place really criticizing Blizzard for incompetence here, and that's odd to me.

DigitalSea 14y ago
I may or may not be a data security professional, but I hardly see how that would make anything I've said more or less credible. Without knowing how Blizzard have set up their infrastructure, I can't really give any examples because each environment is different and requires different forms of security and protocols in place. While Blizzard were apparently using SRP and while I can't say for sure I am guessing Blizzard are using the SRP authentication algorithm out-of-the-box which is bad for a number of reasons, but the main one being SRP by default is an over-glorified way of SHA1 encrypted and salting a password and by the sounds of it the hackers were able to access those salts and could theoretically brute force the passwords which by todays hardware capabilities is not very hard at all, this is LinkedIn all over again. Take a look at the SRP design specification: http://srp.stanford.edu/design.html http://srp.stanford.edu/design.html - if Blizzard didn't modify the algorithm, I think we've yet to see the full effects of this breach. LinkedIn learned the hard way and now one of the worlds largest multiplayer gaming companies is about to find out what a simple mistake like this can do. I hope for their sakes they customised SRP and if they didn't, I think we have the right to know. As a Battle.net account holder, I have the right to voice my concerns about this. I paid money for the privilege of playing Blizzard's games - fortunately my Battle.net password is separate to that of any other account I have, but I feel sorry for the millions who re-use their password for their email accounts, Internet banking and other various accounts that could have all kinds of effects.
- comex 14y ago
  Would you mind stating what weaknesses you see in the unmodified SRP? Against a server compromise it's equivalent to salted hash storage, but it's impossible, in general, to do better without losing the ability to authenticate using the password (only). Edit: do you mean the weakness of salted SHA-1? SRP is not defined for SHA-1 only.

DigitalSea 14y ago

I may or may not be a data security professional, but I hardly see how that would make anything I've said more or less credible. Without knowing how Blizzard have set up their infrastructure, I can't really give any examples because each environment is different and requires different forms of security and protocols in place. While Blizzard were apparently using SRP and while I can't say for sure I am guessing Blizzard are using the SRP authentication algorithm out-of-the-box which is bad for a number of reasons, but the main one being SRP by default is an over-glorified way of SHA1 encrypted and salting a password and by the sounds of it the hackers were able to access those salts and could theoretically brute force the passwords which by todays hardware capabilities is not very hard at all, this is LinkedIn all over again. Take a look at the SRP design specification: http://srp.stanford.edu/design.html http://srp.stanford.edu/design.html - if Blizzard didn't modify the algorithm, I think we've yet to see the full effects of this breach. LinkedIn learned the hard way and now one of the worlds largest multiplayer gaming companies is about to find out what a simple mistake like this can do. I hope for their sakes they customised SRP and if they didn't, I think we have the right to know. As a Battle.net account holder, I have the right to voice my concerns about this. I paid money for the privilege of playing Blizzard's games - fortunately my Battle.net password is separate to that of any other account I have, but I feel sorry for the millions who re-use their password for their email accounts, Internet banking and other various accounts that could have all kinds of effects.

comex 14y ago
Would you mind stating what weaknesses you see in the unmodified SRP? Against a server compromise it's equivalent to salted hash storage, but it's impossible, in general, to do better without losing the ability to authenticate using the password (only). Edit: do you mean the weakness of salted SHA-1? SRP is not defined for SHA-1 only.