Re:Diablo 3 bug report: "Passwords not case-sensitive."
by tptacek on Friday May 25, 2012 @06:20AM
(#4022852)
They're using SRP, which dictates that they're storing passwords (relatively) securely on their side. You don't have to guess; this stuff has been reversed.
Re:Diablo 3 bug report: "Passwords not case-sensitive."
by uxp on Friday May 25, 2012 @10:48AM
(#4023724)
Storing un-hashed passwords (encrypted or otherwise)?
I'm largely unaware of crypto outside of the general "use bcrypt" webapp cases. SRP is a fairly unknown field to me.
Edit: nevermind, you more or less confirmed this question further down this thread[1], and [2]
I'll say for a third time, as you're not the first person to reply in kind, I'm more than well aware of ways this could be done, but none of them meet the typical expectation of how passwords are hashed and I would guess/assume that someone is far more likely to be insecurely storing passwords than going out of their way to store a... reduced entropy version of users' passwords in their database.