Re:Blizzard Network Breached; Change Your Battle.Net Passwords
by elithrar on Thursday August 09, 2012 @09:15PM
(#4364302)
> "The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely."
That is certainly not the only reason to have those rules; in fact, it's probably one of the least popular reasons.
It's done to keep customers creating short-ish passwords, which are likely to be more memorable, and therefore reduce the support load for password resets.
Whether this is actually effective or not is another thing entirely.
Re:Blizzard Network Breached; Change Your Battle.Net Passwords
by Digitalxero on Thursday August 09, 2012 @11:30PM
(#4364743)
they have a "I am an idiot and forgot my password" button so people forgetting their passwords is no additional support, and if they allow longer password it actually makes them easier for people to remember and harder to crack, win win.
Re:Blizzard Network Breached; Change Your Battle.Net Passwords
by jcase on Thursday August 09, 2012 @11:00PM
(#4364645)
Note that e.g. BCrypt has a maximum passphrase length of 56 characters.
And guess what I discovered, my current password is more secure than their current password policy will allow. So I filled out a support ticket with the following question (which all Blizzard account holders should ask them)
I was wondering why even after you discovered a security breach you have not updated your password policy to actually allow secure passwords. Your current password policy only allows password that will take a day or two to brute force crack. see http://xkcd.com/936/
These two rules totally nullify any security of your passwords
"Your password must be between 8–16 characters in length. Your password may only contain alphabetic characters (A–Z), numeric characters (0–9), and punctuation."
In fact my current password is better since I apparently created it before your policy changed to not allow non alpha-numeric characters.
The only reason to have those two rules is because you are storing the password in plain text so anyone who gets access to the database can read them freely. Please update your password policy to
"Your password must be at least 20 characters long."
That is it, let me make a 400 character password if I want, let me use cyrillic, chinese, or whatever other unicode characters I want to use. If you truly care about security you will fix your broken password policy!