Player Features and Ideas Discussion

You're wrong.

Trion, Blizzard, Cryptic and Sony have all had their Core DBs hacked.

Not the client infected with a Trojan, but their databases have been hacked and dumped.

Agreed, up to the user. If the user agrees to not claim reimbursement should their re-used password be used without their authorisation.

That's a bigger security risk.

To emphasize. "MyHorseIsActuallyAPony" takes 9.1804 × 10^41 Years to solve with a dictionary attack. that's over 900.000.000.000.000.000.000.000.000.000.000.000.000.000 years. Good luck with that

How about MyLittlePonyFriendshipIsMagicApplejackPinkiepieRarityFluttershyRainbowdashTwilightsparkle as a password?

I'm not saying that's my password...

...I'm saying that's my password.

While it IS a minor inconvenience at times to have to change passwords, and make sure it isn't an older one you have used before I find it rather refreshing that they won't allow you to use a password you've used before. Of course, over 4 accounts keeping track of your passwords can be a minor pita but it's a small price to pay for the added security it brings to my account overall.

I am FOR not allowing you to sue a password you used before. But hen, I am also an extremely security conscious person as well.

~Z

Humans don't think like machines.

You have to beat both. If your long password is easy to remember, its easy for a human being who knows you to figure out through deduction and a few days of trial and error (if they care).

Its gotta be long, avoid any consistent capitalization scheme, have intentional typos, and be a completely nonsensical grouping of words, to be a truly strong password.

32 BYTE salt? or 32 bit salt? 32 bytes would probably chock a lot of computers out there, and would cause the authentication server to hang itself. 32 bit, while decent is a little weaker than I'd expect for anything decently modern, I would probably go with 56 or 64 bit, light enough for mass authentication, but strong enough to seriously deter most malicious users.
and yeah, people clicking through warning boxes and generally being totally ignorant of the basic function of a computer is what's causing most issues today.

When I worked for a para-military company, we quickly learned that reusing password was good only in the programmers' heads.

People would do the IMPOSSIBLE to circumvent it.

1) In the beginning they would just add a "1" after the password.
2) Requiring certain characters, they just added their birth year at the end of the password.
3) Requiring a minimum length, they just copy pasted their own name twice.
4) Reusing the passwords they just added incremental numbers or a combo of the above or the month of the changed password.


When we made filters to screw them up on the above, they started writing the passwords on Post It attached to their monitors.

When we involved their bosses to force them stop doing that, all went suddenly quiet for 2-3 months.


We could not believe we had won against the End Users.
We could not be fartest from the truth, in fact.

A parent company team of inspectors came for a routine control and guess what did they find?

The end users ALL opened the same Excel sheet one of them originally created. That Excel sheet had the full user names and passwords of the 1200 employees, all in clear of course.


So, instead of better security, we achieve an huge piece of sh!t.


Heads fell, reprimands were made, everything settled down.


2 more months of utter silence and guess what, one morning I randomly pass close to an End User and my eyes and my testicles fell to the floor together.

They - the End Users - somehow created an MS Access forms "application" including the passwords (in clear of course!!!) of every employee, for multiple applications AND with search engine to make it easier to find and copy / paste them!


The fight against the End Users is something beyond programmers' logic.

If you read between the lines - when CCP talks about "two-factor authentication" it means that they are going to add authenticators.

ETA is July 2012 - but that date could slip.