Sepharo wrote on May 23, 2012, 00:48:

Mashiki Amiketo wrote on May 23, 2012, 00:22:
Considering you can glean the answers to most security questions in about 30 seconds because people are idiots and post everything online, I'm sure you can see the problem already. Facebook makes circumventing that trivial, especially since most people use a school, town, pet, or current s/o as their questions.

I'm on all the social networks and I post a lot of info publicly. I challenge you to go find my mother's maiden name and my pet's name in 30 seconds (or I suppose just one of them in 30 seconds)... GO!

No cheating either, you only get 30 seconds, and I'm pretty sure the info is out there somewhere.

Teddy wrote on May 23, 2012, 00:40:

Kitkoan wrote on May 22, 2012, 21:29:
In short, its your fault if our security is broken, thanks for the money.

Not to mention, they totally dodged the issue. So, what happened with this? A lot of accounts got hacked, why? Your security at fault or the users security at fault? What steps are being taken to prevent further problems? Are their steps being taken? Is it being looked into? Or are you just going to point at the Authenticator and hope the problem goes away?

Here's someone that's never had to deal with account security before.

General tip for you, it's almost ALWAYS the user's fault when it comes to security breaches, whether it's games or network security within companies. Users choose poorly constructed passwords, re-use passwords over and over, release their information constantly to phishing scams and other unseemly sources, get viruses on their home machines that consistently need to be weeded out as they transfer files in.

You can protect against direct breaches of your own system. You can't protect against stupid users that don't maintain their own security. That goes for Blizzard just the same as it goes for any other company out there.

Short of Blizzard taking control of your computer and filtering or blocking out any questionable websites for you, what exactly would you like them to do?

Mashiki Amiketo wrote on May 23, 2012, 00:58:
Besides, the point I made about 30 seconds stands true.

Sepharo wrote on May 23, 2012, 00:48:
I'm on all the social networks and I post a lot of info publicly. I challenge you to go find my mother's maiden name and my pet's name in 30 seconds (or I suppose just one of them in 30 seconds)... GO!

No cheating either, you only get 30 seconds, and I'm pretty sure the info is out there somewhere.

Mashiki Amiketo wrote on May 23, 2012, 00:22:
Considering you can glean the answers to most security questions in about 30 seconds because people are idiots and post everything online, I'm sure you can see the problem already. Facebook makes circumventing that trivial, especially since most people use a school, town, pet, or current s/o as their questions.

Kitkoan wrote on May 22, 2012, 21:29:
In short, its your fault if our security is broken, thanks for the money.

Not to mention, they totally dodged the issue. So, what happened with this? A lot of accounts got hacked, why? Your security at fault or the users security at fault? What steps are being taken to prevent further problems? Are their steps being taken? Is it being looked into? Or are you just going to point at the Authenticator and hope the problem goes away?

Mashiki Amiketo wrote on May 23, 2012, 00:22:

Kitkoan wrote on May 23, 2012, 00:00:
What kind of questions are those and thousands of them are being guessed too? Those are rarely touched after first done so a key logger doubtfully would get so many. If they are popping up for hacked accounts, how are they cracking account name, password and rarely touched but uniquely answered private questions? All without getting noticed to a IP/unique warden based ban?

Considering you can glean the answers to most security questions in about 30 seconds because people are idiots and post everything online, I'm sure you can see the problem already. Facebook makes circumventing that trivial, especially since most people use a school, town, pet, or current s/o as their questions.

Kitkoan wrote on May 23, 2012, 00:00:
What kind of questions are those and thousands of them are being guessed too? Those are rarely touched after first done so a key logger doubtfully would get so many. If they are popping up for hacked accounts, how are they cracking account name, password and rarely touched but uniquely answered private questions? All without getting noticed to a IP/unique warden based ban?

Frijoles wrote on May 22, 2012, 23:45:

Kitkoan wrote on May 22, 2012, 23:30:
And with so many accounts they most likely are coming from the same IP area which should set off warning bells when a few hundred accounts suddenly all stop logging in from their last known IP and suddenly are logging in from the same IP area, which the same computer specs that doesn't match their last known configuration (something the warden program is supposed to look at)

They do check, from above:

We also have other measures built into Battle.net to help protect players. Occasionally, when Battle.net detects unusual login activity that differs from your normal behavior -- such as logging in from an unfamiliar location -- we may prompt you for additional information (such as the answer to one of your security questions)

I get the authenticator popup if I try to use a different computer than normal to login (I get it on my main computer about once a month).

Creston wrote on May 22, 2012, 22:40:
That forum seriously makes Bioware's forum look reserved and sensible.

Kitkoan wrote on May 22, 2012, 23:30:
And with so many accounts they most likely are coming from the same IP area which should set off warning bells when a few hundred accounts suddenly all stop logging in from their last known IP and suddenly are logging in from the same IP area, which the same computer specs that doesn't match their last known configuration (something the warden program is supposed to look at)

We also have other measures built into Battle.net to help protect players. Occasionally, when Battle.net detects unusual login activity that differs from your normal behavior -- such as logging in from an unfamiliar location -- we may prompt you for additional information (such as the answer to one of your security questions)

Blackhawk wrote on May 22, 2012, 23:02:
What people are seeing now is, likely as not, months worth of hacked accounts being accessed for the first time all at once.

Blackhawk wrote on May 22, 2012, 23:02:

Creston wrote on May 22, 2012, 22:40:
Yeah, hackers have just managed to brute force thousands of people's of passwords all in one week. There's nothing else going on, just pure sheer luck.

Who says that they did it in a week? These are battle.net accounts, not Diablo III accounts. Blizzard announced you can turn bits into cash a long time ago, while WoW gold has been becoming less and less valuable. Smart hackers have been building up a stock of compromised accounts for a while now, just waiting for Diablo III to go live.

What people are seeing now is, likely as not, months worth of hacked accounts being accessed for the first time all at once.


/edit - and seriously, people using "ABC123" as their password and downloading porn aps isn't a Blizzard security issue.

Blackhawk wrote on May 22, 2012, 23:02:

Creston wrote on May 22, 2012, 22:40:
Yeah, hackers have just managed to brute force thousands of people's of passwords all in one week. There's nothing else going on, just pure sheer luck.

Who says that they did it in a week? These are battle.net accounts, not Diablo III accounts. Blizzard announced you can turn bits into cash a long time ago, while WoW gold has been becoming less and less valuable. Smart hackers have been building up a stock of compromised accounts for a while now, just waiting for Diablo III to go live.

What people are seeing now is, likely as not, months worth of hacked accounts being accessed for the first time all at once.

Cutter wrote on May 22, 2012, 23:01:
So now you have to buy an authenticator - with no guarentees either? Wow, the arrogance of this company is just breathtaking.

Creston wrote on May 22, 2012, 22:40:
Yeah, hackers have just managed to brute force thousands of people's of passwords all in one week. There's nothing else going on, just pure sheer luck.

According to the blizzard fanboys, these people all have keyloggers on their system, and every one of them with an authenticator is lying.

That forum seriously makes Bioware's forum look reserved and sensible.

Creston

Creston wrote on May 22, 2012, 22:40:
Yeah, hackers have just managed to brute force thousands of people's of passwords all in one week. There's nothing else going on, just pure sheer luck.