Blizzard Says Battle.Net Has Been Hacked

An anonymous reader writes "Blizzard announced today that its Battle.net service was compromised. The company is urging users to change their login information immediately. Blizzard is stressing that payment information was not compromised. 'The unauthorized access included email addresses associated with Battle.net accounts in all regions, outside of China. Additional information from accounts associated with the North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) was also accessed, including cryptographically scrambled versions of passwords (not actual passwords), the answer to a personal security question, and information relating to Mobile and Dial-In Authenticators. It's important to note that at this time, Blizzard does not believe this information alone is enough to gain access to Battle.net accounts.'"

Comments

Thanks!

[Anonymous Coward]

Thanks for your always-online requirement for Diablo 3! So very useful if I want to play alone.

Re:Thanks!

[Sir_Sri]

Diablo 3 is a multiplayer game with a where you can choose to not directly interact with other players, but without the auction house the whole itemization would need to be completely different.

That was one of the things they realized with D2, the reason it stuck around was the multiplayer, they just got the idea that the whole thing should be multiplayer. starcraft has less of an excuse because there's no meta economy in starcraft.

Re:Thanks!

[ganjadude]

really??? thats your argument? From my point of view as a D player since D1, STILL play d2, and gave up on d3, i am sick of the people who claim that "d3 is a multiplayer game" maybe by marketing, but not by gameplay. it is NO DIFFERENT than d2, in gameplay that it should require me to check in with them if i want to play by myself. and on top of that, they wouldnt even work with me on a refund, when I had issues 3 weeks after launch because I pre ordered it, and therefore it was more than 30 days out of date, eventhough i only had the game for aweek less than 30 days.

Re:Thanks!

[Anonymous Coward]

as opposed to a single player game where you can choose to play with other players???? facepalm...

Re:Thanks!

[Sir_Sri]

It's not an argument. It is. The game is a multiplayer game. Just because that's a stupid idea doesn't mean it isn't the one they went with.

I'm sorry that your point of view is just wrong. But it is. The whole game was balanced around you being able to buy and sell from the auction house. That was a deliberate choice on blizzards part, and without the AH the game becomes prohibitively hard because you just can't get the right itemized gear and you need an astronomical amount of farming to get through the content. Again, I'm not saying that's a *good* design, but that is the design. If anything the game suffers because you almost never loot anything you actually want, I think I looted one inferno difficulty item I actually used, all of the rest I had to buy.

They certainly could have designed the itemization differently or had a full on single player mode with different itemization. But they didn't.

The 'core activity' of diablo is 'click'. I'll grant you that activity is mostly unchanged form previous versions. But most games are more than just one core activity.

they wouldnt even work with me on a refund, when I had issues 3 weeks after launch because I pre ordered it, and therefore it was more than 30 days out of date, eventhough i only had the game for aweek less than 30 days.

yes well, that's a whole other topic. But once they have your money they don't want to give it back.

Re:Thanks!

[h0dg3s]

That was one of the things they realized with D2, the reason it stuck around was the multiplayer, they just got the idea that the whole thing should be multiplayer. starcraft has less of an excuse because there's no meta economy in starcraft.

And then they gimped the multiplayer to 4 player instead of 8 and made the game entirely too linear. I stopped playing after 2-3 weeks. I doubt they care though, they already suckered me out of my money.

Re:Thanks!

[Anonymous Coward]

including cryptographically scrambled

At least they did use the word "cryptographically".

Otherwise, "scrambled" in reference to "encrypted" is one of those key words that reveals a pattern of thought. The pattern is "our audience is far too stupid to either know what encryption is or to take 10 seconds to Google it".

It's like the way the news (radio, TV, and newspapers) is deliberately written to target a sixth-grade reading level. I mean, heaven forbid if any ignorant person realized that they are ignorant and learned something new! That would be so terrible!

It's a real departure from the early days of the USA, when the news was intended for a college-level audience. This had the effect of elevating the level of discussion. A more in-depth, nuanced understanding of the issues of the day was the result. Those who voted and otherwise participated in public life were more informed. Anyone who was willing to learn new things and educate themselves could join them. Those who couldn't be bothered were filtered out. Coincidentally, they enjoyed more freedom than we now know.

Re:Thanks!

[Anonymous Coward]

as opposed to a single player game where you can choose to play with other players????

There are quite a few of those.

Re:Thanks!

[ganjadude]

I understand your argument, I really do. however I dont understand any good reason to disable to single player mode from d2 (which the char was not able to play on battlenet, and therefore not able to access the "real money" market activision set up (in convinced this is an activision move, and not something blizzard would have done prior to being bought up) I simply disagree with the way the game was handled. Hell I pre ordered, pre downloaded, and still couldnt play for 2 days after it was "released" all because of server issues. If that the the route all games are going to go.. i guess I am not a gamer any longer. Thats just me, but I will not deal with that, Ill keep playing super mario world and D2 and be happy.

Re:Thanks!

[antifoidulus]

Otherwise, "scrambled" in reference to "encrypted"

Ironically you go on this rant about how "uneducated" the American public is while fucking up the basic details of what you claim to know so much about. The term "cryptographically scrambled" is much more accurate than saying "encrypted", because guess what, the passwords ARENT encrypted, they are hashed. "Scrambled" and "Hashed" in reference to passwords are sort of similar, though scrambled in reference to words usually implies some sort of random re-ordering of the letters, for example
password
becomes
wasspdor

In essence, if you are going to criticize the way someone tries to inform the public about a technical issue, please don't substitute "dumbed-down" for "wrong", because "dumbed-down" is always better than "wrong"

Re:Thanks!

[PPalmgren]

While true, it points to the major problem. The entire reason single player must be played "online" is because its a real money auction house. This single design decision drove all of the "features" that everyone detests. Their greed is the problem here.

Re:Thanks!

[Rewind]

I understand your argument, I really do. however I dont understand any good reason to disable to single player mode from d2 (which the char was not able to play on battlenet, and therefore not able to access the "real money" market activision set up (in convinced this is an activision move, and not something blizzard would have done prior to being bought up) I simply disagree with the way the game was handled. Hell I pre ordered, pre downloaded, and still couldnt play for 2 days after it was "released" all because of server issues. If that the the route all games are going to go.. i guess I am not a gamer any longer. Thats just me, but I will not deal with that, Ill keep playing super mario world and D2 and be happy.

I am not the other guy, but maybe I can clarify: It is an online game. That is a fact. You may not like that, you may not have played previous Diablo games online ever, but Diablo III is sever side. It is an online game. That is not an argument, it is a statement of fact.

You are free to not like that and not buy the game and mention how much you dislike the fact, but it is still fact, not an argument. I agreed with their decision here, but I hope they (like me) look at it in retrospec and say "yeah that didn't really work out as well as we had hoped". I mean I only ever really played D1 and D2 online and I was very happy about very realistic changes to drastically reduce cheating and hacking. I was also excited about the (much less realistic) idea that maybe gold & item spam would be reduced by the RMAH. That said, in the end it wasn't worth it and it didn't improve either enough to justify doing it again. Overall I got enough hours out of D3 that I can't really hate on it too hard, but it just wasn't that good of a game. An ok game if you will, and I agree that I hope they drop online in the future.

Basically, I agree with 99% of what you are saying, but its not just 'add on offline and lan'. The game was server side, that was the way they wanted to go.

Re:Thanks!

[Anonymous Coward]

Man some people are just far too easy to troll. Thank you for playing!

Re:Thanks!

[Sir_Sri]

No, not just the real money auction house. The regular one too. The RM AH is so blizzard can get a cut of the real money changing hands.

Re:Thanks!

[Anonymous Coward]

They could have just as easily made single player accounts ineligible for the auction house, like the open/closed characters in Diablo 2. It seems more like they chose to go this route to enforce DRM and inconvenience players.

Re:Thanks!

[amoeba1911]

you need an astronomical amount of farming to get through the content

... or you could play as the wizard and use the teleport skill at the same time as archon skill to enter god mode (complete invulnerability). It took them more than a month to fix this fairly major bug.

Re:Thanks!

[Sir_Sri]

The real money auction house is an example of a free to play concept, and players were exchanging real money through unofficial channels. That poses huge security problems (like the one's people are talking about with WoW), which translate to customer support problems, and blizzard figured they could get a cut.

Even without the real money though, the regular auction house is your entire region, and a main source of gear for high level balance. The ability to dupe items in D2 caused no end of balance grief and problems that arise from that, and having a consistent relatively locked down platform for their main community, which is the multiplayer community is important then.

Also, yes, piracy has ravaged the PC game business (including the companies I contract with) and so everyone who can afford the infrastructure is moving to online setups.

You also have to keep in mind that from Blizzards perspective their main product is WoW, and everything else is an offshoot from that. They want WoW players to still be connected to other WoW players who happen to be in Starcraft or Diablo, and things like that. They're aiming for a total connected product line (sort of the way steam, XBL and PSN let you chat with your friends outside of the game you're playing), so your achievements in WoW carry over to diablo and the reverse, your friends are in both and so on. Again, not really sure that plan is working too well, but I can certainly see what they're trying to do. Blizzard isn't really the right outfit to pull that off though, mostly because it's the wrong level.

Re:Thanks!

[Sir_Sri]

And to not have to balance two different games. As a purely single player experience D3 is like 8 hours, or 8000 if you want to farm stuff. With multiplayer it's a good 50-200 hours, and then significantly diminishing returns after that.

Re:Thanks!

[PopeRatzo]

I am not the other guy, but maybe I can clarify: It is an online game. That is a fact.

Let me clarify further: Diablo 3 is an extremely shitty game that not only is overpriced by about 3x, but then seeks to monetize even further with it's online crapola.

As a free2play online game, Diablo 3 would be excusable. As the anchor in a very popular trilogy of AAA titles, it's inexcusable.

Further, to heal FAIL on top of FAIL, the information that you had to give them to create an online account with Blizzard in order to play this mediocre free2play crap is now in the hands of some Bulgarian sleazebags who will do their best to monetize Diablo 3.

Blizzard couldn't have mistreated Diablo fans much worse without infecting every one of them with Ebola virus and then smacked them in the face with a meat tenderizer.

Naturally, Blizzard bears zero liability for any damage that might be caused by their inability to keep customer records secure because everyone who played the game had to sign away all of their rights in the endless EULAs that they had to agree to on installation and with every single update.

Let me end this rant with a brief prayer: Jesus, Lord Baby Jesus, I beseech you. Please make the prostates of every one of the Blizzard upper management, board of directors and major shareholders swell up to the size of honeydew melons so that it takes them 15 minutes just to squeeze out a painful, burning drop of urine. And let them know, Father, that this pain is directly caused by their behavior with Diablo 3 (which, if it makes any difference to you, Baby Jesus, has satanic overtones). And I further pray, Lord, that you make an example of them so horrible as to cause sweaty, trembling nightmares for the upper management of every game developer and publisher, so that their nights may be beset with horrors so that they might look into their souls in order to change their ways and stop fucking over their customers. I pray this in the name of God (may Allah protect him), Amen. PS: please let the Bears win their home opener by 14 points or more..

Re:Thanks!

[Sir_Sri]

There are lots of single player games that are a special case of multiplayer (where for example you still connect to a server, albeit a local one) with special rules, lots of FPS single player campaigns are like that, and there are single player games that have no support for multiplayer at all.

Diablo isn't either of those. Because of the auction house and achievements connection the game depends on connecting you to a server to facilitate those things. Now I grant you that those things didn't need to be part of the game (obviously) but blizzard deliberately made them critical to the whole experience, especially the auction house. For D3 playing the game without other players directly you're still playing multiplayer, the drops are still as though you are going to sell on the auction house and buy from the auction house, and because at any point you could take your character multiplayer (which is actually a feature) they have to treat your character as a multiplayer character all the time. In this case 'single player' isn't a special ruleset case of multiplayer, it's just multiplayer before anyone else joined.

Re:Thanks!

[Sir_Sri]

they already suckered me out of my money

hence the real money auction house. That you've quit playing reduces the value of the real money auction house (even if you never use it it's connected to the regular auction house as part of the broader economy).

If you read anything they've been saying it's pretty clear they fucked up, badly. And they realize it. They aren't sure what to do about it, but they definitely aren't happy with how much people are (or aren't) playing the game, because that's their revenue model. Think of it like a free to play MMO, even if you never give them any money, you're there so that someone else has a good time and does give them money, and without you playing they are in trouble.

I think blizzard was very much counting on this new fully multiplayered up diablo as a cash cow they could milk alongside Mists of Pokemon and Starcraft 2: why sell one game when we can sell three?.

Re:Thanks!

[Anonymous Coward]

- Also, yes, piracy has ravaged the PC game business (including the companies I contract with) and so everyone who can afford the infrastructure is moving to online setups.

BULLSHIT

Re:Thanks!

[Anonymous Coward]

http://www.pathofexile.com

It's like D2, except so customizable that just about any build is feasible provided you have the right skill set up and allocate your points right. Skills are equipped on gear as gems (and level naturally with your character) and can always be swapped out, and you even get limited refund points to undo poor skill point allocation. It's also a hell of a lot of fun, and the community is much better. It explicitly avoids the pay2win approach that D3 has taken.

It is online only, but I can accept that as long as the game is fun.

Re:Thanks!

[Sir_Sri]

I've discussed in previous posts our piracy rate and dropoff in sales with the proliferation of bit torrent.

Steam has pushed back the other direction, but well, it's an online service, and you pay them 30% for the privilege of using their infrastructure rather than your own.

For us, because we only use steam for retail sales and not authentication or matchmaking well... guess what, even now a year after release 50% of the copies in active use right now are using 1 CD key (with only 4000 concurrent users that's a small sample, and well, time zones and so on), and none of those pirated copies are steam users. I'm not 100% sure how anyone else does it, but I know we give steam a list of keys and only those keys authenticate blah blah blah so their service it's just those. But gamersgate, impulse etc. not so much. And in this case the key in question was part of a broad allotment to the publisher.

Now I wouldn't equate 1 pirated copy to one lost sale, I think, given the previous sales figures (for previous games in the series and so on) I think about 20% of total players (40% of pirates since we're at 50/50 right now) equate to lost sales given our estimates, and some of the pirates are in china and can't buy our game anyway, so it's not all lost sales. But there's certainly a lot of hurt from it.

Obviously you can't know exactly. There's no way to have a synthetic test knowing exactly how many copies would sell if it wasn't for piracy. But sales are way down, forum use and active play sessions are about flat, so guess what, people are pirating the game and not paying for it. Fortunately in the intervening period the government of ontario started kicking in a bunch of money (about 40% of peoples pay) or the guys I work with would be out of business.

Re:Thanks!

[Sir_Sri]

Unfortunately being invulnerable doesn't make drop rates better. Earns you lots of money from the AH though.

Re:Thanks!

[bennomatic]

Mmmmmm... ebola...

Re:Thanks!

[_KiTA_]

No, Blizzard realized there were still people selling runes 10 years after D2's release and thought: Christ, why aren't we getting a piece of that action?

Every decision after that became suspect. The drop rates, the difficulty levels, even the layouts of the maps. Everything can (and has been) designed to push people towards the RMT AH. They have a direct economic incentive to do so.

Re:Thanks!

[Holi]

To say the PC Game industry hasn't been damaged by piracy is disingenuous. The fact that far fewer games are produced, that fringe genres are not even developed anymore, and that we have had to deal with more draconian copy protection schemes are all a result of the ease of piracy on an open platform like a general purpose computer.

Re:Thanks!

[ganjadude]

Just for argument sake. Of those pirated copies, how many people may have never heard of the game if they couldnt play it for free? And of those, how many will buy the game in the future or a future release based on their experience? I am not saying it is right but I would wager at least a handful of people become fans of a company due to initial piracy. I am sure you have people to try and figure out those kinds of numbers better than my speculation (pulling numbers out of my ass)

Re:Thanks!

[Anonymous Coward]

Mmmmmm... ebola...

mmmmmmm... meat tenderizer

Re:Thanks!

[Anonymous Coward]

I'm sorry that your point of view is just wrong. But it is. The whole game was balanced around you being able to buy and sell from the auction house.

Actually if you read developer blogs about why Inferno difficulty was far easier than expected, it's because during testing they balanced for people playing through WITHOUT the auction house, not with it.

But good theory.

Re:Thanks!

[Anonymous Coward]

Single player games are stupid, in this day in age.

Re:Thanks!

[Anonymous Coward]

I guess we know how well that prayer went over, the Bears lost horribly to my Broncos 31-3.

Re:Thanks!

[Anonymous Coward]

To say the PC Game industry hasn't been damaged by piracy is disingenuous.

I don't know. Seems a bit difficult to prove when you're just talking about the loss of hypothetical profit.

and that we have had to deal with more draconian copy protection schemes

Actually, that would be the result of people implementing said draconian DRM. DRM hurts everyone most of the time, not just their targets. The fact that they don't like copyright infringement doesn't, to me, justify the use of DRM, and I'll blame the people actually hurting me (the ones who choose to implement the DRM).

For example, arresting everyone because some people are murderers would be unacceptable. DRM is just a lesser version of this.

Re:Thanks!

[Anonymous Coward]

I just reinstalled D2 a couple weeks ago and am still loving it. For various reasons, including the ones you mentioned, I'm not really interested in D3, though I followed the announcements and changes up to the release like an addict.

I've been dying for someone to make a solid FOSS D2 play-alike for a long time now, and someone's finally taking it on:
http://flarerpg.org/
I don't know a ton about the project, but from what I've read, it seems like they have some good momentum going. Man, I'd love a libre D2 that incorporated some new ideas, including some of the new features from D3 (the alternate forms of mana seems like a particularly great idea). Here's hoping it lives up to its potential!!!

Re:Thanks!

[Anonymous Coward]

It is an online game. That is a fact. You may not like that, you may not have played previous Diablo games online ever, but Diablo III is sever side. It is an online game. That is not an argument, it is a statement of fact.

And it is a really bad design choice, just like not adding LAN support to Starcraft II is. (IMO not having LAN support and marketing it as a game suitable for e-sports is borderline fraud, especially after we have seen that even Blizzard had disconnects in high profile matches in their own damn tournament. That game is NOT suitable for e-sports.)

Re:Thanks!

[gl4ss]

fringe genres not developed anymore? take a look at steam you foaming idiot.

further.. those fringe games are developed by guys who copied them in the '90s.

Re:Thanks!

[Anonymous Coward]

Sad day when rants full of ignorance, prejudice and personal opinion are marked 5, Insightful. See, Diablo 3 is just the evolution of Diablo 2. Much like Starcraft 2 is the evolution of the first part. Nothing revolutionary, they just took the old game, cleaned out some annoying things and made it more fun.
See, I can run Diablo 2 right now, more than 10 years after the release and I can play with friends on Battle.net. 10+ years of support, patches and servers. Is that not worth your $60 or is it something you expect from all the f2p bullshit games? A lot of people would much rather shell out for the game and play for free later than to put up with the pay-to-play (that's marketed f2p) - that to me most of those games aren't even worth the bandwidth they take to download.

Re:Thanks!

[gutnor]

Let me clarify further: Diablo 3 is an extremely shitty game that not only is overpriced by about 3x, but then seeks to monetize even further with it's online crapola.

Diablo 3 is almost the same as Diablo 2 pre-LoD with better graphics and a gameplay rebalanced toward more casual players than hardcore one:
- No need to spend 40+ hours to try a new build.
- An gold auction house (i.e. game money, not real $) to buy high level object without excessive grinding or spending hours in forum to find price, descriptions and reliable vendors.

Of course the guy still playing Diablo 2 today, Diablo 3 will feel dumbed down and "no elitist" enough. I played Diablo 2 as an obsessive gamer student. I appreciate that now that I work and have a family, Diablo 3 allows me (and my wife) to access high level of content without spending unreasonable amount of time. If the compromised is some pissed gold farmer and hardcore player - that's a good trade to me.

There are other cheaper great game out there like torchlight. But let's also be clear, most people complaining about the price of the game have spent 100+ hours on it. That makes it far cheaper than a lot of other activities.

It is reasonable to complain about the always-on connection - but really, in 2012, that is more a question of principle than a real constraint.

Re:Thanks!

[gutnor]

Every decision after that became suspect. The drop rates, the difficulty levels, even the layouts of the maps. Everything can (and has been) designed to push people towards the RMT AH. They have a direct economic incentive to do so.

And yet they took decision that undermine RM AH significantly. In the gold AH, the 10 auctions max, 38 hours minimum wait time, means that you need a lot of time to extract maximum value from your loot. That means that you can find lots of cheap ( = 50K gold and below) that are dumped on the AH all the time. Inflation on good objects (the ones you need to kill diablo in inferno) is quite limited - I spent less than 100K gold to be fully geared for inferno act 1 and 2, that is a quantity of gold that you get by playing normally through the game (didn't do any farming, never used the AH until Act 3 hell)

You only need the real money AH to buy the very very best objects in the game, but there is really no gameplay need. Blizzard could have done a lot more if they really wanted to drive people to the real money AH.

Re:Thanks!

[Anonymous Coward]

Jesus, Lord Baby Jesus, I beseech you. Please make the prostates of every one of the Blizzard upper management, board of directors and major shareholders swell up to the size of honeydew melons so that it takes them 15 minutes just to squeeze out a painful, burning drop of urine.

I'm afraid you're praying to the wrong God here. Jesus would tell you to forgive, and seek in you the strength to go to Blizzard and convince them to lose their bad ways, by being a loving example to them, as you'd like them to be to you.

Muhammad would tell you to behave, be a good moslem, and insist Blizzard upper management is bound for fiery inferno anyway so why care.

Buddha would tell you to care less for videogames, and maybe instead enjoy your next meal more (hmmm pork).

Nanak would just smack you over the head, and then pee in your general direction.

Eris would grant you your wish, turning Blizzard's management even more sour, then She would make you buy their next yet-shittier game nonetheless so you'd share some of the pain you sought to inflict, for the lulz.

Most other deities would require costly sacrifices and long imprecations upfront just to listen, mostly understanding your plea half wrong anyway. And their antagonist deities would curse you afterwards.

Re:Thanks!

[Anonymous Coward]

I worked in the game dev. This is not the piracy doing, it is the publishers doing from day one. It is that the PC (and console and phone) game industry is harming itself at every occasion. Outsourcing to company who are not credited to make games sounds like American studios developing them while Eastern European game dev companies who go bust right after the title get released, common phenomena. Also, the duality, whereby the production company and the design crew is separated is crazy. Good luck to try to get a innovative feature in to a game!

But this goes even further, American game publishers have the culture of releasing games in insane time limits, stuffed with buggy features. Give 1 year to finish a game for 3 platform, and when the studio can't release it just in a haste at the 2 year mark, they are happy if that money will cover the salaries (in quite a few instances, it doesn't cover it at all). Driving people for long hours for very little recognition, impossible time lines.

This is a known phenomena for ages now, but today they try to blame piracy. Lemme tell you, piracy doesn't hurt the industry at all. It's not that our publishers were broke or anything. It's just that the PC market was always a drain compared to the console market simply because the production of games to a platform where you need to make special deals with a multitude of business body, from the video card manufacturers to the operating system guys, it needs extra amount of money to get some returns. So games, especially those on PC shifted toward to the "software as service" where the company makes their own platform and make sure that they can make an incremental business model instead of releasing big titles every second year and crossing their fingers for a good 3 month sale period. This is understandable, the motivation is the same as behind these big franchises like Diablo. Publishers piss their pants to release anything remotely new, so once it was a hit, it has to be a hit forever.

For my part, the computer gaming has become too boring for a while now. For standalone titles, I hope a crowd-funded open source platform will provide eventually a new way of producing games, without hoping profits of a Hollywood title or otherwise consider it as a drain.

Re:Thanks!

[ifrag]

No, Blizzard realized there were still people selling runes 10 years after D2's release and thought: Christ, why aren't we getting a piece of that action?

This is demonstrably not precisely what they thought. Diablo 3 has no runes to sell, because that game mechanic was clearly not fun enough. IMO removal of runes and runewords for sockets was probably the stupidest itemization decision Blizzard made on the game.

So in general perhaps Blizzard wanted to make more money on the game, but by design it pretty much doesn't have an ideal setup for it.

Re:Thanks!

[Anonymous Coward]

People keep trying to say the "always online" aspect is a draconian form of DRM. It is not. Let me repeat, it is not. It has nothing to do with DRM. It's so they can control/protect the economy of a dedicated on-line game. That is the alpha and omega of it.

Re:Thanks!

[flirno]

Not day one but eventually someone had their way and the direction changed. They still have things embedded in the game that point to and even talk about a single player mode that is NOT online (a message pops up about exactly this from the tips generator once in a while).

They can do what they want with the game to generate cash and they did -- they went with the short term cash grab to fund something else apparently. Most of my friends that played D3 and enjoyed D3 are also now done with D3.

Re:Thanks!

[Anonymous Coward]

What the HELL are you talking about? Apparently some of you have been drinking too much kool-aid.

Less games are produced and in restrictive genres because gaming has gone mainstream. AAA titles cost tens of millions to produce, with teams of dozens or hundreds. With that kind of money and effort involved. studios don't want to take risks anymore; they go for the quick sequel so they can milk the cash cow until they can find/create another one and thus keep making profit.

To suggest that this is all related to piracy is nothing short of idiotic!

Re:Thanks!

[Anonymous Coward]

Single player games are stupid, in this day in age.

But I hate other people. Especially you!

Re:Thanks!

[mcgrew]

Blizzard couldn't have mistreated Diablo fans much worse without infecting every one of them with Ebola virus and then smacked them in the face with a meat tenderizer.

Oh, I don't know... besides losing you private data, they could have installed malware that disabled all your P2P and disk burning software, and taken features out of the product you've already paid for and used.

Just because Sony treats it customers worse than Blizzard doesn't excuse Blizzard, and I gave up gaming ten years ago because the industry as a whole started acting like they could do without us and we couldn't do without them. I think the last game I bought was Quake III. Probably the last Blizzard game was D1 or D2 (I'd have to dig it out to see which one I have).

Re:Thanks!

[Luckyo]

It certainly is an online game in the same way that the first Assassin's Creed was. You have to be online to play because otherwise DRM will stop you from playing. But multiplayer elements are completely optional, as the core game is solo still player vs environment. I.e. single player game.

Re:Thanks!

[mcgrew]

I have to agree with you, the DRM they started using on games so they could fight piracy is one of the things that got me out of gaming. I used to spend rediculous amounts on new games, but I haven't bought a game in a decade or so. So yes, piracy hurts sales. Or rather, the fight against it does.

Re:Thanks!

[Anonymous Coward]

Dude. Torchlight 2. Comes out soon. And, none of the developers (except for maybe the music composer) who worked on Diablo 2 were part of the finished product for Diablo 3. All those guys left and went to found Runic Games and developed Torchlight, which was awesome, and Torchlight 2, which adds in the things that Torchlight 1 missed. And it's cheap; you can buy Torchlight 1 for 15 or 20 bucks.

Games are not a static product manufactured in a factory. They are a product of the vision of the people who make them. I didn't even buy Diablo 3 for that exact reason and I'm glad; all my buddies who bought it are hating themselves for it and no longer play it. I'm not following the franchise, I'm following the guys with the vision. If you want the next gen Diablo 2 experience, it's in the Torchlight series, because that's where the vision from Diablo 2 went.

Re:Thanks!

[KingMotley]

Odd, I've never had a problem trying to play alone. And D3 is better because all my characters are online, and all the items floating around in games aren't hacked up versions.

Re:Thanks!

[TheRaven64]

Also, yes, piracy has ravaged the PC game business

Piracy has been rampant since the '80s (maybe earlier, but that's the earliest I remember). I only know people who stopped buying games, however, since publishers started pushing obnoxious DRM schemes. I bought two games between 2003 and 2010, and I regretted both. Since GOG.com started selling DRM-free games at a reasonable price (late 2010), I've bought 40. I decided I wouldn't give money to companies that were going to treat me like a criminal and give actual criminals a better experience. And no, I don't pirate, I just find other things to do with my time and money.

Re:Thanks!

[Anonymous Coward]

I think Sir_Sri misunderstands the whole mod scene, you know, the one that takes care of problems like poor itemization. Even Torchlight had pretty bad itemization, guess what: mods.

Re:Thanks!

[Remus Shepherd]

Diablo 3 is almost the same as Diablo 2 pre-LoD with better graphics and a gameplay rebalanced toward more casual players than hardcore one:

It's not a matter of 'easier' or 'more difficult', or even of 'casual' or 'hardcore'. D2 had great gameplay balance. D3's balance is shitty, in my humble opinion.

In normal difficulty D3 is super-easy, which does appeal to casual players. But in Hell difficulty and above it requires hardcore dedication, grinding, and the auction house in order to have a chance. So the appeal to casual players disappears quickly. The end game appeals only to hardcore players, or possibly to the very rich.

In contrast D2 was challenging for new players in normal difficulty and ramped up smoothly with the players' skill.

There are only two reasons to continue playing games like this -- the end game, or replayability. The end game for D3 is hardcore only. Because of the 'everyone can have all builds' design decision, D3 has zero replay value once you have tried all the classes. D3 was a complete design mistake, and its appeal is a pale shadow of the appeal of D2.

That said, it's a fine game to waste 40 hours with and then walk away. I don't think Blizzard wants players to do that, but it's the only reasonable way to play D3.

Re:Thanks!

[flirno]

Diablo 2 did not flourish because it was multiplayer. Diablo 2 flourished because it was multiplayer with enough rudimentary social tools to facilitate user communities (custom/private channels). Because of those it was possible to quickly form friendships and to communicate with friends in a one to many pathed channel. Diablo 3 does not have this. Diablo 3 only has the friend list and the only one to many pathed channel is in a 4 player game instance which is not nearly enough. If Diablo 3 had added guildhall/clanhall support it probably would have done better. If it had at least carried over the old bnet chat style private/custom chat channels (which are, incidently, available in World of Warcraft to a degree) it might have done better. As it is they misunderstood why Diablo 2 did as well as it did. It is the human social element that got nerfed in Diablo 3.

Re:Thanks!

[dywolf]

It is not a multiplayer game. Being to buy and sell frm the AH is no more needed now than trading was needed in Diablo 2. That is simply one means to an end, among several. Its a time sink game, more time spent gets you the rewards you want. No different now than then. And that doesn't require multiplayer or the AH to accomplish. It is not "balanced around the ah."

Re:Thanks!

[dywolf]

No, it has nothing to do with piracy.

It has everything to do with money: money to produce, bottom line, return on investment.

Niche games dont return as much money as general appeal games. therefore, they no longer get produced with the same level of funding as other games. you dont see many indie developers making games on the same level as the big studios (or just "because it would be fun" other than by a few devs). they used to all have similar production values. those days are gone, and its nothing to do with piracy. it is entirely because the industry itself is maturing and you can no longer create a King's Quest, or Warcraft, or Doom, in your closet or among a few close friends, and reap a big reward. The cost of getting a game to market is dramatically larger than before, and it only keeps getting higher. Same goes for production time, and number of people involved.

Re:Thanks!

[Anonymous Coward]

I don't think you had to leave gaming.

There are still games that don't have DRM.

If you actually aren't a "pirate" (more like file sharer/copier), you'll be supporting the companies who don't do DRM while giving those who do a strong message

Re:Thanks!

[Sir_Sri]

That's essentially the hope with all of this is that a current pirate is a future buyer. It hasn't worked out that way for the last two releases though (but then it's not like can track specific churn, maybe we lose players, because they decide the series is bad, and pick up a new set of players who have lower standards).

You'd kind of think people playing a really niche game a year after release would translate into future customers if they can be, they like the game enough.

Though that goes to the next problem which is when they buy it on a steam sale for 5 bucks, meaning steam takes 30%, it's a 50/50 publisher split (which is pretty common for indie studios), so the publisher takes 35%, and that's 35% of 5 bucks left. So at a $1.75 per copy (less if it's part of a publisher bundle) you need to move an astronomical number of copies to make any money. I know stardock was thrilled they sold 100k of their latest title, which was a record for them, so putting numbers in perspective, for a 6 person team working 2 years taking 35% of the take means you need ~1.2 million dollars in revenue you need about 3.5 million dollars in sales to break even. When a record breaking title in a related genre moves 100k units you need charge about 35 bucks a unit. Stardock doesn't really have a publisher so they get 70% of the take straight up (but then they have higher costs too). If it wasn't for the government kicking in 40% we'd be in trouble, I'm not sure if Stardock gets any breaks like that.

Customers are only worth having if they pay for themselves so to speak, and for 1.75 a copy you're almost better off if they pirate it because your per unit costs for support, patches etc. can average out to more than that.

Re:Thanks!

[Sir_Sri]

Niche games dont return as much money as general appeal games. therefore, they no longer get produced with the same level of funding as other games

I understand what you're getting at, but this statement isn't quite correct. The premium games market has exploded in costs as you get professional voice talent, motion capture, tie in licences, high quality art and story telling etc. Those products can make a LOT of money an there are a lot of them. Indie titles cost about as much as they always have, the platform for under a million bucks has moved to mobile, but generally the product types are still there. But you are competing for player time against skyrim and wow and call of duty and battlefield etc.

It's a bit like movies. there are still cheap indie movies that aren't bad. But you can go to a new movie with 100 million dollar production costs every week. So why would you go to a movie with 100k production costs unless you know it's good (minecraft for example, which started out pretty indie)? Or put another way, you only have one friday night a week, given the choice between a movie that's 10 bucks and probably good, or a movie that is 10 bucks and of unknown quality which do you choose?

Which still goes back to piracy as a serious problem. Why pay for it at all when you can just pirate it? I've had personal friends tell me "I spend enough on games already" ya... you buy skyrim and call of duty and WoW etc. because those are much harder to pirate, to keep working, you don't want to risk your online account etc. But that doesn't help me in the slightest, less sales due to piracy of my game and I'm out of business.

As much as it's common to have piracy rates up in the 90% of active copies, those aren't all lost sales. But even a 10 or 15% drop in sales is the difference between being able to pay the bank back, and not, and having to lay staff off or change businesses. For the big producers they are skeptical of PC for a lot of reasons, piracy and support being the main ones, and that certainly hinders the platform a bit, but they have all moved to online accounts and distributions systems and online games that are not really online games precisely because that makes piracy much much much riskier for the pirate - or at least the pirate who cares about access to his entire steam account, his achievements, friends list etc.

Re:Thanks!

[Rakarra]

The whole game was balanced around you being able to buy and sell from the auction house.

Blizzard developers disagree with you. They have said, more than once, that the game is NOT tuned around the auction house, and that they played through in internal testing without the auction house.

Re:Thanks!

[Rakarra]

I am not the other guy, but maybe I can clarify: It is an online game. That is a fact. You may not like that, you may not have played previous Diablo games online ever, but Diablo III is sever side. It is an online game. That is not an argument, it is a statement of fact.

Diablo 3 is an online game for political reasons only. That is the objection. There's nothing about the game that requires you to play with other people. Does taking a single-player game and moving some game logic to a server make it an 'online game?' I suppose technically it does, but it's a shitty definition of online game.

Re:Thanks!

[Anonymous Coward]

You're confusing the terms single player and solo play. There are plenty of multiplayer games, both persistent and non, which have solo play styles in addition to group play styles. Single player games usually only have solo play modes, but some do have multiplayer modes... most notably consoles with the 'split screen' game options.

I'm not arguing the fact that they could have included an offline play mode, but that's not the point. The point is, it was billed as a multiplayer game with a solo play mode if you desired, not a single player game with multiplayer options.

Re:Thanks!

[_KiTA_]

Every decision after that became suspect. The drop rates, the difficulty levels, even the layouts of the maps. Everything can (and has been) designed to push people towards the RMT AH. They have a direct economic incentive to do so.

And yet they took decision that undermine RM AH significantly. In the gold AH, the 10 auctions max, 38 hours minimum wait time, means that you need a lot of time to extract maximum value from your loot. That means that you can find lots of cheap ( = 50K gold and below) that are dumped on the AH all the time. Inflation on good objects (the ones you need to kill diablo in inferno) is quite limited - I spent less than 100K gold to be fully geared for inferno act 1 and 2, that is a quantity of gold that you get by playing normally through the game (didn't do any farming, never used the AH until Act 3 hell)

You only need the real money AH to buy the very very best objects in the game, but there is really no gameplay need. Blizzard could have done a lot more if they really wanted to drive people to the real money AH.

Ah, but you're forgetting part two of Blizzard's nefarious plan:

Fill the Diablo 3 team with morons.

I have no idea how a company that has ran WOW alongside 3 WOW expansions could have forgotten to add a freaking Login Queue. And that's just the lowest of low hanging fruit. We're not talking about the story of Diablo 3 (Note to Blizzard: Go back to ripping off Games-Workshop, they have better writers than you), or the AH, or yeah, a billion different things that made that game a giant mess.

I guess my point is, them screwing up the execution does not preclude them having a really shitty "big idea" that they founded the rest of their design on.

Re:Thanks!

[PopeRatzo]

See, I can run Diablo 2 right now, more than 10 years after the release and I can play with friends on Battle.net. 10+ years of support, patches and servers. Is that not worth your $60 or is it something you expect from all the f2p bullshit games?

Let me get this straight: You're saying Diablo 3 is totally worth it because Diablo 2 was so good?

Re:Thanks!

[Rakarra]

The fact that far fewer games are produced

The problem is that the game industry has adopted Hollywood's business model -- games have to be bigger and bigger with enormous budgets now, and each has to trump all the competition. Unless you're developing for the mobile market, you just can't make a game with a 5-10 man team anymore. Now games have to have CG cut scenes, voice acting, orchestra soundtracks. Of course there are fewer games, and I don't think piracy is the cause. Piracy has always, always been an issue for the game developers.

Fewer games are developed now? If I'm looking for quality over quantity, then I'm not sure that's a bad thing.

Plus you're ignoring games that keep people around for years and have hundreds of hours of gameplay. For about five years after World of Warcraft came out, my game-buying amount dropped to... well, zero. I was spending $180/year on 'gaming,' but it wasn't buying new (or even used) games. That's the penalty for the subscription model, or even DLC.

Re:Thanks!

[Anonymous Coward]

It is reasonable to complain about the always-on connection - but really, in 2012, that is more a question of principle than a real constraint.

And that's just so elitist, expecting everybody to have what you have. Just today a friend went to Africa for holidays. He has his latop with him and won't be able to play the game at any time because he is staying at a place where they don't even have phone lines. So yea, always on, fuck you rest of the world.

Re:Thanks!

[gutnor]

You probably tried the game very early after it was released. Now the gold AH is literally filled with cheap stuff. Only the very best item is really expensive (i.e. several millions). My wife and I faced the same difficulties you were having in Hell. We spent something like 50K gold and 1 hour digging in the AH and we were good to go until Act 4. It costed a bit more to get inferno level gear, but currently the most expensive piece of kit I have is about 30K and it is going alright through Act 2. That is much that I would have expected remembering D2.

Re:Thanks!

[Anonymous Coward]

Diablo 3 supports multiple players ... it is not a true multiplayer game.

The need to be always connected is only to control pirating, and nothing more - in this model, without a paid for account you can't play - fullstop.

In theory I agree with them - pirating IS a problem, whether people on /. believe it or not! However, in practice, the idea sucks because of all the server issues they've had! :(

The Auction House is simply an attempt to make more money - players used eBay in the past to sell items, Blizzard have simply tried to cash in on that.

Diablo 3 is a great game, but it also has some major issues :(

Re:Thanks!

[Anonymous Coward]

It's because they built the game to be a client/server setup like WoW. They couldn't just "turn on" offline play without first putting a local copy of the server code on your computer. And they will never do that because then people would have all they need to setup functional private servers.

Re:Thanks!

[Krater76]

I'm afraid you're praying to the wrong God here. Jesus would tell you to forgive, and seek in you the strength to go to Blizzard and convince them to lose their bad ways, by being a loving example to them, as you'd like them to be to you.

Maybe he was thinking more of the Old Testament, fire and brimstone God. You know, the one who killed everyone with a flood, destroyed cities for being too 'unclean', wanted a guy to kill his own son to show his faith, or turned a woman to a pillar of salt just for looking at his work. OT God was a pretty big asshole.

Yes, the 'baby Jesus' remark makes an OT God reference a little difficult.

Re:Thanks!

[Anonymous Coward]

> It is reasonable to complain about the always-on connection - but really, in 2012, that is more a question of principle than a real constraint.

Here's something to consider: if I'm an old man in the future, and I visit my attic where old computers are stacked, and manage to boot up that old 386 computer, then Wolfenstein 3D, Biomenace, and so on are gonna work on it. When, however, booting up that computer from 2012, it'll be totally useless due to all these things that require an online connection to services that don't exist anymore in 2070.

Yah

[the_Bionic_lemming]

Can I please have my single player offline games back?

Re:Yah

[DoofusOfDeath]

"No." -Activision

Re:Yah

[Anonymous Coward]

No.

Next question.

Re:Yah

[Teckla]

Can I please have my single player offline games back?

Speaking just for myself, I'm skipping both StarCraft 2 and Diablo 3, because of the onerous DRM and always-online requirements Blizzard now uses.

I wonder if the DRM and always-online requirements are preventing enough piracy that results in sales, to overcome the loss of buyers like me.

Re:Yah

[DoofusOfDeath]

My guess is that what they're losing in sales to people like you (and me), they're more than recouping in the buy-things-for-real-world-money shenanigans they've instituted.

Sucks, but I guess that's how the cookie crumbles.

Re:Yah

[Teckla]

Ah well, I'm still glad people like us are doing what we can, and voting with our wallets.

(Piracy is not an option in my house.)

Re:Yah

[the_Bionic_lemming]

I said no to star craft two and diablo 3 as well.

totally sucks as I really put a ton of hours in the previous versions.

I'm a bit nostalgic to play Warcraft 1, anyone know if that'll load and play on XP?

Re:Yah

[VortexCortex]

My guess is that what they're losing in sales to people like you (and me), they're more than recouping in the buy-things-for-real-world-money shenanigans they've instituted.

-- Or --
They blame the lost sales on piracy and use the figures to justify even more draconian nonsense.

Re:Yah

[Anonymous Coward]

Considering there is probably a very whiny total of 10 of you, yeah they probably won that round.

Re:Yah

[Rewind]

Can I please have my single player offline games back?

Speaking just for myself, I'm skipping both StarCraft 2 and Diablo 3, because of the onerous DRM and always-online requirements Blizzard now uses.

I wonder if the DRM and always-online requirements are preventing enough piracy that results in sales, to overcome the loss of buyers like me.

You didn't miss anything with Diablo 3 really. It was ok, but nothing great. A step back for Blizzard if you ask me. With StarCraft 2 it was your own loss if you liked multiplayer. Also it had an offline mode that thanks to internet issues I got to make several uses of.

Re:Yah

[Anonymous Coward]

They recently announced that Diablo 3 has sold over 10 million copies since launch (3.5 months).

Diablo 2 sold about 4 million copies in the first 18 months.

I'd guess that Blizzard are pretty happy with sales. It may end up selling as much as 5-10 times more than Diablo 2, despite the DRM hate, always online hate and criticism that the end-game and itemization need further work.

Re:Yah

[Rewind]

Best not to bother with trying to run it on XP. It, like most anything with a DOS version, tends to run under DOSbox better/easier than any other way.

Prepare to get super annoyed with the control scheme though. I really feel RTS controls were all rubbish until StarCraft 1, but stuff like Dune RTS and WC1... I honestly don't know how I played it. Then again I guess I didn't try to play it like I do now with RTS games were I like to try and pretend like I have great micro/macro.

Re:Yah

[Anonymous Coward]

I am staying away from all blizzard games until they change their TOS. I want to actually have some rights to level I make in Starcraft 2, and some control over my data on b.net. As it is blizzard practically owns your computer the second you click "I accept".

I actually wondering why no one else has commented on this, and comments of this nature seem to disappear. I have to wonder if blizzard has some bot or virus that is intercepting these comments and is getting rid of them somehow.

Re:Yah

[DoofusOfDeath]

Ah well, I'm still glad people like us are doing what we can, and voting with our wallets.

(Piracy is not an option in my house.)

Honestly, I don't expect voting with my wallet to have any real impact. However, Torchlight 2 should provide roughly the kind of fund I'd been hoping for from D3. So even if Activision doesn't care that I go for T2 vs. D3, at least I can still have my fun.

Re:Yah

[Anonymous Coward]

I said no to star craft two and diablo 3 as well.

totally sucks as I really put a ton of hours in the previous versions.

I'm a bit nostalgic to play Warcraft 1, anyone know if that'll load and play on XP?

Yeah, it's called Dosbox.

Is there something about using Windows that makes people completely unable to find their own trivially-searched information? Or is it just that these are the people who use Windows without feeling completely cramped by its assumptions and limitations and so they never switch to something else?

Re:Yah

[LordLucless]

Are they doing the same thing they did when they said they broke the pre-order record? That is, counting all the copies of D3 they gave away to WoW subscribers who signed up to the Annual Pass as pre-orders. That's the only reason I have the game. I played it for maybe 2 weeks. Then it got old. I played D2 for years.

Re:Yah

[the_Bionic_lemming]

Actually, when I tried to use dosbox I could never get the sound driver bit right. I don't have a lot of time to spend figuring it out either.

It's called "earning a living" you should try it sometime.

Re:Yah

[blahplusplus]

"I said no to star craft two and diablo 3 as well."

Not a loss, the original developers are long gone. D3 and SC2 are bland and the magic is long gone. They survive through sheer inertia and new bodies without a long history of gaming.

Re:Yah

[letherial]

Well i spent 60.00 before i realized it was always online, Accutuly, the only real reason why i bought the game was to find out the rest of the story; i wasnt awed like i was in diablo 2, but it was cool...azmodan was cool...diablo...not so much. I dont know what i would of done had i figured out that it was always online. Maybe i would of bought it, i bought GW2 and all its expansions; i am a pirate at heart though, so buying any game is a big deal.

However,

I did get my 60.00 back cause somone wanted to buy something from me for real money shenanigans, so i guess i sorta pirated it? not realy, but it was still free hooray!

Re:Yah

[Anonymous Coward]

Wow, way to be a dick to someone that was trying to be helpful. If you can't figure out Dosbox then you should probably get back to making a living picking up trash or sweeping floors.

Re:Yah

[the_Bionic_lemming]

That stung you huh?

Re:Yah

[Anonymous Coward]

Actually, when I tried to use dosbox I could never get the sound driver bit right. I don't have a lot of time to spend figuring it out either.

It's called "earning a living" you should try it sometime.

If you don't "have time" to do about 5-20 minutes of Google searching then you're either a national leader, or a self-important douche.

Re:Yah

[Anonymous Coward]

Not like the guy he was replying to was innocent of dickishness:

Is there something about using Windows that makes people completely unable to find their own trivially-searched information? Or is it just that these are the people who use Windows without feeling completely cramped by its assumptions and limitations and so they never switch to something else?

Re:Yah

[the_Bionic_lemming]

I did more than 5-20 minutes trying to set up the sound for the game - but instead of acting like a shithead, why don't you let us know how to connect the sound to the game?

After all, it's trivial right? 5-20 minutes is all the time it'll take you.

Then you can really make me look stupid. :)

Re:Yah

[Anonymous Coward]

I said yes to diablo3. Next time i'll know better, as this was the first(and only) single player game that i've bought that requires you to play it online. At launch i couldn't play at all. After that it's been a bit better, but i just hate it when i have the time to play and their servers are down for whatever reason. I'm not a teenage with unlimited amount of time anymore, so the game has to work when _I_ want to play, not the other way around. And now it's hacked? Great, just great.

Re:Yah

[kat_skan]

"Yes." -Runic

Re:Yah

[Anonymous Coward]

My guess is that what they're losing in sales to people like you (and me)

A few grand- no big deal. You guys are freaks. Loud freaks. But freaks.

We're soooooooooo tired of hearing these same complaints every single time Blizzard is mentioned. Would you guys mind getting over it and getting a life?

Re:Yah

[trawg]

Speaking just for myself, I'm skipping both StarCraft 2 and Diablo 3, because of the onerous DRM and always-online requirements Blizzard now uses.

Just to provide a different viewpoint (not that I have any problem whatsoever with you doing that), I play StarCraft 2 exclusively online in multiplayer mode.

I tried the single player game and got an hour or two into it before getting bored. I haven't really enjoyed single player games for many years; I prefer the competitive (or co-operative) aspects of multiplayer games.

With online multiplayer games, "always on DRM" has never really been a big deal for me - though I certainly have avoided buying games from Ubisoft and other publishers because of their onerous DRM requirements, even though the games have interested me (e.g., the recent From Dust, which looks as close to Populous as anything has for many years).

So I totally understand your perspective, but just wanted to chime in and say that - for me at least, and I assume a few others like me - single player offline is not a feature we want any more.

Re:Yah

[Anonymous Coward]

Can't wait for torchlight 2 to be honest.

It'll be what Diablo 3 should have been.

Offline capable. Online optional, multi player co-op with LAN play iirc.

It even has Diablo 2s story for all intents and purposes. Hero of game one gets corrupter by evil mcguffin from first game. Goes on world wrecking rampage.

Re:Yah

[Anonymous Coward]

To be fair to SC2, at least most of its charm IS actually multiplayer, and gathering with my friends for a LAN party nowadays is much more hassle, than for a quick battle.net game.

Re:Yah

[Anonymous Coward]

>I wonder if the DRM and always-online requirements are preventing enough piracy that results in sales, to overcome the loss of buyers like me.

Diablo III has not been cracked even though it has been out 3 months. You cannot even play it as single player. Meanwhile it's one of the best selling games ever.

Does that answer your question?

Re:Yah

[Anonymous Coward]

Same here. I was really looking forward to SC2, too.

Re:Yah

[guttentag]

Sucks, but I guess that's how the cookie crumbles.

Blizzard's cookies don't crumble. They persist until Blizzard no longer has a use for them, and then simply blink out of existence when they expire. It's rather cleaner than the old crumble method in which bits of data would slowly break off and go all over the place.

Re:Yah

[Anonymous Coward]

for starters, never use pulseaudio. it's shit. try alsa.

didya think of that? jackass.

Re:Yah

[DoofusOfDeath]

Amen, brother. And so Activation has lost my business to Runic.

I doubt Activision will really notice or care about the small % loss of money, but it only takes a small number of people buying TL2 instead of D3 to give Runic a huge % increase in revenue.

Re:Yah

[cpricejones]

I doubt there are that many people like you who would really not play because of DRM (i.e., many people don't even know what the big deal is). In my mind, many of these people who profess to be anti-DRM would have downloaded a hacked or cracked version of game. I could be cynical, but I can understand why the companies want to protect their games even if the method is BS.

In any case, it seems like more people would skip these two games in favor the free-to-play League of Legends, which appears to be eclipsing both in terms of no. of players. Different game type of course ... but not to burst any bubbles, SC2 SCBW and Diablo 3 D2

Re:Yah

[Anonymous Coward]

I did more than 5-20 minutes trying to set up the sound for the game - but instead of acting like a shithead, why don't you let us know how to connect the sound to the game?

After all, it's trivial right? 5-20 minutes is all the time it'll take you.

Then you can really make me look stupid. :)

besides mentioning alsa ... maybe you just don't know jack-shit about how DOS handled sound. that would mean your problem is not that dosbox is malfunctioning, it's that you don't know how to use any dos. it would explain having problems most users just don't have.

back in those days sound cards had an I/O port like 0x220, an IRQ number like 7, and a DMA number like 1.

it really didn't matter what they were. what did matter was that the game settings match the card settings. dosbox is an emulator so you can set the numbers to whatever, but 0x220, 7, 1 is pretty standard. check the goddamned config file, probably located in ~/.dosbox/ (its name might vary with version, mine is ~/.dosbox/dosbox-0.74.conf - note the DOT in .dosbox you douche). then start the game, go into its options and check what settings the game is trying to use. also check type (like SoundBlaster 16 aka sb16) and make sure those match. sb16 is pretty standard and probably default.

if they don't match you found your problem. your trivial, easily remedied, easily searched little problem. that has nothing to do with dosbox. that would be the same on any implementation of dos. you're welcome. you see back in those days each game had to directly talk to the hardware itself because it's a single-tasking OS that didn't abstract away things like sound.

Re:Yah

[Anonymous Coward]

To be perfectly clear, Blizzard runs almost completely without oversight from Activision. Activision has only high level oversight of Blizzard (board and senior executive level) and Blizzard makes all their own day to day decisions. Its really easy to blame the 800 pound gorilla in the room, but Blizzard still runs independent on this front. - Speaking from experience, hence the coward status.

Re:Yah

[benhattman]

Ditto. Moreover, I no longer get a thrill in my medula oblongota every time a Blizzard game is announced. They are just another manufacturer to me now.

And, if we're all being truly honest, even Warcraft III seemed to have lost a little bit of it's soul. Blizzard wasn't into shenanigans then, but I found that game a little less fun than their earlier RTS. I think it's the RPGization of the gaming industry. RPG characteristics like leveling up can be addictive, but they DO NOT make every game better even if they are being added to every game.

Re:Yah

[Anonymous Coward]

This is only a problem on slashdot where everyone plays games alone... I don't want to stereotype but did the nerds not learn in school that at some point they have to play with other people?

Re:Yah

[the_Bionic_lemming]

Still doesn't work.

How much more time you got left in that 10-15 minutes and trivial setup?

Re:Yah

[Anonymous Coward]

Still doesn't work.

How much more time you got left in that 10-15 minutes and trivial setup?

For me that was all it took - maybe 4 minutes of config.

Sorry it is not working for you. Maybe you fuck up basic things?

Your next step is run it from a terminal so you can collect an error message. Then google that. Simple. Really if you don't know this you should just go back to windows. The best thing about linux is that the clueless get frustrated, whine about it, and go use something else.

Re:Yah

[the_Bionic_lemming]

So, you give up then?

Thought so.

Re:Yah

[Kalriath]

In that case, when did Mike Morhaime become an asshole?

No, I don't believe you at all that ActivisionBlizzard doesn't control any of Blizzard's decisions. The rapid about-turn in the way Blizzard treats customers since the merger tends to be at odds with your claim.

Re:Yah

[Rakarra]

Wow, way to be a dick to someone that was trying to be helpful. If you can't figure out Dosbox then you should probably get back to making a living picking up trash or sweeping floors.

If you start with an insult, expect to get one back.

Remember "just saying what's on my mind" == "Just calling it as I see it" == Being a dick.

Re:Yah

[Anonymous Coward]

So, you give up then?

Thought so.

So what was your error message?

Niggers.

Re:Yah

[the_Bionic_lemming]

Nope, it wasn't Niggers.

Re:Yah

[Anonymous Coward]

After having played D3 and similar games now, I am almost tempted to bug my local Congresscritter to bring up the old bill wanting to tax the shit out of MMO real money sales. Yes, people bitched before, but if they had read the previous bills closely enough, it had stated that the costs would be on the provider who would be taxed per transaction, and there was language restricting what they could charge customers.

Kind of like how you know, real auctions and sales normally work.

Cryptographically Scrambled Passwords

[PhrostyMcByte]

I'm going to go out on a glass-half-empty limb here and say that means encrypted, not salted and hashed. "Cryptographically Scrambled" is too obviously ambiguous. I hope I'm wrong!

Re:Cryptographically Scrambled Passwords

[GerardAtJob]

It smell like XOR... ;)

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Even if they are salted and hashed, accounts of high value can still be brute forced.

Re:Cryptographically Scrambled Passwords

[ericloewe]

Yeah, but the salted hashes aren't of much value then...

Re:Cryptographically Scrambled Passwords

[safetyinnumbers]

The 'additional info' link in the announcement says they use SRP, which I'd not heard of but seems to be a hash-based system. http://srp.stanford.edu/

the server carries a verifier for each user, which allows it to authenticate the client but which, if compromised, would not allow the attacker to impersonate the client

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

I'm going to go out on a glass-half-empty limb here and say that means encrypted, not salted and hashed. "Cryptographically Scrambled" is too obviously ambiguous. I hope I'm wrong!

From Blizzard's FAQ on the breach

What can you tell us about the scrambled passwords that were accessed?
Cryptographically scrambled versions of passwords for North American players were accessed, protected by Secure Remote Password (SRP) protocol. This information alone doesn't give unauthorized users the actual passwords -- each password would need to be deciphered individually. The added layer of protection from SRP makes that process computationally very difficult and expensive.

Re:Cryptographically Scrambled Passwords

[Mashiki]

SRP is augmented by PAKE, I've heard people call it the latter before which is wrong. Some info here for those that have never heard of it. But it's not new, but it's very useful.

Re:Cryptographically Scrambled Passwords

[JesseMcDonald]

On the contrary, it is much easier to brute-force the password matching a known salt and hash on your own workstation, cluster, or botnet than it would be to brute-force it through repeated logins to a remote server, particularly if basic security precautions are implemented, such as rate-limiting login attempts and locking the account after several failures.

Salted and (repeatedly, as with bcrypt) hashed passwords are much better than merely hashed passwords, which are in turn somewhat better than plain-text passwords, but you really don't want any of the three out in the open. Actually reversing the hash is unlikely, but if a user with a valuable enough account picks an insecure password, not even salting will prevent it from being brute-forced from the password side.

If you really need all your accounts to be secure in the face of server data leaks, you're looking for public-key cryptography and challenge-response authentication. Server-side password checking against a hash isn't sufficient. However, if you must use passwords, at least generate them randomly on the server rather than letting users pick their own. Humans are really bad at randomness and pick passwords subject to trivial dictionary attacks far too often.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Given that this is the same company that thinks case sensitivity isn't important in passwords, I'm not too hopeful either.

Seriously, give it a shot. Try logging in with your capslock on.

Re:Cryptographically Scrambled Passwords

[VortexCortex]

Which is still very secure if they used a one time pad with the XOR.

The only thing stronger than XORing with a one time pad, is XORing the input with itself.

Re:Cryptographically Scrambled Passwords

[ericloewe]

I'd agree with you, if there were a real very high value to the accounts, which is doubtful. The computing power needed to brute force the salted, hashed passwords is probably more expensive than the reward is valuable. It's not worth the hassle.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

It doesn't matter if they're salted and hashed because someone can just use the answer to the security question to reset the password.

Re:Cryptographically Scrambled Passwords

[Stormy Dragon]

The letter from Blizzard itself says they use the Secure Remote Password protocol, so this is what they mean by "Cryptographically Scrambled":

http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Even if they are salted and hashed, accounts of high value can still be brute forced.

Yep, it would only take about $100k+ of S3 compute time to break my wife's password in under a year, and that includes all lower case plus numbers. Must be some highly valued accounts or horribly weak passwords.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Since they say that they use SRP for authentication, so in their database they most likely save username, a salt and g^hash(salt, password) in ZN , where N is a large prime.
g and N are known to both the server and client, an attacker would first have to extract that from their client. As is the hashing algorithm.
Then the reference implementation uses sha256 for hashing.
So your password should be quite hard to bruteforce as it has a salt. They could even implement multiple rounds of sha256, but that is just speculation.

for more about that : http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

( AC because Im too lazy to register )

Re:Cryptographically Scrambled Passwords

[Nemyst]

For storage, possibly, for authentication, I'd say it's quite the opposite ;)

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Who cares!

It will be a matter of time before they mostly are bruteforce cracked.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

If you can hack other people's computers and have them do the work then your cost isn't very much.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

I'm going to go out on a glass-half-empty limb here and say that means encrypted, not salted and hashed. "Cryptographically Scrambled" is too obviously ambiguous. I hope I'm wrong!

More likely to be hashed, no? If unsalted, all they need now is a reverse hash database.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

..or rot13 :)

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Right, for those who don't have any experience in this area, with SRP, as with password hashing, the server doesn't end up knowing your password at all. They get some numbers, which they can use to verify that whoever is talking to them knows the password. But unlike with most web-based password hashing schemes in SRP your password never even gets sent to the server. They don't "hash it and then throw it away" like a Facebook or Wikipedia they simply never have it at all. It goes a bit like this:

Client: Hey, pick a fucking number
Server: Alright, I picked R (a random number)
Client: OK, if I do this complicated operation on the password using the number R, the answer is X
Server: Oh, you got X? Well if I do some maths using X and R and what I know about your password, then... yes, you must know the password or have a breakthrough in mathematics.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

It's "ambiguous" because it was purposefully dumbed down because the majority of Blizzard's customers have zero computer knowledge. They wanted to be transparent about password data being stolen, but at the same time wanted to make sure people knew that the stolen passwords weren't plaintext or anything. Trust me, anything with "Mike Morhaime" is the signature is going to be the least technically specific language possible because the target is the 80% of their users that only use their computer for email, Facebook and WoW and don't play any other PC games. WoW was to PC gaming like the Wii was to console gaming. It brought in a lot of people who otherwise didn't play games at all.

Think about this for a minute: they had to add an "upgrade" button to their character select screen to let players know that an expansion was available because they had customers who didn't realize new expansions existed.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Is it possible that you misread something? I've heard SRP called an "augmented PAKE" system before, meaning a PAKE system where the information on the server is not sufficient to log in. I don't know what it would mean for SRP to be "augmented by PAKE".

Nuclear

[Anonymous Coward]

So the hashed passwords were or we're not salted?

Well now.

[Frosty Piss]

Since I''m over 25 and work for a living, this does not effect me.

Re:Well now.

[Razed By TV]

Since I'm over 25 and work for a living,
and since I got into Diablo and Starcraft when I was under 25,
this does effect me.

Re:Well now.

[Svippy]

Since I am 25 and do nothing for a living, your incorrect spelling of 'affect' affects me.

Re:Well now.

[Anonymous Coward]

Because the only people that play games are young and don't work? As if playing games for entertainment is somehow immature, as opposed to camping out on a couch and watching ESPN?

Nonsense.

Re:Well now.

[Sir_Sri]

Since I''m over 25 and work for a living

making you the target market for games, and modern MMO's. Especially so if you're male. Because you know, the people who actually work at blizzard want to play their own game, and they're mostly over 25 and have jobs. So if you're one of the 40 million or so people who ever created a battle.net account for starcraft or diablo or WoW then yes, this effects you. Because what was your security question, have you ever reused it, and was it publicly available information?

Re:Well now.

[Anonymous Coward]

Since I am 25 and do nothing for a living, your incorrect spelling of 'affect' affects me.

he spelled it correctly, he just wasn't smart enough to know the difference between a noun and a verb

Re:Well now.

[Mashiki]

Since I''m over 25 and work for a living, this does not effect me.

Well this will surprise you then. The prime market for MMO's and gaming in general is...

Male, 25-41, working, with an average yearly income of $38,000

Re:Well now.

[Anonymous Coward]

Since I am 25 and do nothing for a living, your incorrect spelling of 'affect' affects me.

he spelled it correctly, he just wasn't smart enough to know the difference between a noun and a verb

"Effect" can be a verb, too, but it doesn't make sense in the way the OP used it.

Re:Well now.

[Charliemopps]

is that Average income when they START playing or after they're living on disability?

Re:Well now.

[Anonymous Coward]

Cute. The average gamer is 37. I'm 35. I've earned at least $120k/yr every year for the last decade. I play Star Craft 2 and Diablo III.

Re:Well now.

[Anonymous Coward]

if they’re pulling $40k on disability they are doing something right.

Re:Well now.

[Mashiki]

You might want to you know, go and live outside of a large city sometime in your life. https://en.wikipedia.org/wiki/Household_income_in_the_United_States

Oddly, this is the first time that Canada has a higher median income than the US though. About 44k, even surpassing men. You'd actually be surprised at how well you can live on $30k/year, heck even $25k/year depending. Especially if you don't have anything else tying you down.

Re:Well now.

[Anonymous Coward]

You have much to learn, young padawan.
http://xkcd.com/326/

Re:Well now.

[Anonymous Coward]

Since my age does not matter as long as I have a high-school education, your incorrect labeling of 'incorrect spelling' what is clearly a mistake of word usage does not affect me. It just confirms the already low opinion I have of you.

Re:Well now.

[Anonymous Coward]

Since you are 25, do nothing for a living, and are a jerk, I thought I'd point out that your characterization of the poster's incorrect spelling which is actually correct, effectively makes you look like a 25 year old lazy idiot. Grammar and spelling are two different things. Now, get a job and / or get off my lawn.

Re:Well now.

[antdude]

And you shouldn't be working for using the word word. :P

Re:Well now.

[Frosty Piss]

"Spelling Nazi" bullshit is no longer funny. Now get back to taking my order. And I could I get my burger without spit?

Re:Well now.

[Svippy]

Considering the mistake, I am more offended by people modding my comment 'Funny'.

Re:Well now.

[Svippy]

Calling it an 'incorrect spelling' was a joke. I guess all humour is triumphed by pedantics.

So, looks like I'm cancelling that e-mail address.

[DRAGONWEEZEL]

and removing my CC (oh, wait, I already did that).

This is going to be bigger than the Sony breach

honestly

[ganjadude]

If they got my passwords now, I dont care. After the hassles i have had with D3 from day 1 I dont even care anymore,

Re:honestly

[failedlogic]

I bought D3 about 1 week after launch. Was very disappointed. Asked for a refund - four times. Blizzard refunded me.

Re:honestly

[ganjadude]

I pre ordered the game. I know I dont have 24/7 access so my results may be different than others however. I have been able to play no more than 35% of the times I have attempted to.. I have had to redownload the.... almost 8 gig file 8 different times because it does not seem to understand the "forced update" every other day they push. I simply want to play by myself, which I cannot do without "checking in with mommy" and that is when it lets me connect. I assume (hope) I am in the minority here, but either way, I asked for a refund about 3 weeks after the game was released... however because I pre-ordered, I was unable to get a refund because i "bought the game more than 30 days aggo" even though it was unplayable until 20 days ago in my case. I was one of the biggest supporters of the blizz, and I had a feeling things would go bad with activision buying the place out (which I got a feeling from the 10 or so techs I talked to trying to fix my problem is the feeling in the office..off the record of course..) but I dont think I can buy another blizz game after the way I feel i have been screwed here. Time to find a new dungeon crawler.

Re:honestly

[exomondo]

If they got my passwords now, I dont care. After the hassles i have had with D3 from day 1 I dont even care anymore,

Yeah i gave up on it too, the having to wait to play because the servers were full, the lag, the crashes...there's no reason it couldn't have just been an offline game like its predecessors. Very disappointed with it.

Re:honestly

[lgw]

I pre ordered the game.

Why would anyone do that in this day and age? A game is something you download, so paying for it more than a day or so before it comes out seems pointless. Waiting until there are some reviews seems better still.

Having D3 at the launch did you little good - the servers were so overloaded that playtime was quite limited the first week.

Re:honestly

[Anonymous Coward]

I assume (hope) I am in the minority here, but either way, I asked for a refund about 3 weeks after the game was released... however because I pre-ordered, I was unable to get a refund because i "bought the game more than 30 days aggo" even though it was unplayable until 20 days ago in my case.

The solution to that is to call up your credit card company and issue a chargeback.

It probably won't even go as far as arbitration. If it does go to arbitration, these tend to be in the customer's (your) favor.

Chargebacks cause hassle for the merchant. In this case it will be well earned. But for fuck's sake, don't just lie down and take it. It sends entirely the wrong message.

Re:honestly

[ganjadude]

I pre ordered it for the extra goodies you get by pre ordering, it was the digital download.

Re:honestly

[Woldry]

Sometimes a pre-order gets you benefits, like in-game rewards, access to the beta, or the ability to log in several days before everyone else. These are my reasons for having pre-ordered Guild Wars 2.

Re:honestly

[lgw]

Yes, good point. I was thinking specifically of pre-ordering the physical box. MMOs (and MMO expansions) have had some pretty enticing rewards for pre-orders.

Re:honestly

[Kalriath]

Of course doing that also locks you out of every other game from that vendor. A chargeback against Blizzard means you lose access to WoW, Starcraft II, Diablo III, and any future products (because you can be damn sure they won't let you keep an account). A chargeback against Valve means you lose access to a metric fuckton of games, and means a metric fuckton of future games become inaccessible to you.

Anyone have real information?

[Kenja]

Nothing on battle.net, blizzard.com or any other location but marketwatch. Link in the article goes to a non-existant page on blizzard.com. Not saying shenanigans just yet, but some real information would be nice.

Re:Anyone have real information?

[Kenja]

Found it. http://us.blizzard.com/en-us/securityupdate.html URL in the article is wrong.

Re:Anyone have real information?

[safetyinnumbers]

They messed up the link in the article.

http://us.blizzard.com/en-us/securityupdate.html

Re:Anyone have real information?

[Anonymous Coward]

http://eu.blizzard.com/en-gb/securityupdate.html

Re:This is not news

[DRAGONWEEZEL]

meet me.

I have a maxed out Mage on Rexar that hasn't yet been hacked, BUT I do agree w/ you. Everyone 'else' I know has had their accounts just trashed.

Naked Gnomes everywhere...

Re:This is not news

[SomeJoel]

When my account got hacked, it was the final straw that led me to quit WoW. All signs pointed to it being an inside job. I had a dedicated (hard) password for the site, I had not visited any questionable websites, and I hadn't installed any addons in months.

Whoever hacked it had a seriously weird sense of priorities too. They had sold the starting gear off my level 1 bank alt types and mailed off the money (at a loss!) but hadn't bothered to strip my midrange characters. They used my level 85 main character with bot-aided speedruns through Karazhan. Ironically, when I regained control of my character, I had a ton of gold from their most recent run. I donated it all to my guild and quit the next day. Since I was an officer, they'd looted that too - but since it was a casual guild the gold they got me easily replaced any items in there we'd cared about.

Re:This is not news

[Anonymous Coward]

My account keeps being hacked*, despite the fact I don't login, have no real interest in playing the games, change it to random passwords even I don't remember, run linux day to day, and have it associated to a gmail account which hasn't had any suspicious activity. I've tried to reason with them, but they refuse to listen. I've come to the conlusion that Blizzard are incompetant in this area.

* I've never seen any proof of my account being hacked besides their e-mails telling me and locking my account. I managed to get them unlocked the first few times, my characters still has all items and gold I remember. Now they want me to fax a passport or some 'real identification'. I honestly don't want the games that bad, I'm just annoyed they're taking them off me.

The Responsible Thing To Do

[TranquilVoid]

Technically I'm working from home today, but I guess good security dictates I log into WoW to change my password and check for any foul play.

Re:The Responsible Thing To Do

[VortexCortex]

While you're at it, edit the realmlist.wtf file and point it at a private server...

Re:The Responsible Thing To Do

[Anonymous Coward]

Ones that would be able to get your password by merely editing the server source code just as well as Blizz could if they bothered. With worse gameplay.

Re:The Responsible Thing To Do

[Anonymous Coward]

I did that. Nothing appears to be out of normal. I am not a regular WoW player but Blizz seems to have forced a more-frequent authentication request. I don't think that they are stupid and they will rapidly fix their external (or maybe its internal) security breach and also upgrade their external authentication requirements.

Hopefully without requiring too many extra auth request from its users.

Karl

Who cares?

[PhilistineGuillotine]

They didn't get billing information and can easily revert any accounts that get messed up.

Re:Who cares?

[PhilistineGuillotine]

Blizzard can easily revert, I mean.

Re:Who cares?

[Anonymous Coward]

But they can't revert the fact that email addresses were compromised. I started using my domain because I thought Blizzard would treat it kindly. I used it with dropbox too when they got hacked. I hope I don't start getting a ton of spam now :\

Re:Who cares?

[wiredlogic]

Many people use the same password for all accounts including their e-mail. You can also assume that the same login and/or e-mail username is used in other places by many people and attempt to access other outside accounts. This creates a huge security threat for those affected.

Re:Who cares?

[c0lo]

They didn't get billing information .

The didn't get girlfriends either... so stay tuned, they'll try again.

Re:Who cares?

[TCM]

If you use your domain, why aren't you using battle.net-$rnd@$yourdomain, for example?[1]

The luxury of your own domain is precisely the ability to use one address per "consumer" and disable individual addresses at will.

[1] $rnd being 4 random chars to keep people who know your scheme from guessing websites you use.

FYI, "secret" questions can not be changed.

[Kenja]

Once a Battle.net account is created, the first name, last name and security question can not be changed. Since these questions are now compromised, everyone is SOL.

Re:FYI, "secret" questions can not be changed.

[dgatwood]

That hasn't been true for over a year.

Also, they're going to en masse make everyone change their security question/answer real soon now.

Re:FYI, "secret" questions can not be changed.

[Sir_Sri]

They said they're working on a change to the security question.

But yes, in general this is bad. Although that's sort of the idea behind salting and hashing passwords, that even if someone gets the passwords they still can't recover them.

Re:FYI, "secret" questions can not be changed.

[Kenja]

The link you provided says that only Blizzard can change them, so it sounds like its still true for now unless you want to argue with them on the phone and provided a photo id.

Re:FYI, "secret" questions can not be changed.

[Anonymous Coward]

The real problem here is not that you can't change it, it's that, unlike a password that probably has (or at least should have) no relevance to your actual life, the security question is likely to be something that is a constant, such as "last 4 of SSN" or "City of Birth" and are also likely to have been used elsewhere.

Re:FYI, "secret" questions can not be changed.

[Seumas]

Unfortunately, your mother's maiden name never changes, so you're basically SOL at your bank, broker, utilities and other services, too.

Re:FYI, "secret" questions can not be changed.

[dgatwood]

You mean my mother, née Oklahoma, or my mother né Icosahedron?

You don't mean to say that you actually give them the real information, do you? :-)

Re:FYI, "secret" questions can not be changed.

[Anonymous Coward]

Glad I don't use my real name despite their fascist TOS.

Re:FYI, "secret" questions can not be changed.

[arth1]

You mean my mother, née Oklahoma, or my mother né Icosahedron?

You don't mean to say that you actually give them the real information, do you? :-)

No, but you have to remember what answer you have at each and every site. When there are a lot of them, that becomes a very difficult task unless you keep the answer the same everywhere.
And if you do, or did, the crackers now know that your mother was once named Slimyfootdisease.

This is great news.

[Anonymous Coward]

Blizzard is now going to give us free stuff so we don't fret about this.

Please let it be mount swag. That'll be awesome. I guess I'd better buy a subscription card tomorrow.

Word choice? Dwarfed!

That's a sign I tell you!

Re:This is not news

[spire3661]

Same WoW password since 2004, never been hacked once. I might not even change it after this because , frankly, i dont care.

"Were hacked" or still pwned?

[Anonymous Coward]

Have the fully removed any backdoor? hopefully they've taken huge steps to ensure that now password changes cannot be intercepted before the encryption process :)

Re:This is not news

[Sir_Sri]

Of the 56 unique players in my guild when we quit, only 2 had ever been hacked. We've certainly had people who were hacked off and on over time, (and most of them left the guild) but once they brought in authenticators it was pretty rare for people to get hacked. Even before that, you usually had to do something stupid to get your account hacked.

The most common culprits for it were from re-using passwords (especially on WoW fansites, because duh...) and people buying gold. Then there was the usual keyloggers and so on.

Hacked, and hacked for a long time.

[Anonymous Coward]

I've suspected that the battle.net network has been compromised for a long time. I've known way too many people that have had their account compromised for no discernible reason. No, not Trojan or key logged or phished or anything stupid like that. Just straight up compromised. Often, it's someone who's not touched a blizzard game in months or years.. And then out of the blue they get random emails from blizzard indicating some sort of acct activity has occurred, or they've been banned for something.

I wager there's a hole somewhere in the network that allows bad parties to get a hold of enough details to compromise certain accounts. .. Actually, I bet it's an inside job. Given the lucrative nature of blizzard accounts (Well, maybe not so recently but at one time hacking for wow gold was considered way more profitable than outright CC fraud) I would not be surprised if someone was taking money in exchange for account DB dumps.

Re:Hacked, and hacked for a long time.

[RogueyWon]

Well, it might be an "inside job", but not in the way you're thinking.

There was a issue with MS Xbox Live accounts being compromised recently. I was one of the ones affected by this and, until I learned more about it, I was utterly puzzled as to how it had happened.

See, prior to the Sony breach, I had been guilty of a bit of password sharing between accounts. After the Sony breach, I get more sensibly paranoid and, other than random don't-really-care forum accounts, everything gets its own password. As part of this, I change my Xbox Live password. I go for something reasonably strong - 10 characters, mix of lower case, upper case and numerals (spending your teenaged years learning Latin and ancient Greek is great for your memory). This password is only ever entered into my (stock, unmodified) 360. I'm pretty sure my PC is free of keyloggers - but even if it isn't, this particular sequence of characters has never been typed into a PC.

A few months later, I find I'm locked out of my Xbox Live account. The password and e-mail address have been changed (the e-mail address is now some German one) and around 50GBP has been spent on MS points, of which around a quarter have been spent on FIFA DLC. Fortunately, I notice within a few hours of this happening. Half an hour later, I've spoken to MS, who have locked the account and to my bank, who have refunded the credit card transaction.

The account then spends about 3 weeks locked while MS perform an investigation. At the end of this period, I get profuse apologies from them, a free 2 month extension to my gold subscription and my account back. This takes me by surprise - I'd previously thought that, except in cases of Sony-style security breaches, almost all compromised accounts were down to the behaviour of the user. Despite the circumstances of my case, I'd been torturing myself trying to think of all the ways I might have slipped up (god knows how many rootkit scanners I ran on my PC). I'd certainly not expected MS to be bending over backwards to make amends.

Anyway, Eurogamer picks up on stories from people who've had similar cases and investigates. A few months later, we quietly get our explanation. The security breach is at MS's end, but isn't in their software - it's in the protocols that their phone support guys use. Basically, it was possible to use social engineering techniques against MS's own support staff to get them to do password resets and e-mail address changes on an account, without actually knowing anything more than the name of the account. I gather the issue has since been "rectified", but it's still alarming.

Apparently my account had raised many of the flags that makes it desirable to the scumbags who do this. It's an old account (created on the day that the Xbox Live service for the original Xbox was launched in the UK), so it's a bit like having a low UID account on slashdot. It has a reasonably high gamerscore (though not exceptional). Perhaps more importantly, a few days before my account was taken, I'd got my first 1000/1000 gamerscore on a game (and not on one of the titles that are known to be quick and easy to do it for). This apparently meant that my account was desirable not only for the ability to spend on my credit card (FIFA DLC can apparently be traded for real-life cash, and hence is a way to re-monetise XBL currency), but would also have had a high resale value.

Re:Hacked, and hacked for a long time.

[Krojack]

No, not Trojan or key logged or phished or anything stupid like that.

Sorry but every time I see someone say that I laugh. It's like they think their computers are impervious or perfect and there is no way in hell they can be at fault. It's ALWAYS the other guy!

Back in the WoW BC days I was hacked. I thought I was pretty good with security. Come to find out I visited some website blog that was exploited with an iframe/XSS logger. That's how my password was logged. You don't have to have something installed on your computer to get keylogged.

Re:This is not news

[Macgrrl]

I got hacked back in Vanilla when I was running on a Windows machine. It was a result of a key logger I picked up from the Curse addons site after they were compromised. Since moving back to a Mac for my primary WoW machine I haven't been compromised since. I also avoid using Curse as my primary source of Mods, preferring WoW Interface.

Ironic. . .

[Limburgher]

I seem to recall reading in the Security Question comments how Battle.net's system was excellent. That portion of it may have been, and they seem to be responding well to this, but the timing is interesting.

Re:Ironic. . .

[mapsjanhere]

If anyone gets an email for the hackers - I forgot my battlenet account info years ago, maybe they can send it to me?

Re:This is not news

[Sir_Sri]

That's actually pretty common when people do get hacked. If you have gold they immediately mail it off and sell it, and then try and bot farm whatever the best gold/hour is. That might be tradeskilling, that might be cash runs through bosses, sort of depended.

My lingering suspicions is that WoW was vulnerable to a session spoof attack at some point, or the usual exploit of a flash vulnerability to get your password, but their systems became overall pretty robust with authenticators added in.

In your case I'd guess a flash vulnerability, possibly a 0 day one, those are much less of a problem today than they were 2 or 3 years ago when browsers weren't well sandboxed etc. etc. But those sorts of things always got a few people.

Asherah poles

[Maluminati]

"Instead, you must break down their pagan altars, smash their sacred pillars, and cut down their Asherah poles." cut down / hack. Same thing. Good job, Mr Bond ;)

Re:Asherah poles

[Anonymous Coward]

https://mobile.twitter.com/AsherahResearch
prolly not

Re:This is not news

[Sir_Sri]

As I mentioned below, because i'd forgotten about them, when I typed this flash exploits as well (which of course had keyloggers of various sorts). Strategy videos and all that.

Secret questions are a weak auth mechanism

[hackertarget]

So were the passwords salted or only encrypted? Do we have yet more passwords in the wild?

The use of secret questions are a weak form of password retrieval. Finding someones home town or mothers maiden name is not exactly difficult.

Rainbow tables

[Coolhand2120]

Oh the passwords are cryptographically scrambled? Do they mean hashed or encrypted? I imagine anyone with enough skill to steal all of those accounts knows how to operate a rainbow table. Why not just come clean an tell everyone their passwords are compromised too. Why leave everyone with a nebulous message like "cryptographically scrambled". Are they encrypted? Or did you just hash+salt them? I for one would really like to know!

Re:Rainbow tables

[VortexCortex]

scrambled? Do they mean hashed or ... Or did you just hash+salt them? I for one would really like to know!

I think what's best is unsalted, over easy, and hash browns on the side.

Re:Rainbow tables

[Anonymous Coward]

Here’s what you need to know about rainbow tables: no modern password scheme is vulnerable to them.

Re:Rainbow tables

[Anonymous Coward]

What can you tell us about the scrambled passwords that were accessed?
Cryptographically scrambled versions of passwords for North American players were accessed, protected by Secure Remote Password (SRP) protocol. This information alone doesn't give unauthorized users the actual passwords -- each password would need to be deciphered individually. The added layer of protection from SRP makes that process computationally very difficult and expensive.

Re:Rainbow tables

[Anonymous Coward]

Oh the passwords are cryptographically scrambled? Do they mean hashed or encrypted? I imagine anyone with enough skill to steal all of those accounts knows how to operate a rainbow table. Why not just come clean an tell everyone their passwords are compromised too. Why leave everyone with a nebulous message like "cryptographically scrambled". Are they encrypted? Or did you just hash+salt them? I for one would really like to know!

Read the announcement if you "would really like to know" I guess (or maybe you actually just want to be a jackass)

http://sea.blizzard.com/en-sg/securityupdate.html
We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually. As a precaution, however, we recommend that players on North American servers change their password. Please click this link to change your password. Moreover, if you have used the same or similar passwords for other purposes, you may want to consider changing those passwords as well.

Re:Rainbow tables

[Anonymous Coward]

What do you mean "just hash+salt them"? If you cared to read the wiki page you linked to, you'd know that hashing them with a salt is how you're supposed to store passwords in a way that defeats rainbow tables.

"Encrypting" passwords is dumb because it's reversible - if the service knows how to encrypt passwords it gets from users it means that when the service is compromised the attacker will get easy access to all your passwords.

Hmmm

[Lando]

How does this affect my bnetd server? Oh, that's right Blizzard sued it out of existence and I haven't purchased a blizzard product since then. No worries then, doesn't effect me.

Who cares..

[SD-Arcadia]

Diablo 3 was DOA. It is a hamster-wheel farming game revolving around the auction house with no depth nor creativity.
Summary: It's fun but too easy going through normal, nightmare and hell if you gather a party. Then you hit the inferno act 2 brick wall, and your only hope for punching through that is either the RMAH or something like 100+ hrs into cheese-farming spots like dank cellar (gold) or the ancient path goblin (rares).
I found myself wishing someone else would "play" for a while because the game part peeled away and it was revealed to be a stupid repetitive virtual item farming-trading game. I bought the game mid-May, and haven't touched it past June and don't plan to either. Gonna keep it around for a couple more weeks and then give my login info to the first friend who shows interest when I go back to school for TA'ing in september.

Re:Who cares..

[Anonymous Coward]

Sell your account so blizzard doesnt get another sale. Fuck blizzard. Fuck ubisoft.

Re:Who cares..

[Anonymous Coward]

Yep, I stopped playing after trapping Belial. It just got so boring and repetitive. I didn't care much about the DRM or always on connection like some. The gameplay just didn't interest me anymore. Oh well.

Re:Who cares..

[Anonymous Coward]

Gonna keep it around for a couple more weeks and then give my login info to the first friend who shows interest when I go back to school for TA'ing in september.

Gave my credentials to a friend after beating the game. Blizzard locked me out of my account, claiming it may have been hacked. Oh, the irony.

Re:Who cares..

[Anonymous Coward]

The thing everybody seems to be missing is the rare feature offered by D3 - hardcore mode and hence consequences to your actions or ineptitude. Suddenly when permadeath is introduced the first 3 difficulties aren't a careless walk in the park. Suddenly you realize there's things in the game before Inferno. For example the 12 acts before that. Suddenly items you find (even gems and tomes) are worth something and just by playing you get a few million gold that you can then invest in some pretty good Inferno gear. Yes, you need the auction house. Or maybe not, because you can just trade with friends or form a "clan" like you used to have to do in D2. But unless you want the best-of-the-best gear (or you completely suck as a player) you don't ever need RMAH.

Re:Who cares..

[Anonymous Coward]

hamster-wheel farming game

This is a 1:1 description of Diablo 2 for anyone who played it longer than it took to kill Nightmare Act 4 (later 5).

Re:Who cares..

[Anonymous Coward]

Ditto and completely agree.

Using scrambling rather than cryptography

[tlambert]

Using scrambling rather than cryptography gets around cryptographic export and import restrictions. This is why it was possible to decypt a lot of Windows and Microsoft Word scrambled content, and why Windows NT password recovery tools existed.

Unless you want to lock yourself out of most Asian countries where videogaming comes close to a religion, and is therefore worth gobs of money, you will not build something which violates their import restrictions. See also:

http://en.wikipedia.org/wiki/Restrictions_on_the_import_of_cryptography#Status_by_country

Re:Customer service amateurs

[VortexCortex]

Last week my friend has his D3 account hacked, and they treated him as if it was his fault! What a bunch of assholes. Get your shit together Blizzard!

Their shit IS your shit, and being all together is actually the problem; Both in terms of security and bandwidth bottlenecks...

Re:So, looks like I'm cancelling that e-mail addre

[Anonymous Coward]

Only if Blizz takes down Battle.net for a month....

Been a while

[Xtifr]

Oh man, I think I created an account for Starcraft I. Do you suppose it's still active? I doubt I can remember what password I used all those years ago, or what email address I might have had at the time.

Re:Been a while

[HPXX]

Well, it seems to be the Battle.Net 2.0 data that has been leaked whilst you had an account on Battle.Net classic. If it was a long time ago I would assume you are safe. In the earlier days B.Net didn't even have email (until they introduced password recovery) and accounts were removed if inactive for a certain period of time (3 months iirc). Today Bnet classic accounts are not removed after this period of time. The accounts will however be open for re-registration if you have not logged in to your account during these 3 months someone else can register that account and your stored information would effectively be deleted. Unfortunately, I don't know when this introduced.

Defeating your own security 101

[fisted]

Store password hashes in the database, but the answer to a security question, which enables resetting the password, in plain text. Cool story Blizzard

Re:Defeating your own security 101

[Anonymous Coward]

Assuming they already have access to your email address. I love my authenticator.

Re:Defeating your own security 101

[Anonymous Coward]

Awesome. Now, to be secure, we just need to buy and add next to our car keys on our key chin an authentication FOB for the work office, our bank, our brokerage account, our power company, our pest control company, our cable company, our internet provider, amazon, overstock, and every other place you ever do business. Hey, I'm sure it wont' be a problem to have four hundred authentication fobs dangling from your pocket.

Re:Defeating your own security 101

[Anonymous Coward]

Very interesting. Do you also go out and buy a new calculator every time you need to perform the same calculation on a different set of numbers?

Re:Defeating your own security 101

[Kalriath]

Most companies use authenticators that can only be associated with one server. Blizzard's is one of these. A Blizzard Authentication is not compatible with anyone except Blizzard.

Generally, the only ones that work with multiple companies are the Verisign and RSA ones.

Re:This is not news

[SilverJets]

My account keeps being hacked*, despite the fact I don't login, have no real interest in playing the games, change it to random passwords even I don't remember, run linux day to day, and have it associated to a gmail account which hasn't had any suspicious activity. I've tried to reason with them, but they refuse to listen. I've come to the conlusion that Blizzard are incompetant in this area.

* I've never seen any proof of my account being hacked besides their e-mails telling me and locking my account. I managed to get them unlocked the first few times, my characters still has all items and gold I remember. Now they want me to fax a passport or some 'real identification'. I honestly don't want the games that bad, I'm just annoyed they're taking them off me.

If I had mod points I'd vote this up.

My battle.net / wow account was fine for years. Never had a problem. Then I installed StarCraft2 and its updates. A day later I get a legitimate e-mail from Blizzard telling me my account had been used to spam the chat channels on wow. Changed my password, and started using their iPhone authenticator app. Nothing from any of my characters was missing. Not a single thing.

When it comes to security I don't think Blizzard knows what it is doing.

Re:This is not news

[Cat_Herder_GoatRoper]

Authenticator! Oh yea it is free, if you have a smart phone.

So where is all the pure hatred?

[Anonymous Coward]

When sony got hacked everyone and I mean everyone could not spewing unadulterate bile and hatred at sony for getting hacked and it went on for a year where no one couldnt post something without acting like a immature, bratty, uninformed child. Dozens of companies were hacked and now blizzard is but no one is pissed off.

Re:So where is all the pure hatred?

[Anonymous Coward]

Sony was operating unpatched Linux servers with several year-old exploits along with clear-text passwords and SQL injection. Sony's server security was a cross between ineptitude and negligence.

Re:This is not news

[Anonymous Coward]

well, I have an authenticator and several maxxed toons, but I had the mobile auth beforehand. Figured it was a good idea and my WoW account has never been hacked, but my gmail certainly has.

Re:This is not news

[Anonymous Coward]

You could also try running a decent antivirus.

This is for real

[tangent3]

Real links here: http://us.blizzard.com/en-us/securityupdate.html
http://sea.battle.net/support/en/article/important-security-update-faq

The important thing to note is that the passwords were encrypted with Secure Remote Password protocol, meaning that Rainbow Tables are ineffective since each password is individually encrypted instead of using a common hash. Also, the process is CPU expensive so brute forcing is highly unfeasiable for reasonably length passwords.

Re:This is for real

[Anonymous Coward]

"reasonably length passwords" with salted hash is MUCH safer than encrypted. A CPU "expensive" hash doesn't matter for a good password. By good, I mean 10+char, upper, lower, number, and 2-3 different categories of "special" chars.

Re:This is for real

[Nos.]

That's all fine and dandy until you realize that Blizzard doesn't differentiate case in passwords. They either covert them all to upper or lower case, not sure which. The forums were alive with this recently. So, all of a sudden brute forcing isn't so tough, especially when they also only allow a reduced set of special characters.

Re:This is for real

[Anachragnome]

" Also, the process is CPU expensive so brute forcing is highly unfeasiable for reasonably length passwords."

Tell that to the 10 million Chinese willing to do it manually for $.18 an hour.

Re:This is for real

[Anonymous Coward]

Add to it, that B.net passwords must be between 8 and 16 characters. That entropy is dwindling fast...

Re:This is for real

[ildon]

Password length is far more important than number of possible characters in each position. Ignoring case in a password actually does not affect its cryptographic security in a meaningful way. Look it up.

Re:This is for real

[Nos.]

Lets look at the possible number of passwords (so we're talking about a brute force attempt on the hashed password).

Blizzard's setup is not case sensitive, and they disallow a significant number of special characters. Lets say they have 40 possible values for each. A good password setup should have around 75 (or more).

So lets see how many possible values there are for a 7 character password in each setup:
Blizzard 4.456764032636319e+34
Good: 1.6883055225799413e+64

That's quite a difference. Lets see how many characters it would take in a Blizzard password to get into the same ballpark. Turns out its 37 which gives: 1.9782022283855447e+64

So, I guess a restricted character set is okay, if you go with REALLY long passwords.

(I used the password calculator at http://www.csgnetwork.com/optionspossiblecalc.html with 4 for a minimum length to determine those numbers).

Fool me once...

[DJ Particle]

Before I got an auth'er, I once logged into the armory app on my iPhone over an insecure wireless. Yeah, stupid, I know. My account was compromised shortly after. A couple weeks later, I got it back, intact to the way it was before the hack.

Now, I have a password I don't use anywhere else, a mobile auth'er (that I changed the serial number on after I read about this breach), and I have it set to *always* require the auth'er to log in. Now that whatever mobile auth'er info they got regarding my account is useless, I should be relatively okay.

Re:Customer service amateurs

[webdog314]

Your "friend" is likely an idiot who has a key-logged, malware-ridden machine. 99.99% of the time, what someone calls "hacking" is nothing more than poor personal security on their own machine.

Re:So, looks like I'm cancelling that e-mail addre

[Anonymous Coward]

Cancelling your email, what? If it uses the same pass then change it, otherwise you don't even worry.

Re:Proof Linux is more insecure than Windows

[Anonymous Coward]

Hey... wow - at least it was just a list of linux hacks / exploits.

If it had been a list of windows hacks / exploits, it would have been at least a thousand times longer and slashdot would have run out of disk space and bandwidth to host it all!!!

Thanks for playing Shill!!

Stupid SHIT

[darkain]

There is a ton of stupid SHIT being posted here on the slashdot comments. I don't blame the commenters one bit, thought. Why? Because the article was a regurgitated rehashed pile of shit in comparison to the actual Blizzard press release... which was really hard to find, ya'know, being the top post on Blizzard.com after all... A very key detail, the usage of SRP, is completely missed by the article, which is leading to the majority of the confusion here and elsewhere.

http://us.blizzard.com/en-us/securityupdate.html

Re:Stupid SHIT

[Cimexus]

Welcome to Slashdot. :)

Re:Customer service amateurs

[powerspike]

Well it probably wasn't their Fault. A few accounts hackers have admitted to hacking fan sites and getting usernames and passwords from there, and trying them against battle.net, quite a few people use the same logon details.. and account hacked. Not Defending them what has happened (according to this article), But alot of people are blaming blizzard for hacked accounts that had nothing to do with Blizzard. They have really F'd up big time with D3, but account hacking issues up to now haven't been because of them.

Re:Proof Linux is more insecure than Windows

[Gaygirlie]

I know I am replying to a troll, though I am not actually expecting any kind of sane reply from him, I'm rather replying to his post so that other users would notice the obvious flaw here.

The thing is, if the hack does not actually use any of the OS-specific features to gain access to privileged data then the OS is wholly irrelevant. All the hacks and attacks mentioned by the troll have been because of faults on the Internet-facing software that runs on top of the OS and would've happened just the same if the software was running on *BSD, OSX or Windows. Operating systems simply cannot protect against stupid people or faulty software, that is merely a pipedream. As an example if there is a bug in your latest Windows-based MMORPG that lets attackers gain access to your data do you blame Windows or do you blame the MMORPG for the failure? I sure would opt for the latter. With that in mind the troll in question here is simply trying to associate bugs in 3rd-party software with the OS, shifting blame from one party to another.

heh

[niix]

Trading 40 SoJs!

Re:This is not news

[Zaelath]

My account had a max level character in every slot of my main server. Never got hacked.

Next theory.

Re:Proof Linux is more insecure than Windows

[Gaygirlie]

I don't think you've realized the magnitude of his insanity or trolling... the smoking crater from his last post here.

As I said, I don't expect any sane reply from him. In fact, I'm not expecting a reply at all. I merely wanted the...um, "less attentive" commenters not to fall prey to his obvious attempts, other than that I don't care who he is or what he has posted before.

Re:This is not news

[SydShamino]

I played from release day until last year. My account was never hacked.

I use noscript and, when I could get one, an authenticator. I also don't use the same email address for my battle.net authentication as I did for other WoW forums, so phishing was even easier to identify.

Re:This is not news

[TheLink]

Actually depending on what the hackers do, changing your password might actually make things worse[1]... Plus Blizzard don't seem to have figured out the details of the hack, so why waste time creating an uberstrong password if they could get hacked again?

BUT if you happen to use the same password in other sites/services, change it at those places.

[1] They might then get the plaintext of your password instead of the "scrambled" version.

stop whinging

[Anonymous Coward]

why does everyone cry about not having single player? seems like the stuck up little rich kids that daddy always bought them what they wanted, now they cant play single player so keep crysing. WELL BOO FUCKING HOO YOU LITTLE BITCHES harden up! it was designed like that for a reason and it was a good feature!

Re:So, looks like I'm cancelling that e-mail addre

[Anonymous Coward]

OP might be meaning something else, but I own my own email domain, and set up an address for basically anything, having it go to a catch-all. Over the years, my warhammer@, lotro@, sony@, and now bnet@ emails are being redirected to /dev/null, because they're all in (or going to be in) the hands of spammers galore.

Re:This is not news

[Billly Gates]

The flash exploit I believe. My ex had terrible securith with her gaming Vista laptop. I was more ignorant back then too with security issues as I have not worked in a pc shop yet and seen the machines coming in and the steps people took. I thought AV software was a waste too as I do not visit bad sites on this machines etc. I was quite stupid.

Nowdays I am so paranoid I tend to avoid firefox because it has no sandboxing, use flash that updates automatically, use Chrome which does it for me and has double sandboxing, am very serious with a good AV package and also run Malware bytes.

My kids run ancient java still probably on the old desktop out of my control to run minecraft and I shudder. I thought it was safe back then too in 2009/10. GOD. Windows 7 thankfully is much more secure as well as the steps I now take.

But still mac users back then were getting hacked and the ones who had access to the guild vault were always hacked. hmmm .... sorry something is up with that.

And the counter argument

[SmallFurryCreature]

How many paying customers see other people getting it for free and decide they also no longer want to pay?

Proof of this behavior? Walking through a red light, once one person does it, others follow.

Guarding against theft is not just to stop active thiefs, it is also a way to keep non-thieves from turning to thieving.

Proof with regards to copyright infringement?

Whenever a story runs in the main stream media on thepiratebay or napster or whatever, every geek gets asked by non-geeks how they can get in on the action.

Re:And the counter argument

[Anonymous Coward]

Proof of this behavior? Walking through a red light, once one person does it, others follow.

That's not proof, since you didn't prove that.

Guarding against theft is not just to stop active thiefs

Guarding against 'theft' at the expense of innocents (DRM) is simply immoral.

Proof with regards to copyright infringement?

Whenever a story runs in the main stream media on thepiratebay or napster or whatever, every geek gets asked by non-geeks how they can get in on the action.

That's not proof, since you didn't prove that.

Re:And the counter argument

[kiep]

bullshit- I always walk on red lights and no one is following me.

Re:And the counter argument

[Anonymous Coward]

http://thepiratebay.se/torrent/7522392/NEW_2012_Sony_Rootkit_Exploit

There. Get in on the action.

MOD PARENT FUNNY

[Anonymous Coward]

I loled

fuck blizzard! nothing else to say

What do you expect?

[SmallFurryCreature]

It is a console game first of all. Console games do not have depth or replay value, rather they have difficulty levels that are locked forcing replay.

And Diablo has ALWAYS been a repetitive dungeon crawler/hack&slash game. That is what it is. And the only way to increase difficulty without improving AI is to add more monsters with more hit points and more resists and this creates the brick wall then your "skill" level is reached.

My advice for Diablo? Play it once, just like other games. Then STOP.

There are people who play Final Fantasy games to max everything or speed run RPG's and for THOSE people there is Inferno. They don't "play" a game for story or novelty, they play to get REALLY good at doing the exact same thing over and over again. If by some miracle of scripting a game company made every boss unique on every play through, these people would be REALLY upset. It stops them from using skillX at 3904872 HP followed by Y and Z in 2.322334 seconds.

Basically, the above poster is complaining that a porn movie gets a bit repetitive after the 100th play through. DUH!

Re:What do you expect?

[RogueyWon]

You know it's not a console game, right?

Right?

Blizzard have mulled over the possibility of a console release from time to time, but there's nothing announced. The game's not that different from its predecessors - as you yourself note.

In fact, the Diablo series is historically a PC/Mac series. There was a Playstation 1 version of the original, but it never got much traction. This series is as computery as a very computery thing that was just made even more computery by the injection of a big pile of computer.

I think you're using "console" as a shorthand for "shallow and repetitive". Well, I can certainly agree that Diablo games are shallow and repetitive. Absolutely. Definitely. With cherries on.

But then, I look at some of the console games I own and I don't necessarily see much in the way of shallowness or repetition in some of those. Valkyria Chronicles (PS3 exclusive) is absolutely brimming with depth and complexity, packaged beneath a highly accessible exterior. Dark Souls (360 and PS3, belated PC version due later this month) is more action oriented, but has one of the deepest and most precise combat systems I've come across. The Forza Motorsport (360 exclusive) games have depth coming out of their ears.

By all means criticise the Diablo series for its core gameplay - god knows it deserves a bit of a grilling as a counter-point to the fawning it got from some review sites. But if you're claiming it's a console game, you look ridiculous and if you're claiming that all console games are shallow, you look ignorant to boot.

Re:What do you expect?

[Krojack]

You know it's not a console game, right?

Yet the game could be a console game. Blizzard has also been tossing around the idea of releasing a console version. They are looking for a Game Systems Designer (Console) Diablo III. It's clearly no proof but still something they are considering.

Re:What do you expect?

[RogueyWon]

Well yes, but Creative Assembly have "considered" the idea of a console version of the Total War games before. And I challenge you to find a more definitively "PC" series than that.

How long did it take them to figure this out?

[Anonymous Coward]

I've been getting targeted phishing emails for years now at my Battle.net's email account. Although I can see that WoW and Diablo had enough users that simply emailing people at random could be enough, I strongly suspect Blizzard has been compromised for a lot longer than they let on. At least my Authenticator still works.

not just the application that gets hacked

[dutchwhizzman]

With most hacks, the application gets hacked and the attacker gets access to whatever users privileges the application is running as. That user usually is an administrator when you're on windows, or it has access to local exploits that target administrator or system accounts. On linux, chances that someone gets root after compromising an application are smaller, or require more manual work at least. That makes the OS safer, but as you said, the chance to get hacked is just as big. Mind you, the OS is safer against automated attacks and script kiddies. Someone that really wants to get in and knows what they are doing, often can still find a privilege escalation.

Re:$10,000 CHALLENGE to Alexander Peter Kowalski

[Anonymous Coward]

You challenge has been answered, possibly here http://ask.slashdot.org/comments.pl?sid=3035653&cid=40926387 or maybe even over here http://science.slashdot.org/comments.pl?sid=3024445&cid=40867985. Some assembly may be required. No individual post is guaranteed to satisfy your desires, your mileage may vary.

Found it funny

[Alarash]

I went to Battle.net to change my account password. I use KeyPassX to generate reasonably safe password. I can remember each generated password but that is fine, I usually copy/paste them. Oddly enough, Battle.net doesn't allow you to copy/paste passwords when you change them (not in the old password input, nor the new one).

Re:This is not news

[Anonymous Coward]

Hacking WoW accounts is Prime Directive #4 of stuxnet.

Conspirancy

[Anonymous Coward]

Not really related to this article but... I'm inclined to believe that Blizzard on purpose tags some accounts as compromised to promote the one-time password authenticators...

I'm pretty sure that my computer is free of malwares since if it wasn't, my wow account would be the least of my problems. It happens that once, and only once, I was going to log in my account and it had been blocked. Of course they blamed on the existence of malware on my computer to what I just nodded my head and said 'ya,ya just give me access again kthxbai'.

I'm pretty sure they should have some protections against brute-forcing a password, but that was pretty much the only way they could have figured my account's password. To make sure, I generated an even longer random password and haven't been hacked on my WoW account ever since. Weird?

If I had a malware, I should have been by now... no?

I mean malwares don't magically disappear, do they?

Then you don't have time to play Warcraft 1

[Anonymous Coward]

Because, you know, that game takes longer than 5-20 minutes to play. Heck, it takes more than a few hours to play.

Alternatively, you can not bother playing Warcraft 1, not ask how to play Warcraft 1 and shut the fuck up when someone answers what they THOUGHT was a genuine question.

Because people have jobs and they don't want to spend their time helping assholes like you.

Re:Then you don't have time to play Warcraft 1

[the_Bionic_lemming]

So, it's not 10 to 15 minutes, but rather I should devote hours to setting it up?

Gee, that sorta makes the first anon coward post in the thread look - totally idiotic then.

So how are they infomring customers?

[Shivetya]

Especially those of us who have taken a break from Blizzard games?

No one I no of nor I have received any notification about this breech. It is not like they don't have my email address.

As for the part about credit card information, I can believe them for one reason. A while back we had an account deleted per our request because we wanted no CC information stored with any game company. Well we had to have the account deleted and you do that through an email to the Blizzard privacy group.

Guess what, they delete the account and all related information EXCEPT for the credit card. How did we know? Because we got billed on it six months later by Blizzard.

Re:Customer service amateurs

[RogueyWon]

This used to be true, but an increasingly popular means of compromising accounts involves using social engineering techniques not on the end user, but on the host company's support staff. Look around a bit and you'll find some shocking examples of how easily certain companies *cough* MS Xbox Live *cough* have been giving their support staff protocols which make it trivial for scumbags to compromise individual accounts via phone-call while knowing nothing more than a username.

But I agree that "hacking" is the wrong word in 99% of cases. If an account's compromised through a Sony style breach, that's "hacking". In other cases, it's best to use a different term.

Re:So, looks like I'm cancelling that e-mail addre

[BenJury]

Frankly its about time the credit card companies \ bank sorted themselves out. What we need is a number that can be given out but links to one merchant only. So if these numbers are retrieved by a third party damage is limited as they can only be used on the original site, and it would be trivial to revoke them when the intrusion was discovered. Unlike right now as when you discover someone might have your cc information, you have to cancel the card, wait for the new one to be issued and re-enter the new information into all the other sites.

The same goes for bank details. When we need to transfer cash electronically from one person to another, why not give us 'deposit only' details to give out?

I know the banking sector moves at a snails pace on things like this, but seriously, how hard can it be?

Re:This is not news

[Anonymous Coward]

I hade the same problems, it turned out that when you login from different locations this mechanism will be triggered...it has nothing to do with your account really being hacked. The only way to stop it is by using an Authenticator for the battle.net account...changing the security question is not possible (at least not according to the Blizzard hotline). I never saved my answer and had a long argument on the Blizzard hotline, which resulted in them sending me the random answer I had given when I opened my account a couple of years ago.

So:

- security questions answer is saved in plain text
- you cannot change it
- you have to use it to be able to login to play your games (or use an Authenticator -- which either costs money or you need to use your phone)

On a side note...why does anyone still rely on security questions? They have proven to be insecure by design time and time again.

Great, Blizzard, to receive this thru 3rd party!

[freaker_TuC]

As a long-term Blizzard customer, I am outraged; to have this news delivered through third party.

No notification came from Blizzard thru e-mail. Cool way to support your customers..

Europe impacted?

[Anonymous Coward]

"For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed."

What about European servers?

Linux trolls caught lying and impersonating apk

[Anonymous Coward]

They've sunk to new lows and are sinking their own ship http://science.slashdot.org/comments.pl?sid=3024445&cid=40887471

What justifies the -1 TROLL rating?

[Anonymous Coward]

Post facts Penguins can't take that makes them look stupid and they react like the bitches they are with unjustified bad down moderations.

Back to moderating yourself up again?

[Anonymous Coward]

http://science.slashdot.org/comments.pl?sid=3024445&cid=40870249 .

* One of your own even says how it's done, & it's NO BIG TRICK to do the following here on /. to cheat the moderation system (I caught tomhudson = Barbara, not Barbie admitting to it (they're the same person)):

---

1.) Downmoderate using one of many sockpuppet alternate registered 'luser' accounts with mod points collected up (easily done by "pandering" to group think & modding one's Self (or should I say, SELVES, lol) up.

2.) Logout to preserve the cookie state & karma of said multiple sockpuppet accounts

3.) Troll, harass, & stalk (usually off topic with ad hominem attacks that are illogical in & of themselves) by ac posts

4.) Login to other sockpuppet alternative 'luser' accounts with mod points collected up, then upmoderate your own posts.

---

* The link above has "one of your own" illustrating how & why it's done... nuff said, & I didn't even do the saying of it!

APK

P.S.=> You fail, and you must LOVE punishment... especially self-inflicted ones, having to go off topic & worse afterwards (like unjust downmods) - hey, you only did it to yourself... ... apk

Re:Proof Linux is more insecure than Windows

[Gaygirlie]

I don't think you've realized the magnitude of his insanity or trolling...

I got several replies from him -- none of them actually trying to debunk what I said and most of them trying to argue that because he has gotten modded up before he must therefore be right -- and I see what you meant! :)

Re:This is not news

[Anonymous Coward]

You and me both. I didn't even bother getting an authenticator till blizzard so how much gold I had and mailed me one for free.

They can use it to get into other accounts

[Anonymous Coward]

Forget the password. Are the email addresses and security questions encrypted?

Because with your email, security question and real-life address (assuming you entered real information), they can probably get into your email account (they say they forgot the password, and hey, they know the answer to the security question, so they must be legit), and have a good chance of getting into other accounts like Amazon and Ebay, since most people use the same email address/security question for everything.

Most slashdotters probably know how to protect themselves from this, but I'm sure most bnet users don't even bother.

Re:This is not news

[Sqweegee]

How do you know your account is getting "hacked"? E-mail notification?

Checking my spam folder I've found that my account gets hacked every couple of days and there's a easy link to verify my identity and login credentials... It seems you don't even need an account to get hacked!

Change your secret question and answers

[kenp2002]

"...the answer to a personal security question, and information relating to Mobile and Dial-In Authenticators..."

Bluntly now they have an email and an sample of your secret question. Given a question of "What is your Mother's Maiden Name" then script kiddies now have your email address and one of your potential secret question responses. WTF wouldn't you hash the answers....

They now have an email address, your phone number, a secret answer response. Christ all might Activision.... way to fuck up. Now ever script kiddie with that data dump is going to spam every major site with those email address and now with at least one potential secret question response... just wow...

Re:So, looks like I'm cancelling that e-mail addre

[Shompol]

And then you have buddy@ and significan_other@, and then it's your birthday and both buddy@ and significan_other@ send you a FREE postcard, and suddenly all your accounts are flooded with spam.... I guess you have all your emails redirected to /dev/null by now.

Re:This is not news

[Krojack]

If you have an android phone get the Google Authenticator also. It's that added wall that makes you feel a little more at ease.

Re:i hate blizzard

[Anonymous Coward]

Clearly because you can't read. If you could read then you would have noticed that D3 is in fact a multiplayer ONLINE game with an option to not play with other people.

Re:Customer service amateurs

[Krojack]

The chance it was in fact your friends fault is still very high. Blizzard hasn't given a date span as to how long ago this occurred so you can't say your friend is a perfect little saint just yet.

And the deluge of Emails have begun!

[Anonymous Coward]

And now...my email is full of suspicious "Blizzard Entertainmen" emails demanding that I verify my information via their 'link' or my account will be banned...FOREVER! I think the Phishing emails are the worse and now it just got worse.

Re:Customer service amateurs

[Anonymous Coward]

Posting this under an article about Battle.net being compromised borders on idiocy. Insightful idiocy nonetheless, which speaks volumes about this site's moderation.

Which Battle.net

[Anonymous Coward]

Can anyone get a clear picture on what has actually been hacked?

Is it the Battle.net website (and fora)?
Is it the old Battle.net (WarIII and earlier)? Which realms?
Is it the newfangled Battle.net for Wow, SC2 and D3? (Does that have realms?)

Re:So, looks like I'm cancelling that e-mail addre

[Anguirel]

What we need is a number that can be given out but links to one merchant only. So if these numbers are retrieved by a third party damage is limited as they can only be used on the original site, and it would be trivial to revoke them when the intrusion was discovered.

I know everyone hates on Bank of America, but they have exactly that. It's the main reason I didn't cancel my account there (during all of the other recent issues they've had) - the ShopSafe system they have for their CCs is pretty amazing. You generate a new CC# for online purchases. Once it has been used once, it's linked to that merchant, and will fail if any other merchant attempts to use it (which can be a bit of a hassle on occasion -- Amazon is not the same as Amazon Kindle is not the same as Amazon Marketplace, even if all of those are in a single account system from my perspective -- also fails if the merchant ever randomly changes their listed name or accounts on their end).

I won't defend anything else they may or may not do, since I barely touch most of their services, but as a basic direct-deposit-account-and-credit-card service they've been pretty good for me and the ShopSafe option is pretty cool (and likely patented or something which would explain no other institution managing to do it).

Re:So, looks like I'm cancelling that e-mail addre

[BenJury]

Sounds about right! So it can be used for subscriptions, etc? Are listening First Direct?!

Re:Proof Linux is more insecure than Windows

[Anonymous Coward]

APK shuts the trolls up with facts. Works every time.

Re:This is not news

[Kalriath]

Uberstrong password? You CAN'T set an uberstrong password! Case insensitive, alphanumeric only, 16 characters max. It's like requiring that a bank vault be secured with a sturdy rope.

Re:Great, Blizzard, to receive this thru 3rd party

[Anonymous Coward]

I did get an email about it. But the spam filtering couldn't distinguish between a legitimate email from blizzard and those other emails about either the fact that I have been selling my account, a free invite to the beta of the next expansion pack, or another phishing email that my account was hacked...

Re:So, looks like I'm cancelling that e-mail addre

[Anguirel]

Yes, it can be used for subscriptions (up to a year at a time - you choose how long a given number is valid, between 2 and 12 months). It also has a capped amount of cash associated with it (that you set when creating a new number), so even if the site you're buying from isn't on the level, you'd still only be at risk of losing whatever amount you expected to be paying (until fraud protections kick in), rather than suddenly having your card unusable until you can get the charges reversed.

I for one want to congratulate blizzard

[Anonymous Coward]

for again displaying just how little concern they have for customer security. security question answers should be... salted... hashed... DUH.
way to go blizzard, you guys are truly a bunch of f*cktards.