Source
r/Guildwars2•
kvxdev

Security worry

[Question]

Hello Anet!

My friend recently reset his password and what he told me scared me, so I was hoping I misunderstood or that he did. I wanted him to send me a snapshot, but he was already past the screen when I asked him.

Anyhow, he got an error message that supposedly told him the password he was trying to use was already used *BY SOMEONE ELSE*...

Now here's the thing. Not even withstanding someone could harvest passwords like this (very impractical) and would make people more likely to use bad passwords or passwords they would forget and thus leave them written around (much worse), this raises a HUGE question:

-How do you know. The way I figure, you have 3 ways of knowing:

First, you actually hash and salt your password with a combo of the player's hidden data to be fully safe. In that case, it means you need to try this password with *EVERYONE*'s salt and compare with their hash. Somehow, I doubt that's the case.

Second, you don't salt. You're running a hash collision on all the passwords. This is plain terrible and dangerous, but, the damage isn't *too bad*... Until someone steals your data (and it always happen) and starts reverse-engineering the passwords...

Or, and this is the scary one, but we're talking about unique passwords per user-base...

Third, you store the passwords in plain text. If that's the case, there's no point telling you the danger of a data leak, a badly behaving employee or the like. And, if THAT's the case, what else is being stored without protection?

.... OMG, I just realized I passed a "took too long to recover my password" question in the weekly question. Again, I hope I misunderstood and he's talking about a password reset...

Please Anet, either tell me I don't need to worry and you have a competent security expert on your team or, if not, get one and have them audit your stuff and fix it, then tell me I don't need to worry and that you have a competent security expert on your team...

Posted Jul 20, 2018, 6:10 AM UTC

021
bananananasananaso•

You misunderstand how this works. There is a list of known compromised passwords. You can find one such list here. These passwords are confirmed compromised and should not be used by anyone, ever.

ANet is not checking against the passwords of players in their system—they are checking against a list of passwords from some massive hacks. This is a Good Thing™.

5
kvxdevOP•

If that is the *ONLY* list they check against, yes, it's basically preventing a dictionary attack. HOWEVER, if what Kazika writes is true, it also includes current players' passwords. Also, the option of recovering said passwords means they are stored either in plain or with encryption. While the later is safer, it does mean they also exist to be traced back to the accounts and, by extension, e-mails -> online persona.

1
bananananasananaso•

HOWEVER, if what Kazika writes is true, it also includes current players' passwords.

This would probably be a hashed (not salted) list of passwords that does not record corresponding account names. This isn't particularly unsafe—it only potentially reveals a password to a malicious third party that is in use by a single GW2 user (of millions). So:

While the later is safer, it does mean they also exist to be traced back to the accounts and, by extension, e-mails -> online persona.

This is prevented.

How does ANet get these (hashed) passwords? As soon as you set your password, they simply store the hashed version in this massive list, and store the hashed+salted password and your account name in their user database.

You're panicking so much for no reason.

1
kvxdevOP•

You misunderstood. If you lose your password and I can recover it, it isn't hash. By definition, a hash is a one way function. At best, it's encrypted. At worse, plain. I'm not panicking, I work in security and I'm worried. ;)

1
Kezika•

They don't recover and tell you what your password was if you lost it and contact support, they just verify that you are the true account owner by asking for serial number, mobile number, e-mail, etc and then they'll reset it for you if you can prove that you're the rightful account owner.

3
bananananasananaso•

I work in security and I'm worried.

Then by now you should have clicked the "recover" button to see what it does—reset your password or send it back to you.

1
Kezika•

This was a change they implemented back shortly after launch after there was a massive breach of various internet sites.

ArenaNet forced all passwords to be changed, then they also implemented it where it checks against a list of known compromised passwords (my original password was on said list from a breached site so it flat out can't be used by anyone)

Then when a password is created they have some way of checking it against all current passwords of theirs to make sure no two players use identical ones.

It is actually a very good security thing that they do this and was highly praised when they implemented it as such.

2
Scow2•

... No, it isn't a good thing.

-4
vluhdzvluhdalt.2715 [RNG]•

^

It's like saying "your password must be exactly eight characters, contain three of the four of lower case letters, upper case letters, numbers, and special characters". You've just given anyone brute forcing the password a huge leg up. Enabling people to check if a password has been used without putting a failed login flag on the relevant account is a massively terrible idea.

0†
Kezika•

You actually can't tell with it if a password has been used or it it's just on the massive list of known compromised passwords from the multi-site breach in 2012, gives the same error.

Here are the details on it: https://www.guildwars2.com/en/news/mike-obrien-on-account-security/

7
kvxdevOP•

... Assuming I'm someone trying that list as a attack vector, wouldn't I know Anet position on the matter and only try passwords *outside* of it?

1
theotherdanlynch•

That's a glitch that's been around forever. When you try to use a password that matches the list of banned passwords (password123, boston7, etc), you get a message saying it's being used by somebody else. It's dorky, but they've just never fixed it.

2
Kezika•

That's actually not a glitch at all. Not telling potential attackers exactly why a password isn't working is best practices.

When you try to set a password and fail the error message is always:

"That password is not available. Either you've used it before, someone else has used it before, or it's known to have been hacked from another game or web site. Please choose a new, unique password for your ArenaNet account. We recommend creating a new password by choosing four random, unrelated words, as shown in this comic strip."

1
FribbtasticEPIDEMIC :*☆─σ( ಠ ﾛ ಠ )ﾉ•

Just because ArenaNet prompts you with "someone else already used this password" (note the past tense here) doesn't necessarily mean that they are not using salt, checking the current or an accumulation of passwords somewhere in plain text or hashes.

There was a breach a long time ago which rendered all passwords obsolete and those could be either in plain text or hashed in a dump location in which they check the password you want to use and prevent you from using it but later, on success (so password you are using is not found) create a new salt which is applied to your password and then the result is saved in their database. this dump file could also contain commonly used passwords like 'password1234', 'p@sswr0rd' or 'trustno1' (list of commonly used passwords here) to prevent the user to even try to create an account with a possibly compromised password or one that is not really that save. It could also contain the whole dictionary to prevent dictionary attacks.

So while I'm not saying your concerns are unjustified I think you are a bit too pessimistic on this one.

Edit: regarding to the blog post u/Kezika linked it is a blacklist of passwords.

Since we’ve been observing hackers constantly scanning accounts that don’t even exist yet, waiting for someone to create those accounts, we obviously want to make sure that if those new customers do join the game, they don’t use the password that the hackers are waiting for. Thus we’re building a blacklist of all the passwords that hackers are scanning for — it’s already at 20 million passwords and growing — and we’re preventing new customers from choosing any of those passwords. (The blacklist contains passwords only, not account names.)

1
Kezika•

I just tested a few various type of bad passwords actually since I have 2 accounts the prompt is always a catch all saying password can’t be used because might not meet requirements, be known compromised, already used, or contain certain keywords. Regardless of whether I put in password1234 or Tina or my other account’s password, or my one that was known compromised and in their blacklist.

Yep can’t find the list they started with offhand but it’s managed by a very well respected Australian cyber security firm. I assume they also grab updates often too as they maintain lists from other compromises. They also even give advice on how to download and run checks against the list computationally efficiently.

That and some trusted and well regarded security companies offer password blacklisting service for companies as part of their offerings for businesses. Symantec I know offers. It does this where it proxies through them for the yay/nay on passwords.

Thirdly some industry standards for certain fields actually require such setups because of how secure it is. Field I’m in is financial with a TON of very highly desired (by ill members) data. We are required to have all of our passwords ran against an industry approved password blacklist.

1
thevogonityO Freddled Gruntbuggly•

and thus leave them written around (much worse)

I don't see this as much of a problem. People trying to brute-force accounts do not have access to passwords that are written down in our homes. And the likelihood of a home break in seems so much less likely than an online breach of security. Even if you are robbed in real life, chances are they are not going to take whatever it is you have you passwords written down on, but instead the physical items that can be pawned or credit card statements. The practical alternative to writing down a unique password for all your various online games, food service websites, shopping sites, etc. is using the same password for multiple vendors, which is even a bigger no-no.

1
kvxdevOP•

(Just to address this one, I meant on your computer, i.e.: making a computer breach that much more damaging).

1