10 ms·
Ubisoft hacked, account data compromised
- codereflection 13y agoI just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.
- eksith 13y agoAs an alternative, you could GPG a text file with all passwords and use... hexdump -n 16 -v -e '/1 "%02X"' /dev/urandom ...as a password generator
- 286c8cb04bda 13y agoopenssl rand 48 -base64
- eksith 13y agoAh, yes. Much shorter and more effective ;)
- just2n 13y agoI built an extension to use PBKDF2 and some other cleverness to generate predictable passwords for websites because I was tired of needing "random" passwords for every site and some kind of password keeper that stored them. I'd rather generate the password when I need it, and to do so from a password I have memorized, but which isn't written down or used anywhere else.
- y0ghur7_xxx 13y agoI'm using cat /dev/urandom |base64 |head -c20 && echo
- cookiecaper 13y agoTry pwgen 20
- deleted 13y ago[deleted]
- zachlatta 13y agoI've been looking for a Lastpass alternative forever. Had no idea Dashlane existed, thanks!
- codereflection 13y agoDashlane is pretty nice, I'm using it and RoboForm, which I've owned for years.
- zachlatta 13y agoHow is RoboForm? I've never used them before.
- codereflection 13y agoShowing it's age. They continue to update it, but it's definitely lacking in usability compared to Dashlane.
- deelowe 13y agoWhy don't you like lastpass? Genuinely curious. I've been pretty happy with them.
- zachlatta 13y agoMostly because the interface is clunky and I'd rather not be forced to have my passwords stored on a company's servers.
- deelowe 13y agoAhh. OK. One small nit. Passwords aren't stored, the has is. If you forget your lastpass password, there's no way to retrieve them. I'm OK with this, which is why I continue to use lastpass. That said, the interface is definitely terrible. It could use a refresh at this point.
- engtech 13y agoI was happy that they included the "you should change your password on all other websites if it is the same" line. I find that's the biggest hurdle that average users can't grasp, it's not about one website getting hacked.. it's that if your ubisoft password is the same as your email address password then they can now log into your email address, which means they can probably take over every online account you have.
- mordae 13y agoYay!
- dclowd9901 13y agoI wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.
- Zikes 13y agoEverything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
- zachlatta 13y agoIs there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
- cookiecaper 13y agoNo. A potential common excuse may be, "No one will remember a secure password in excess of 16 characters, we are trying to minimize support volume", but this is not a "reasonable" excuse.
- groby_b 13y agoYes. It's a DoS vector. The question is, what is a reasonable limit - and 16 characters fails horribly in that section.
- cookiecaper 13y agoRight, as the OP said, there is no reasonable excuse to limit character intake to less than multiple hundreds. I agree that some limit is sensible just to ensure someone doesn't insert War and Peace (or base64-encoded binaries or whatever) as their password.
- psycr 13y agoLet's play the guessing game: by "encrypted" they mean MD5'd?
- Everlag 13y agoBy encrypted they probably mean they applied the most potent of all cryptographic techniques: base64 encoding!
- kmfrk 13y agorot13
- krallin 13y agoI received an email from them - the password was included in the email, in plaintext. So I don't know exactly what they mean, but it's at best symmetric encryption.
- Zikes 13y agoI've got an account with them under two different email addresses, and have gone through the password change process with both. In neither case did I receive an email with my password in it.
- Arnor 13y agoSymmetric Encryption means both sides can access the data. It's different from using a hash (like MD5 or the stronger SHA series) in that it can be reversed given the key. Ouch... that's oversimplified... Here: https://en.wikipedia.org/wiki/Symmetric-key_algorithm https://en.wikipedia.org/wiki/Symmetric-key_algorithm http://cseweb.ucsd.edu/~mihir/cse207/w-se.pdf http://cseweb.ucsd.edu/~mihir/cse207/w-se.pdf
- eranation 13y agoTo add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's emails (Although they have captcha protection so it's not really feasibly or at least less likely in a reasonable cost, but still, I can find out if John Doe has a Ubisoft account or not, e.g. if I'm Joe's manager who works for a competitor, and he swore last night that he never plays Ubisoft games, busted!). So this is what I got from their change password screen: "No account was found matching those entries. No email will be sent." So I'm glad I learned that I don't have my password compromised. but I think someone at Ubisoft need to take web security 101 again p.s. Who encrypts passwords anyway? isn't there a consensus to hash using bcrypt / scrypt + random salt?
- cookiecaper 13y agoNo one encrypts passwords. They just refer to one-way hashes, typically MD5, as encryption.
- andrewmunsell 13y agoUnfortunately, I have to disagree. In fact, there are some large vendors of software that truly use encryption instead of some form of one way hashing. Sadly, I have to deal with software like this and there's no chance it's going to change any time soon.
- mattmanser 13y agoIt's a built-in feature of ASP.Net's membership provider (user accounts for those not knowing MS's Enterprise Obfuscation Naming And Extension Standard).
- recursive 13y agoBut that behavior is configurable.
- lampe3 13y agocan someone please make a hall of shame for all the big Companies which where hacked! i think there are quite a lot by now.
- Everlag 13y agoIt shouldn't be a hall of shame for companies being hacked, getting hacked is thing you can only mitigate not prevent. The shaming should be for storing your sensitive data in an insufficiently secure manner. If a company used scrypt to hash their passwords then they would essentially have no issue with getting hacked.
- viraptor 13y agoAlready there: http://plaintextoffenders.com/ http://plaintextoffenders.com/
- Zikes 13y agoHacking is inevitable.
- RKearney 13y agoWhile 0-day vulnerabilities will always get the best of some companies, there are some security breaches that are just due to plain negligence of the company. I believe I recall Sony getting hacked, and tons of plain-text credit card numbers were hacked. It was discovered that Sony didn't even follow even the most simple of PCI compliance. It's things like that that deserve the "hall of shame"
- Zikes 13y agoI have a PSN account and indeed had an account during that event. There was tons of wild speculation about what data was breached, but there was no evidence that credit card numbers were included. Sony unfortunately only fueled those rumors by refusing to comment on the specifics, but I can assure you that if they were storing "tons of plain-text credit card numbers" there would have been a legal shitstorm the likes of which we have not seen in many a year, including a class-action lawsuit. I have yet to receive any invitations to participate in any such lawsuit.
- deleted 13y ago[deleted]
- Arnor 13y ago> No personal payment information is stored with Ubisoft, meaning your credit/debit card information was not at risk from this intrusion. Sure they can't read the data right of the disk, but what about a MITM? If the intruder had access to the application server, there's a good chance the credit card data was in memory at some point. If the data ever touches the server memory in an unencrypted form, the intruder could have it...
- deleted 13y ago[deleted]
- dansanderson 13y agoThey sent a notification email to every customer asking them to change their password. The email includes the user's current password. I know this because I received such an email-- intended for someone else who accidentally used my email address for their account. So not only is Ubisoft storing raw passwords and sending them via email, they're not verifying email addresses during account creation.
- Brandon0 13y agoNo way, really? According to the article they claim to "encrypt" the passwords (they actually mean hash). Any way you could post the contents of the email (minus the personal details)?
- dclowd9901 13y agoI think he's misunderstanding the email: >As a result, we are recommending that you change the password for your account: dclowd9901 All I see is the plaintext representation of my username.
- dansanderson 13y agoAh, glad to have that clarified. The username in the misdelivered email I received looked very much like an attempt at a memorable password, not a username. Thanks!
- devinegan 13y agoUbisoft should have a look at LaunchKey (https://launchkey.com https://launchkey.com) which went out of private beta yesterday. Passwords being compromised should be a thing of the past.
- jheimark 13y agoI received an email from Ubisoft and assumed I was being phished. They are not doing a good job of fixing the problem here. They should have a cert on the splash redirect page. I wasn't sure if ubi.com was actually Ubisoft. Even worse, the email I got had some terrible font - practically unreadable. Those two factors combined did not make me feel that giving them my password is a good idea.