7 ms·

I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/pl

I wouldn't care so much about this, except that I am often essentially required to give my data to Ubisoft (and other third party publishers) in order to buy/play their games. EA, you're no better. Why are all these companies adamant about trying to bootstrap their own services. It's maddening, and it only causes things like this to happen. Steam exists, and it's amazing. Stop trying to do better -- you won't.

Zikes 13y ago
Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.
- zachlatta 13y ago
  Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
  - cookiecaper 13y ago
    No. A potential common excuse may be, "No one will remember a secure password in excess of 16 characters, we are trying to minimize support volume", but this is not a "reasonable" excuse.
    - groby_b 13y ago
      Yes. It's a DoS vector. The question is, what is a reasonable limit - and 16 characters fails horribly in that section.
      - cookiecaper 13y ago
        Right, as the OP said, there is no reasonable excuse to limit character intake to less than multiple hundreds. I agree that some limit is sensible just to ensure someone doesn't insert War and Peace (or base64-encoded binaries or whatever) as their password.
        Brandon0 13y ago
        I was using War and Peace -- now I have to go change my passwords. Thanks!
        kibibu 13y ago
        ...a dependence of which we are not conscious.2
  - Pxtl 13y ago
    None that wouldn't be better handled with a warning of "excessive password complexity, we're not sure you'll remember this". Even truncating all password entries (create/change and auth) and simply taking the used subset would be better than blocking me from using my intended password.
    - trothoun 13y ago
      Hmmm... if your password was password30jf0sd09jga09ja0i9sdfasi09djf0-sdj9faspiodjf and they only used the first 8 characters, you'd think you had a strong password, but would really have a very weak password. Hashing then truncating as discussed above would be much safer.
      - jlgreco 13y ago
        Really no reason to truncate after hashing. The output size of any cryptographic hash function should be more than small enough to send down the wire and hash again properly. Really though, just reject passwords over a few KB. Nobody will ever notice that limit except for people trying to fuck with you.
  - Zikes 13y ago
    The only reasonable restriction is in overall POST body length. I recall an exploit once on node.js where unreasonably large POST requests could DDOS a server with minimal effort.
    - zachlatta 13y ago
      Well, that and the server having to hash a huge password.
  - quaunaut 13y ago
    There's no reason to limit the length of passwords whatsoever, except perhaps to be sure you're not trying to hash 20mb of text.
    - just2n 13y ago
      You could really support an arbitrary password size by locally hashing the password to a length at least as long as the one you store in the database to preserve entropy, then send the fixed length hash as the user's "password", and hash it again on the server using something slower, like PBKDF2 with a few thousand rounds.
      - Hello71 13y ago
        How do you think hashing functions work?
        TillE 13y ago
        At least on the web, hashing isn't usually done locally (ie, in Javascript).
        alexjeffrey 13y ago
        this doesn't add extra security - the first hash becomes a substitute password. A cracker could modify their steam account to take said hash as input and sent it directly over the wire.
        just2n 13y ago
        It doesn't remove any security, either. If you perform a hash on the server that sends an arbitrary input size to a fixed number of bits, the attacker needs only to try O(2^n) different inputs where n is the number of bits of that hash. By using a hash with at least n bits as a substitute password, there's no less security. It does mitigate the DoS vector, however.
  - misterdai 13y ago
    Only the support issue, but then I'd have thought that people using really long passwords as normally the ones who'll make an effort to remember / store them. They mention "Encrypted passwords", which would vary the amount of storage required in their database and also make the passwords retrievable if the attacker had gained access to the key / algorithm etc... I'd had preferred if they used a one way hash instead, obviously with a secure hash algorithm, uniquely salted and rehashed multiple times. All passwords would then be the same length when stored and users wouldn't have to have such a low maximum limit. There are worse offenders for low character limits, like Adobe with a 12 char maximum. Used to be a site that listed some, just a shame it's no longer available http://web.archive.org/web/20100526105638/http://www.weakpasswords.org/list http://web.archive.org/web/20100526105638/http://www.weakpas...
- pmh 13y ago
  The Steam forums were hacked in Nov 2011. The hackers got access to a DB with Steam users' personal information. http://arstechnica.com/gaming/2011/11/valve-confirms-steam-hack-credit-cards-personal-info-may-be-stolen/ http://arstechnica.com/gaming/2011/11/valve-confirms-steam-h...
  - Zikes 13y ago
    Valve's game development servers were also hacked, and Half Life 2's source code was leaked before the game even launched. No company is immune from hacking, the best anyone can hope for is secure hashing functions are in place and that financial and user account data are properly separated.
missing_cipher 13y ago
Relying on one service is good for no one. Specially consumers.
- TheCraiggers 13y ago
  It's better for my hard drive and RAM. It's bad enough having just one program on my PC whose only purpose is to allow me to play the games I've purchased legitimately, I don't want any more. It's also better for That One Service... but that's besides the point. ;-)
FredFredrickson 13y ago
I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop trying to compete entirely, either.
- kcbanner 13y ago
  I agree. However, in every current case Steam is just making all these other platforms look bad.
- cookiecaper 13y ago
  The other companies aren't really trying to compete with Steam per se, they just want to inject their own custom babysitter to analyze your computer and see if they're complying with their rules. When you open a game from Steam that's produced by one of these companies, it chains in its own loaders and achievements and stuff. It totally sucks, and it's a terrible end user experience. It'll be exciting when the fogies in charge of these companies die out. They seem to have difficulty grasping the concept of computers and digital distribution.
  - HelloMcFly 13y ago
    I think they are probably more interested in avoiding the ~15-30% (rumored) cut that Steam takes for digital sales of their games. And I know in EA's case, they want to sell DLC through their game, not through Steam's client specifically to avoid that charge (that's the reason some EA games were removed from Steam when Valve changed their policy on the matter).
    - cookiecaper 13y ago
      They do this even on games purchased directly through Steam. It's obviously not about cutting out Steam, because they still facilitate their sales via Steam and presumably are still obliged to render commissions. As Ubisoft says in their own announcement, UPlay did not accept payments directly; distribution channels like Steam or physical retail were still required to obtain the games.
biot 13y ago
That's a pretty lousy, defeatist attitude to have. "Girls, stop trying to be as good at math as boys -- you won't." "Google, stop trying to do better than AltaVista/HotBot/Lycos/Excite -- you won't." "Apple/Linux, stop trying to do better than Microsoft -- you won't." "PlayStation/Xbox, stop trying to do better than Nintendo -- you won't." "Tesla, stop trying to do better than Toyota -- you won't." "Renewable energy companies, stop trying to do better than fossil fuels -- you won't."
- andybak 13y ago
  "User-hostile dinosaur companies. Stop trying to do better than..." Oh wait.
wmf 13y ago
This is what happens when companies try to own the customer relationship and use their own customers as strategic weapons. Steam isn't a neutral party.
shmerl 13y ago
Here is a good list of DRM free Ubisoft games: http://www.gog.com/catalogue?search=Ubisoft http://www.gog.com/catalogue?search=Ubisoft This doesn't matter though in regards to personal information. Any service where you buy the game will have your information for the sake of enabling purchase. Steam is no better here, and even GOG. If either of them is hacked - your personal info will be leaked.

Zikes 13y ago

Everything else being equal, Steam may well end up being similarly hacked in the future. The big difference with them is that they use 2FA, so even if your hashed password were stolen and cracked, they still would not be able to access your account. Edit: I just went through Ubi's password change process, they also restrict password lengths to 8 to 16 characters. Annoys the heck out of me when companies do this.

zachlatta 13y ago
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
- cookiecaper 13y ago
  No. A potential common excuse may be, "No one will remember a secure password in excess of 16 characters, we are trying to minimize support volume", but this is not a "reasonable" excuse.
  - groby_b 13y ago
    Yes. It's a DoS vector. The question is, what is a reasonable limit - and 16 characters fails horribly in that section.
    - cookiecaper 13y ago
      Right, as the OP said, there is no reasonable excuse to limit character intake to less than multiple hundreds. I agree that some limit is sensible just to ensure someone doesn't insert War and Peace (or base64-encoded binaries or whatever) as their password.
      - Brandon0 13y ago
        I was using War and Peace -- now I have to go change my passwords. Thanks!
        kibibu 13y ago
        ...a dependence of which we are not conscious.2
- Pxtl 13y ago
  None that wouldn't be better handled with a warning of "excessive password complexity, we're not sure you'll remember this". Even truncating all password entries (create/change and auth) and simply taking the used subset would be better than blocking me from using my intended password.
  - trothoun 13y ago
    Hmmm... if your password was password30jf0sd09jga09ja0i9sdfasi09djf0-sdj9faspiodjf and they only used the first 8 characters, you'd think you had a strong password, but would really have a very weak password. Hashing then truncating as discussed above would be much safer.
    - jlgreco 13y ago
      Really no reason to truncate after hashing. The output size of any cryptographic hash function should be more than small enough to send down the wire and hash again properly. Really though, just reject passwords over a few KB. Nobody will ever notice that limit except for people trying to fuck with you.
- Zikes 13y ago
  The only reasonable restriction is in overall POST body length. I recall an exploit once on node.js where unreasonably large POST requests could DDOS a server with minimal effort.
  - zachlatta 13y ago
    Well, that and the server having to hash a huge password.
- quaunaut 13y ago
  There's no reason to limit the length of passwords whatsoever, except perhaps to be sure you're not trying to hash 20mb of text.
  - just2n 13y ago
    You could really support an arbitrary password size by locally hashing the password to a length at least as long as the one you store in the database to preserve entropy, then send the fixed length hash as the user's "password", and hash it again on the server using something slower, like PBKDF2 with a few thousand rounds.
    - Hello71 13y ago
      How do you think hashing functions work?
      - TillE 13y ago
        At least on the web, hashing isn't usually done locally (ie, in Javascript).
        alexjeffrey 13y ago
        this doesn't add extra security - the first hash becomes a substitute password. A cracker could modify their steam account to take said hash as input and sent it directly over the wire.
        just2n 13y ago
        It doesn't remove any security, either. If you perform a hash on the server that sends an arbitrary input size to a fixed number of bits, the attacker needs only to try O(2^n) different inputs where n is the number of bits of that hash. By using a hash with at least n bits as a substitute password, there's no less security. It does mitigate the DoS vector, however.
- misterdai 13y ago
  Only the support issue, but then I'd have thought that people using really long passwords as normally the ones who'll make an effort to remember / store them. They mention "Encrypted passwords", which would vary the amount of storage required in their database and also make the passwords retrievable if the attacker had gained access to the key / algorithm etc... I'd had preferred if they used a one way hash instead, obviously with a secure hash algorithm, uniquely salted and rehashed multiple times. All passwords would then be the same length when stored and users wouldn't have to have such a low maximum limit. There are worse offenders for low character limits, like Adobe with a 12 char maximum. Used to be a site that listed some, just a shame it's no longer available http://web.archive.org/web/20100526105638/http://www.weakpasswords.org/list http://web.archive.org/web/20100526105638/http://www.weakpas...
pmh 13y ago
The Steam forums were hacked in Nov 2011. The hackers got access to a DB with Steam users' personal information. http://arstechnica.com/gaming/2011/11/valve-confirms-steam-hack-credit-cards-personal-info-may-be-stolen/ http://arstechnica.com/gaming/2011/11/valve-confirms-steam-h...
- Zikes 13y ago
  Valve's game development servers were also hacked, and Half Life 2's source code was leaked before the game even launched. No company is immune from hacking, the best anyone can hope for is secure hashing functions are in place and that financial and user account data are properly separated.

missing_cipher 13y ago

Relying on one service is good for no one. Specially consumers.

TheCraiggers 13y ago
It's better for my hard drive and RAM. It's bad enough having just one program on my PC whose only purpose is to allow me to play the games I've purchased legitimately, I don't want any more. It's also better for That One Service... but that's besides the point. ;-)

FredFredrickson 13y ago

I have mixed feelings about that. On the one hand, I fully agree - I hate having all kinds of junky game clients running on my computer when I ought to just be able to have one, Steam, which is obviously doing a decent job. On the other hand, I think that competition will drive Steam to be better (or maybe, just maybe, result in something better than Steam), and so I don't necessarily want the other companies to stop trying to compete entirely, either.

kcbanner 13y ago
I agree. However, in every current case Steam is just making all these other platforms look bad.
cookiecaper 13y ago
The other companies aren't really trying to compete with Steam per se, they just want to inject their own custom babysitter to analyze your computer and see if they're complying with their rules. When you open a game from Steam that's produced by one of these companies, it chains in its own loaders and achievements and stuff. It totally sucks, and it's a terrible end user experience. It'll be exciting when the fogies in charge of these companies die out. They seem to have difficulty grasping the concept of computers and digital distribution.
- HelloMcFly 13y ago
  I think they are probably more interested in avoiding the ~15-30% (rumored) cut that Steam takes for digital sales of their games. And I know in EA's case, they want to sell DLC through their game, not through Steam's client specifically to avoid that charge (that's the reason some EA games were removed from Steam when Valve changed their policy on the matter).
  - cookiecaper 13y ago
    They do this even on games purchased directly through Steam. It's obviously not about cutting out Steam, because they still facilitate their sales via Steam and presumably are still obliged to render commissions. As Ubisoft says in their own announcement, UPlay did not accept payments directly; distribution channels like Steam or physical retail were still required to obtain the games.

biot 13y ago

That's a pretty lousy, defeatist attitude to have. "Girls, stop trying to be as good at math as boys -- you won't." "Google, stop trying to do better than AltaVista/HotBot/Lycos/Excite -- you won't." "Apple/Linux, stop trying to do better than Microsoft -- you won't." "PlayStation/Xbox, stop trying to do better than Nintendo -- you won't." "Tesla, stop trying to do better than Toyota -- you won't." "Renewable energy companies, stop trying to do better than fossil fuels -- you won't."

andybak 13y ago
"User-hostile dinosaur companies. Stop trying to do better than..." Oh wait.

wmf 13y ago

This is what happens when companies try to own the customer relationship and use their own customers as strategic weapons. Steam isn't a neutral party.

shmerl 13y ago

Here is a good list of DRM free Ubisoft games: http://www.gog.com/catalogue?search=Ubisoft http://www.gog.com/catalogue?search=Ubisoft This doesn't matter though in regards to personal information. Any service where you buy the game will have your information for the sake of enabling purchase. Steam is no better here, and even GOG. If either of them is hacked - your personal info will be leaked.