Blizzard intentionally makes passwords non-case sensitive

oteren · 1 day

Bingo.

And for those who want maximum security: Use the OTP authenticator.

oteren · 1 day

They have an authenticator FOB or a free smartphone app that will give you a OTP for 2-factor login. Secure enough for you?

When you have that enabled, your password can be 1234 and you're still more secure from brute force than 90% of other services.

mycall · 1 day

I think your problem is likely to be finding a source of time that you can trust.

harikt · 2 days

Until you try and align a line continuation, then everything goes to shit.

harikt · 2 days

Suck it up and conform.

Ask any Python developer worth their salt what PEP8 has done for their ecosystem. EVERYTHING is written in the same style.

harikt · 2 days

Yes - and it was Zend's coding standard before this also.

harikt · 2 days

People should just turn on smart tabs in their editor.

Editing and navigating freedom of tabs, writes spaces to the file, every thing aligns perfectly. At this stage, I don't care whether they had picked spaces OR tabs - I'm glad that they picked one.

Hopefuly the PSR-* can be like PEP8 from the Python world and bring in standardised code.

harikt · 2 days

Then you're trying to align a continued line with spaces against an indented line with tabs that could be anywhere from 2-8 characters wide.

xmido · 3 days

In that case, I think you may be disappointed here.

xmido · 3 days

If that's the case I wouldn't worry about it, there's literally nothing you can do to not be hacked in-game.

Would really, really like to see some proof or at least some actual information around this apart from chinese whispers and conjecture. Would be tempted to fire up wireshark myself if the servers were running :)

xmido · 3 days

Yeah, nothing's perfect of course but in the case of malware/keylogger - the authenticator token reduces the attack surface by such a huge factor it would almost be impractical to exploit.

xmido · 3 days

Ok, well that's not MitM but session hijacking. Same thing if I took your reddit cookie.

If D3 client is disclosing a trusted secret then that allows access to the game, yes, this is srsbsns.

But I'm seriously skeptical that the "session ID" grants access to the account management. Even the D3 client kicks you out to a web browser to change your password etc...

IMO, it's way more likely that some D3-related site got owned and the attackers sucked down a list of user/passwords that line up with battle.net logins. Guess we won't know until we see some evidence or at least some more data on who's getting hacked here.

EDIT: Oh you edited, my comment doesn't line up to yours now but I'll leave it here.

xmido · 3 days

Yeah - anything is possible, for sure.

I'm just saying that most of Blizzard's infrastructure is relatively mature and the majority of it (e.g. authentication) has been battle tested for years by Starcraft and WoW, the latter already being a juicy target for attackers, with very little to show for it.

The D3 specific part is relatively new and untested but with D3 and WoW Blizzard has been absolutely obsessed with stopping hackers and cheaters - I would be thoroughly surprised if it turned out to be something so simple it was exploitable within the first few days of launch.

A much more likely story is that some lamers site got hacked and the attackers are relying on the axiom that most internet dwellers will happily use the same user/pass/email across everything and hate security options that are inconvenient.

xmido · 3 days

It's not MitM. Lets just take a moment to reflect the EPIC amount of effort and infrastructure one would have to leverage to be able to MitM communication between a random game client and Blizzard's game servers.

Given:

You don't control the Victim's network/computer (malware i.e not blizzards fault)
You don't control the Blizzard's network (DNS or routing) because trying to MitM that end will be like drinking from a firehose.

You're pretty much left with attacking ISP's (DNS or route poisoning) between the two and I'm sure Blizzard would have correlated that by now.

xmido · 3 days

I seriously, seriously doubt it was SQL injection on Blizzards side. I would say that their game and authentication infrastructure is far too advanced and convoluted for such a simple exploit.

However, if any site that caters to D3 players were to have such a vulnerability, then, that would be an excellent source of very likely credentials.

xmido · 3 days

The forum system likely won't have access to the username and especially password as battle.net authentication is centralised (e.g. not part of the forums).

That being said, all it takes is for one semi-popular Diablo 3-related site to have a vulnerability like you describe and suddenly you have a pile of very likely logins.

xmido · 3 days

Yeah, the current theory is a session hijack - you don't need MitM to do that. The victims session ID may have been sniffed from network traffic or dug out of the clients memory.

xmido · 3 days

Could you please elaborate? I would have thought any obvious weakness in the authenticator system would have been borne out in WoW.

xmido · 3 days

It certainly makes it harder.

Apparently some of the attacks have been characterised by the victim being disconnected and then password being reset to lock the victim out, presumably to prevent a session reset when the victim logs straight back in again. Account changes are not possible without a code from the associated authenticator.

Doesn't stop them from hijacking your session but definitely narrows the attack surface.

redelman431 · 3 days

The fact that the string "0" == false is the one that bakes my noodle.

Pretty clear signal that: maybe types are pretty important and perhaps we shouldn't carelessly shift them around.

ImpactEventFan · 8 days

Zend_Date is even worse with it's horrible Locale issues :\

revets · 15 days

The script seems to be for retrieving a page given the ID - You definitely want to use GET for that.

If it was /change.php?id=123&action=delete then, yes, POST is a lot more appropriate.

Bumblebeebakery · 15 days

Yeah... What exactly is wrong with the SC2 community? It's been the most friendly and mannered gaming community I've ever been involved in...

nickhelix · 15 days

God no!

Start by using automated testing to test your code. You'll find that the properties of code that is easy to test are much the same as code that is decoupled and modular. e.g. Code only does one thing, is deterministic, does not keep state it doesn't need, has very few dependencies and those it needs are injected, have a structured interface etc...

It's hard - it's usually something you learn with experience but I'll take a look around to see if there's some easy resources to get started and I'll get back to you.

fraseyboy · 16 days

Actually, when I was playing Aion I found that I had much better ping tunneling over an SSH connection to an american server than connecting directly.

I approached the issue with Orcon, provided the ports etc... they basically confirmed they were deprioritising the traffic but refused to make any changes.

chrismsnz

TROPHY CASE

chrismsnz

TROPHY CASE

you'll need to login or register to do that

create a new account

login