Blizzard Says Battle.Net Has Been Hacked

An anonymous reader writes "Blizzard announced today that its Battle.net service was compromised. The company is urging users to change their login information immediately. Blizzard is stressing that payment information was not compromised. 'The unauthorized access included email addresses associated with Battle.net accounts in all regions, outside of China. Additional information from accounts associated with the North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) was also accessed, including cryptographically scrambled versions of passwords (not actual passwords), the answer to a personal security question, and information relating to Mobile and Dial-In Authenticators. It's important to note that at this time, Blizzard does not believe this information alone is enough to gain access to Battle.net accounts.'"

Comments

Thanks!

[Anonymous Coward]

Thanks for your always-online requirement for Diablo 3! So very useful if I want to play alone.

Re:Thanks!

[Sir_Sri]

Diablo 3 is a multiplayer game with a where you can choose to not directly interact with other players, but without the auction house the whole itemization would need to be completely different.

That was one of the things they realized with D2, the reason it stuck around was the multiplayer, they just got the idea that the whole thing should be multiplayer. starcraft has less of an excuse because there's no meta economy in starcraft.

Re:Thanks!

[ganjadude]

really??? thats your argument? From my point of view as a D player since D1, STILL play d2, and gave up on d3, i am sick of the people who claim that "d3 is a multiplayer game" maybe by marketing, but not by gameplay. it is NO DIFFERENT than d2, in gameplay that it should require me to check in with them if i want to play by myself. and on top of that, they wouldnt even work with me on a refund, when I had issues 3 weeks after launch because I pre ordered it, and therefore it was more than 30 days out of date, eventhough i only had the game for aweek less than 30 days.

Re:Thanks!

[Sir_Sri]

It's not an argument. It is. The game is a multiplayer game. Just because that's a stupid idea doesn't mean it isn't the one they went with.

I'm sorry that your point of view is just wrong. But it is. The whole game was balanced around you being able to buy and sell from the auction house. That was a deliberate choice on blizzards part, and without the AH the game becomes prohibitively hard because you just can't get the right itemized gear and you need an astronomical amount of farming to get through the content. Again, I'm not saying that's a *good* design, but that is the design. If anything the game suffers because you almost never loot anything you actually want, I think I looted one inferno difficulty item I actually used, all of the rest I had to buy.

They certainly could have designed the itemization differently or had a full on single player mode with different itemization. But they didn't.

The 'core activity' of diablo is 'click'. I'll grant you that activity is mostly unchanged form previous versions. But most games are more than just one core activity.

they wouldnt even work with me on a refund, when I had issues 3 weeks after launch because I pre ordered it, and therefore it was more than 30 days out of date, eventhough i only had the game for aweek less than 30 days.

yes well, that's a whole other topic. But once they have your money they don't want to give it back.

Re:Thanks!

[h0dg3s]

That was one of the things they realized with D2, the reason it stuck around was the multiplayer, they just got the idea that the whole thing should be multiplayer. starcraft has less of an excuse because there's no meta economy in starcraft.

And then they gimped the multiplayer to 4 player instead of 8 and made the game entirely too linear. I stopped playing after 2-3 weeks. I doubt they care though, they already suckered me out of my money.

Re:Thanks!

[ganjadude]

I understand your argument, I really do. however I dont understand any good reason to disable to single player mode from d2 (which the char was not able to play on battlenet, and therefore not able to access the "real money" market activision set up (in convinced this is an activision move, and not something blizzard would have done prior to being bought up) I simply disagree with the way the game was handled. Hell I pre ordered, pre downloaded, and still couldnt play for 2 days after it was "released" all because of server issues. If that the the route all games are going to go.. i guess I am not a gamer any longer. Thats just me, but I will not deal with that, Ill keep playing super mario world and D2 and be happy.

Re:Thanks!

[antifoidulus]

Otherwise, "scrambled" in reference to "encrypted"

Ironically you go on this rant about how "uneducated" the American public is while fucking up the basic details of what you claim to know so much about. The term "cryptographically scrambled" is much more accurate than saying "encrypted", because guess what, the passwords ARENT encrypted, they are hashed. "Scrambled" and "Hashed" in reference to passwords are sort of similar, though scrambled in reference to words usually implies some sort of random re-ordering of the letters, for example
password
becomes
wasspdor

In essence, if you are going to criticize the way someone tries to inform the public about a technical issue, please don't substitute "dumbed-down" for "wrong", because "dumbed-down" is always better than "wrong"

Re:Thanks!

[PPalmgren]

While true, it points to the major problem. The entire reason single player must be played "online" is because its a real money auction house. This single design decision drove all of the "features" that everyone detests. Their greed is the problem here.

Re:Thanks!

[Rewind]

I understand your argument, I really do. however I dont understand any good reason to disable to single player mode from d2 (which the char was not able to play on battlenet, and therefore not able to access the "real money" market activision set up (in convinced this is an activision move, and not something blizzard would have done prior to being bought up) I simply disagree with the way the game was handled. Hell I pre ordered, pre downloaded, and still couldnt play for 2 days after it was "released" all because of server issues. If that the the route all games are going to go.. i guess I am not a gamer any longer. Thats just me, but I will not deal with that, Ill keep playing super mario world and D2 and be happy.

I am not the other guy, but maybe I can clarify: It is an online game. That is a fact. You may not like that, you may not have played previous Diablo games online ever, but Diablo III is sever side. It is an online game. That is not an argument, it is a statement of fact.

You are free to not like that and not buy the game and mention how much you dislike the fact, but it is still fact, not an argument. I agreed with their decision here, but I hope they (like me) look at it in retrospec and say "yeah that didn't really work out as well as we had hoped". I mean I only ever really played D1 and D2 online and I was very happy about very realistic changes to drastically reduce cheating and hacking. I was also excited about the (much less realistic) idea that maybe gold & item spam would be reduced by the RMAH. That said, in the end it wasn't worth it and it didn't improve either enough to justify doing it again. Overall I got enough hours out of D3 that I can't really hate on it too hard, but it just wasn't that good of a game. An ok game if you will, and I agree that I hope they drop online in the future.

Basically, I agree with 99% of what you are saying, but its not just 'add on offline and lan'. The game was server side, that was the way they wanted to go.

Re:Thanks!

[Sir_Sri]

No, not just the real money auction house. The regular one too. The RM AH is so blizzard can get a cut of the real money changing hands.

Re:Thanks!

[amoeba1911]

you need an astronomical amount of farming to get through the content

... or you could play as the wizard and use the teleport skill at the same time as archon skill to enter god mode (complete invulnerability). It took them more than a month to fix this fairly major bug.

Re:Thanks!

[Sir_Sri]

The real money auction house is an example of a free to play concept, and players were exchanging real money through unofficial channels. That poses huge security problems (like the one's people are talking about with WoW), which translate to customer support problems, and blizzard figured they could get a cut.

Even without the real money though, the regular auction house is your entire region, and a main source of gear for high level balance. The ability to dupe items in D2 caused no end of balance grief and problems that arise from that, and having a consistent relatively locked down platform for their main community, which is the multiplayer community is important then.

Also, yes, piracy has ravaged the PC game business (including the companies I contract with) and so everyone who can afford the infrastructure is moving to online setups.

You also have to keep in mind that from Blizzards perspective their main product is WoW, and everything else is an offshoot from that. They want WoW players to still be connected to other WoW players who happen to be in Starcraft or Diablo, and things like that. They're aiming for a total connected product line (sort of the way steam, XBL and PSN let you chat with your friends outside of the game you're playing), so your achievements in WoW carry over to diablo and the reverse, your friends are in both and so on. Again, not really sure that plan is working too well, but I can certainly see what they're trying to do. Blizzard isn't really the right outfit to pull that off though, mostly because it's the wrong level.

Re:Thanks!

[Sir_Sri]

And to not have to balance two different games. As a purely single player experience D3 is like 8 hours, or 8000 if you want to farm stuff. With multiplayer it's a good 50-200 hours, and then significantly diminishing returns after that.

Re:Thanks!

[PopeRatzo]

I am not the other guy, but maybe I can clarify: It is an online game. That is a fact.

Let me clarify further: Diablo 3 is an extremely shitty game that not only is overpriced by about 3x, but then seeks to monetize even further with it's online crapola.

As a free2play online game, Diablo 3 would be excusable. As the anchor in a very popular trilogy of AAA titles, it's inexcusable.

Further, to heal FAIL on top of FAIL, the information that you had to give them to create an online account with Blizzard in order to play this mediocre free2play crap is now in the hands of some Bulgarian sleazebags who will do their best to monetize Diablo 3.

Blizzard couldn't have mistreated Diablo fans much worse without infecting every one of them with Ebola virus and then smacked them in the face with a meat tenderizer.

Naturally, Blizzard bears zero liability for any damage that might be caused by their inability to keep customer records secure because everyone who played the game had to sign away all of their rights in the endless EULAs that they had to agree to on installation and with every single update.

Let me end this rant with a brief prayer: Jesus, Lord Baby Jesus, I beseech you. Please make the prostates of every one of the Blizzard upper management, board of directors and major shareholders swell up to the size of honeydew melons so that it takes them 15 minutes just to squeeze out a painful, burning drop of urine. And let them know, Father, that this pain is directly caused by their behavior with Diablo 3 (which, if it makes any difference to you, Baby Jesus, has satanic overtones). And I further pray, Lord, that you make an example of them so horrible as to cause sweaty, trembling nightmares for the upper management of every game developer and publisher, so that their nights may be beset with horrors so that they might look into their souls in order to change their ways and stop fucking over their customers. I pray this in the name of God (may Allah protect him), Amen. PS: please let the Bears win their home opener by 14 points or more..

Re:Thanks!

[Sir_Sri]

There are lots of single player games that are a special case of multiplayer (where for example you still connect to a server, albeit a local one) with special rules, lots of FPS single player campaigns are like that, and there are single player games that have no support for multiplayer at all.

Diablo isn't either of those. Because of the auction house and achievements connection the game depends on connecting you to a server to facilitate those things. Now I grant you that those things didn't need to be part of the game (obviously) but blizzard deliberately made them critical to the whole experience, especially the auction house. For D3 playing the game without other players directly you're still playing multiplayer, the drops are still as though you are going to sell on the auction house and buy from the auction house, and because at any point you could take your character multiplayer (which is actually a feature) they have to treat your character as a multiplayer character all the time. In this case 'single player' isn't a special ruleset case of multiplayer, it's just multiplayer before anyone else joined.

Re:Thanks!

[Sir_Sri]

they already suckered me out of my money

hence the real money auction house. That you've quit playing reduces the value of the real money auction house (even if you never use it it's connected to the regular auction house as part of the broader economy).

If you read anything they've been saying it's pretty clear they fucked up, badly. And they realize it. They aren't sure what to do about it, but they definitely aren't happy with how much people are (or aren't) playing the game, because that's their revenue model. Think of it like a free to play MMO, even if you never give them any money, you're there so that someone else has a good time and does give them money, and without you playing they are in trouble.

I think blizzard was very much counting on this new fully multiplayered up diablo as a cash cow they could milk alongside Mists of Pokemon and Starcraft 2: why sell one game when we can sell three?.

Re:Thanks!

[Sir_Sri]

I've discussed in previous posts our piracy rate and dropoff in sales with the proliferation of bit torrent.

Steam has pushed back the other direction, but well, it's an online service, and you pay them 30% for the privilege of using their infrastructure rather than your own.

For us, because we only use steam for retail sales and not authentication or matchmaking well... guess what, even now a year after release 50% of the copies in active use right now are using 1 CD key (with only 4000 concurrent users that's a small sample, and well, time zones and so on), and none of those pirated copies are steam users. I'm not 100% sure how anyone else does it, but I know we give steam a list of keys and only those keys authenticate blah blah blah so their service it's just those. But gamersgate, impulse etc. not so much. And in this case the key in question was part of a broad allotment to the publisher.

Now I wouldn't equate 1 pirated copy to one lost sale, I think, given the previous sales figures (for previous games in the series and so on) I think about 20% of total players (40% of pirates since we're at 50/50 right now) equate to lost sales given our estimates, and some of the pirates are in china and can't buy our game anyway, so it's not all lost sales. But there's certainly a lot of hurt from it.

Obviously you can't know exactly. There's no way to have a synthetic test knowing exactly how many copies would sell if it wasn't for piracy. But sales are way down, forum use and active play sessions are about flat, so guess what, people are pirating the game and not paying for it. Fortunately in the intervening period the government of ontario started kicking in a bunch of money (about 40% of peoples pay) or the guys I work with would be out of business.

Re:Thanks!

[Sir_Sri]

Unfortunately being invulnerable doesn't make drop rates better. Earns you lots of money from the AH though.

Re:Thanks!

[bennomatic]

Mmmmmm... ebola...

Re:Thanks!

[_KiTA_]

No, Blizzard realized there were still people selling runes 10 years after D2's release and thought: Christ, why aren't we getting a piece of that action?

Every decision after that became suspect. The drop rates, the difficulty levels, even the layouts of the maps. Everything can (and has been) designed to push people towards the RMT AH. They have a direct economic incentive to do so.

Re:Thanks!

[Holi]

To say the PC Game industry hasn't been damaged by piracy is disingenuous. The fact that far fewer games are produced, that fringe genres are not even developed anymore, and that we have had to deal with more draconian copy protection schemes are all a result of the ease of piracy on an open platform like a general purpose computer.

Re:Thanks!

[ganjadude]

Just for argument sake. Of those pirated copies, how many people may have never heard of the game if they couldnt play it for free? And of those, how many will buy the game in the future or a future release based on their experience? I am not saying it is right but I would wager at least a handful of people become fans of a company due to initial piracy. I am sure you have people to try and figure out those kinds of numbers better than my speculation (pulling numbers out of my ass)

Re:Thanks!

[Anonymous Coward]

It is an online game. That is a fact. You may not like that, you may not have played previous Diablo games online ever, but Diablo III is sever side. It is an online game. That is not an argument, it is a statement of fact.

And it is a really bad design choice, just like not adding LAN support to Starcraft II is. (IMO not having LAN support and marketing it as a game suitable for e-sports is borderline fraud, especially after we have seen that even Blizzard had disconnects in high profile matches in their own damn tournament. That game is NOT suitable for e-sports.)

Re:Thanks!

[gl4ss]

fringe genres not developed anymore? take a look at steam you foaming idiot.

further.. those fringe games are developed by guys who copied them in the '90s.

Re:Thanks!

[Anonymous Coward]

Sad day when rants full of ignorance, prejudice and personal opinion are marked 5, Insightful. See, Diablo 3 is just the evolution of Diablo 2. Much like Starcraft 2 is the evolution of the first part. Nothing revolutionary, they just took the old game, cleaned out some annoying things and made it more fun.
See, I can run Diablo 2 right now, more than 10 years after the release and I can play with friends on Battle.net. 10+ years of support, patches and servers. Is that not worth your $60 or is it something you expect from all the f2p bullshit games? A lot of people would much rather shell out for the game and play for free later than to put up with the pay-to-play (that's marketed f2p) - that to me most of those games aren't even worth the bandwidth they take to download.

Re:Thanks!

[gutnor]

Let me clarify further: Diablo 3 is an extremely shitty game that not only is overpriced by about 3x, but then seeks to monetize even further with it's online crapola.

Diablo 3 is almost the same as Diablo 2 pre-LoD with better graphics and a gameplay rebalanced toward more casual players than hardcore one:
- No need to spend 40+ hours to try a new build.
- An gold auction house (i.e. game money, not real $) to buy high level object without excessive grinding or spending hours in forum to find price, descriptions and reliable vendors.

Of course the guy still playing Diablo 2 today, Diablo 3 will feel dumbed down and "no elitist" enough. I played Diablo 2 as an obsessive gamer student. I appreciate that now that I work and have a family, Diablo 3 allows me (and my wife) to access high level of content without spending unreasonable amount of time. If the compromised is some pissed gold farmer and hardcore player - that's a good trade to me.

There are other cheaper great game out there like torchlight. But let's also be clear, most people complaining about the price of the game have spent 100+ hours on it. That makes it far cheaper than a lot of other activities.

It is reasonable to complain about the always-on connection - but really, in 2012, that is more a question of principle than a real constraint.

Re:Thanks!

[gutnor]

Every decision after that became suspect. The drop rates, the difficulty levels, even the layouts of the maps. Everything can (and has been) designed to push people towards the RMT AH. They have a direct economic incentive to do so.

And yet they took decision that undermine RM AH significantly. In the gold AH, the 10 auctions max, 38 hours minimum wait time, means that you need a lot of time to extract maximum value from your loot. That means that you can find lots of cheap ( = 50K gold and below) that are dumped on the AH all the time. Inflation on good objects (the ones you need to kill diablo in inferno) is quite limited - I spent less than 100K gold to be fully geared for inferno act 1 and 2, that is a quantity of gold that you get by playing normally through the game (didn't do any farming, never used the AH until Act 3 hell)

You only need the real money AH to buy the very very best objects in the game, but there is really no gameplay need. Blizzard could have done a lot more if they really wanted to drive people to the real money AH.

Re:Thanks!

[Anonymous Coward]

Jesus, Lord Baby Jesus, I beseech you. Please make the prostates of every one of the Blizzard upper management, board of directors and major shareholders swell up to the size of honeydew melons so that it takes them 15 minutes just to squeeze out a painful, burning drop of urine.

I'm afraid you're praying to the wrong God here. Jesus would tell you to forgive, and seek in you the strength to go to Blizzard and convince them to lose their bad ways, by being a loving example to them, as you'd like them to be to you.

Muhammad would tell you to behave, be a good moslem, and insist Blizzard upper management is bound for fiery inferno anyway so why care.

Buddha would tell you to care less for videogames, and maybe instead enjoy your next meal more (hmmm pork).

Nanak would just smack you over the head, and then pee in your general direction.

Eris would grant you your wish, turning Blizzard's management even more sour, then She would make you buy their next yet-shittier game nonetheless so you'd share some of the pain you sought to inflict, for the lulz.

Most other deities would require costly sacrifices and long imprecations upfront just to listen, mostly understanding your plea half wrong anyway. And their antagonist deities would curse you afterwards.

Re:Thanks!

[ifrag]

No, Blizzard realized there were still people selling runes 10 years after D2's release and thought: Christ, why aren't we getting a piece of that action?

This is demonstrably not precisely what they thought. Diablo 3 has no runes to sell, because that game mechanic was clearly not fun enough. IMO removal of runes and runewords for sockets was probably the stupidest itemization decision Blizzard made on the game.

So in general perhaps Blizzard wanted to make more money on the game, but by design it pretty much doesn't have an ideal setup for it.

Re:Thanks!

[Anonymous Coward]

People keep trying to say the "always online" aspect is a draconian form of DRM. It is not. Let me repeat, it is not. It has nothing to do with DRM. It's so they can control/protect the economy of a dedicated on-line game. That is the alpha and omega of it.

Re:Thanks!

[flirno]

Not day one but eventually someone had their way and the direction changed. They still have things embedded in the game that point to and even talk about a single player mode that is NOT online (a message pops up about exactly this from the tips generator once in a while).

They can do what they want with the game to generate cash and they did -- they went with the short term cash grab to fund something else apparently. Most of my friends that played D3 and enjoyed D3 are also now done with D3.

Re:Thanks!

[mcgrew]

Blizzard couldn't have mistreated Diablo fans much worse without infecting every one of them with Ebola virus and then smacked them in the face with a meat tenderizer.

Oh, I don't know... besides losing you private data, they could have installed malware that disabled all your P2P and disk burning software, and taken features out of the product you've already paid for and used.

Just because Sony treats it customers worse than Blizzard doesn't excuse Blizzard, and I gave up gaming ten years ago because the industry as a whole started acting like they could do without us and we couldn't do without them. I think the last game I bought was Quake III. Probably the last Blizzard game was D1 or D2 (I'd have to dig it out to see which one I have).

Re:Thanks!

[Luckyo]

It certainly is an online game in the same way that the first Assassin's Creed was. You have to be online to play because otherwise DRM will stop you from playing. But multiplayer elements are completely optional, as the core game is solo still player vs environment. I.e. single player game.

Re:Thanks!

[mcgrew]

I have to agree with you, the DRM they started using on games so they could fight piracy is one of the things that got me out of gaming. I used to spend rediculous amounts on new games, but I haven't bought a game in a decade or so. So yes, piracy hurts sales. Or rather, the fight against it does.

Re:Thanks!

[KingMotley]

Odd, I've never had a problem trying to play alone. And D3 is better because all my characters are online, and all the items floating around in games aren't hacked up versions.

Re:Thanks!

[TheRaven64]

Also, yes, piracy has ravaged the PC game business

Piracy has been rampant since the '80s (maybe earlier, but that's the earliest I remember). I only know people who stopped buying games, however, since publishers started pushing obnoxious DRM schemes. I bought two games between 2003 and 2010, and I regretted both. Since GOG.com started selling DRM-free games at a reasonable price (late 2010), I've bought 40. I decided I wouldn't give money to companies that were going to treat me like a criminal and give actual criminals a better experience. And no, I don't pirate, I just find other things to do with my time and money.

Re:Thanks!

[Remus Shepherd]

Diablo 3 is almost the same as Diablo 2 pre-LoD with better graphics and a gameplay rebalanced toward more casual players than hardcore one:

It's not a matter of 'easier' or 'more difficult', or even of 'casual' or 'hardcore'. D2 had great gameplay balance. D3's balance is shitty, in my humble opinion.

In normal difficulty D3 is super-easy, which does appeal to casual players. But in Hell difficulty and above it requires hardcore dedication, grinding, and the auction house in order to have a chance. So the appeal to casual players disappears quickly. The end game appeals only to hardcore players, or possibly to the very rich.

In contrast D2 was challenging for new players in normal difficulty and ramped up smoothly with the players' skill.

There are only two reasons to continue playing games like this -- the end game, or replayability. The end game for D3 is hardcore only. Because of the 'everyone can have all builds' design decision, D3 has zero replay value once you have tried all the classes. D3 was a complete design mistake, and its appeal is a pale shadow of the appeal of D2.

That said, it's a fine game to waste 40 hours with and then walk away. I don't think Blizzard wants players to do that, but it's the only reasonable way to play D3.

Re:Thanks!

[flirno]

Diablo 2 did not flourish because it was multiplayer. Diablo 2 flourished because it was multiplayer with enough rudimentary social tools to facilitate user communities (custom/private channels). Because of those it was possible to quickly form friendships and to communicate with friends in a one to many pathed channel. Diablo 3 does not have this. Diablo 3 only has the friend list and the only one to many pathed channel is in a 4 player game instance which is not nearly enough. If Diablo 3 had added guildhall/clanhall support it probably would have done better. If it had at least carried over the old bnet chat style private/custom chat channels (which are, incidently, available in World of Warcraft to a degree) it might have done better. As it is they misunderstood why Diablo 2 did as well as it did. It is the human social element that got nerfed in Diablo 3.

Re:Thanks!

[dywolf]

It is not a multiplayer game. Being to buy and sell frm the AH is no more needed now than trading was needed in Diablo 2. That is simply one means to an end, among several. Its a time sink game, more time spent gets you the rewards you want. No different now than then. And that doesn't require multiplayer or the AH to accomplish. It is not "balanced around the ah."

Re:Thanks!

[dywolf]

No, it has nothing to do with piracy.

It has everything to do with money: money to produce, bottom line, return on investment.

Niche games dont return as much money as general appeal games. therefore, they no longer get produced with the same level of funding as other games. you dont see many indie developers making games on the same level as the big studios (or just "because it would be fun" other than by a few devs). they used to all have similar production values. those days are gone, and its nothing to do with piracy. it is entirely because the industry itself is maturing and you can no longer create a King's Quest, or Warcraft, or Doom, in your closet or among a few close friends, and reap a big reward. The cost of getting a game to market is dramatically larger than before, and it only keeps getting higher. Same goes for production time, and number of people involved.

Re:Thanks!

[Sir_Sri]

That's essentially the hope with all of this is that a current pirate is a future buyer. It hasn't worked out that way for the last two releases though (but then it's not like can track specific churn, maybe we lose players, because they decide the series is bad, and pick up a new set of players who have lower standards).

You'd kind of think people playing a really niche game a year after release would translate into future customers if they can be, they like the game enough.

Though that goes to the next problem which is when they buy it on a steam sale for 5 bucks, meaning steam takes 30%, it's a 50/50 publisher split (which is pretty common for indie studios), so the publisher takes 35%, and that's 35% of 5 bucks left. So at a $1.75 per copy (less if it's part of a publisher bundle) you need to move an astronomical number of copies to make any money. I know stardock was thrilled they sold 100k of their latest title, which was a record for them, so putting numbers in perspective, for a 6 person team working 2 years taking 35% of the take means you need ~1.2 million dollars in revenue you need about 3.5 million dollars in sales to break even. When a record breaking title in a related genre moves 100k units you need charge about 35 bucks a unit. Stardock doesn't really have a publisher so they get 70% of the take straight up (but then they have higher costs too). If it wasn't for the government kicking in 40% we'd be in trouble, I'm not sure if Stardock gets any breaks like that.

Customers are only worth having if they pay for themselves so to speak, and for 1.75 a copy you're almost better off if they pirate it because your per unit costs for support, patches etc. can average out to more than that.

Re:Thanks!

[Sir_Sri]

Niche games dont return as much money as general appeal games. therefore, they no longer get produced with the same level of funding as other games

I understand what you're getting at, but this statement isn't quite correct. The premium games market has exploded in costs as you get professional voice talent, motion capture, tie in licences, high quality art and story telling etc. Those products can make a LOT of money an there are a lot of them. Indie titles cost about as much as they always have, the platform for under a million bucks has moved to mobile, but generally the product types are still there. But you are competing for player time against skyrim and wow and call of duty and battlefield etc.

It's a bit like movies. there are still cheap indie movies that aren't bad. But you can go to a new movie with 100 million dollar production costs every week. So why would you go to a movie with 100k production costs unless you know it's good (minecraft for example, which started out pretty indie)? Or put another way, you only have one friday night a week, given the choice between a movie that's 10 bucks and probably good, or a movie that is 10 bucks and of unknown quality which do you choose?

Which still goes back to piracy as a serious problem. Why pay for it at all when you can just pirate it? I've had personal friends tell me "I spend enough on games already" ya... you buy skyrim and call of duty and WoW etc. because those are much harder to pirate, to keep working, you don't want to risk your online account etc. But that doesn't help me in the slightest, less sales due to piracy of my game and I'm out of business.

As much as it's common to have piracy rates up in the 90% of active copies, those aren't all lost sales. But even a 10 or 15% drop in sales is the difference between being able to pay the bank back, and not, and having to lay staff off or change businesses. For the big producers they are skeptical of PC for a lot of reasons, piracy and support being the main ones, and that certainly hinders the platform a bit, but they have all moved to online accounts and distributions systems and online games that are not really online games precisely because that makes piracy much much much riskier for the pirate - or at least the pirate who cares about access to his entire steam account, his achievements, friends list etc.

Re:Thanks!

[Rakarra]

The whole game was balanced around you being able to buy and sell from the auction house.

Blizzard developers disagree with you. They have said, more than once, that the game is NOT tuned around the auction house, and that they played through in internal testing without the auction house.

Re:Thanks!

[Rakarra]

I am not the other guy, but maybe I can clarify: It is an online game. That is a fact. You may not like that, you may not have played previous Diablo games online ever, but Diablo III is sever side. It is an online game. That is not an argument, it is a statement of fact.

Diablo 3 is an online game for political reasons only. That is the objection. There's nothing about the game that requires you to play with other people. Does taking a single-player game and moving some game logic to a server make it an 'online game?' I suppose technically it does, but it's a shitty definition of online game.

Re:Thanks!

[_KiTA_]

Every decision after that became suspect. The drop rates, the difficulty levels, even the layouts of the maps. Everything can (and has been) designed to push people towards the RMT AH. They have a direct economic incentive to do so.

And yet they took decision that undermine RM AH significantly. In the gold AH, the 10 auctions max, 38 hours minimum wait time, means that you need a lot of time to extract maximum value from your loot. That means that you can find lots of cheap ( = 50K gold and below) that are dumped on the AH all the time. Inflation on good objects (the ones you need to kill diablo in inferno) is quite limited - I spent less than 100K gold to be fully geared for inferno act 1 and 2, that is a quantity of gold that you get by playing normally through the game (didn't do any farming, never used the AH until Act 3 hell)

You only need the real money AH to buy the very very best objects in the game, but there is really no gameplay need. Blizzard could have done a lot more if they really wanted to drive people to the real money AH.

Ah, but you're forgetting part two of Blizzard's nefarious plan:

Fill the Diablo 3 team with morons.

I have no idea how a company that has ran WOW alongside 3 WOW expansions could have forgotten to add a freaking Login Queue. And that's just the lowest of low hanging fruit. We're not talking about the story of Diablo 3 (Note to Blizzard: Go back to ripping off Games-Workshop, they have better writers than you), or the AH, or yeah, a billion different things that made that game a giant mess.

I guess my point is, them screwing up the execution does not preclude them having a really shitty "big idea" that they founded the rest of their design on.

Re:Thanks!

[PopeRatzo]

See, I can run Diablo 2 right now, more than 10 years after the release and I can play with friends on Battle.net. 10+ years of support, patches and servers. Is that not worth your $60 or is it something you expect from all the f2p bullshit games?

Let me get this straight: You're saying Diablo 3 is totally worth it because Diablo 2 was so good?

Re:Thanks!

[Rakarra]

The fact that far fewer games are produced

The problem is that the game industry has adopted Hollywood's business model -- games have to be bigger and bigger with enormous budgets now, and each has to trump all the competition. Unless you're developing for the mobile market, you just can't make a game with a 5-10 man team anymore. Now games have to have CG cut scenes, voice acting, orchestra soundtracks. Of course there are fewer games, and I don't think piracy is the cause. Piracy has always, always been an issue for the game developers.

Fewer games are developed now? If I'm looking for quality over quantity, then I'm not sure that's a bad thing.

Plus you're ignoring games that keep people around for years and have hundreds of hours of gameplay. For about five years after World of Warcraft came out, my game-buying amount dropped to... well, zero. I was spending $180/year on 'gaming,' but it wasn't buying new (or even used) games. That's the penalty for the subscription model, or even DLC.

Re:Thanks!

[gutnor]

You probably tried the game very early after it was released. Now the gold AH is literally filled with cheap stuff. Only the very best item is really expensive (i.e. several millions). My wife and I faced the same difficulties you were having in Hell. We spent something like 50K gold and 1 hour digging in the AH and we were good to go until Act 4. It costed a bit more to get inferno level gear, but currently the most expensive piece of kit I have is about 30K and it is going alright through Act 2. That is much that I would have expected remembering D2.

Re:Thanks!

[Krater76]

I'm afraid you're praying to the wrong God here. Jesus would tell you to forgive, and seek in you the strength to go to Blizzard and convince them to lose their bad ways, by being a loving example to them, as you'd like them to be to you.

Maybe he was thinking more of the Old Testament, fire and brimstone God. You know, the one who killed everyone with a flood, destroyed cities for being too 'unclean', wanted a guy to kill his own son to show his faith, or turned a woman to a pillar of salt just for looking at his work. OT God was a pretty big asshole.

Yes, the 'baby Jesus' remark makes an OT God reference a little difficult.

Yah

[the_Bionic_lemming]

Can I please have my single player offline games back?

Re:Yah

[DoofusOfDeath]

"No." -Activision

Re:Yah

[Teckla]

Can I please have my single player offline games back?

Speaking just for myself, I'm skipping both StarCraft 2 and Diablo 3, because of the onerous DRM and always-online requirements Blizzard now uses.

I wonder if the DRM and always-online requirements are preventing enough piracy that results in sales, to overcome the loss of buyers like me.

Re:Yah

[DoofusOfDeath]

My guess is that what they're losing in sales to people like you (and me), they're more than recouping in the buy-things-for-real-world-money shenanigans they've instituted.

Sucks, but I guess that's how the cookie crumbles.

Re:Yah

[Teckla]

Ah well, I'm still glad people like us are doing what we can, and voting with our wallets.

(Piracy is not an option in my house.)

Re:Yah

[the_Bionic_lemming]

I said no to star craft two and diablo 3 as well.

totally sucks as I really put a ton of hours in the previous versions.

I'm a bit nostalgic to play Warcraft 1, anyone know if that'll load and play on XP?

Re:Yah

[VortexCortex]

My guess is that what they're losing in sales to people like you (and me), they're more than recouping in the buy-things-for-real-world-money shenanigans they've instituted.

-- Or --
They blame the lost sales on piracy and use the figures to justify even more draconian nonsense.

Re:Yah

[Rewind]

Can I please have my single player offline games back?

Speaking just for myself, I'm skipping both StarCraft 2 and Diablo 3, because of the onerous DRM and always-online requirements Blizzard now uses.

I wonder if the DRM and always-online requirements are preventing enough piracy that results in sales, to overcome the loss of buyers like me.

You didn't miss anything with Diablo 3 really. It was ok, but nothing great. A step back for Blizzard if you ask me. With StarCraft 2 it was your own loss if you liked multiplayer. Also it had an offline mode that thanks to internet issues I got to make several uses of.

Re:Yah

[Rewind]

Best not to bother with trying to run it on XP. It, like most anything with a DOS version, tends to run under DOSbox better/easier than any other way.

Prepare to get super annoyed with the control scheme though. I really feel RTS controls were all rubbish until StarCraft 1, but stuff like Dune RTS and WC1... I honestly don't know how I played it. Then again I guess I didn't try to play it like I do now with RTS games were I like to try and pretend like I have great micro/macro.

Re:Yah

[DoofusOfDeath]

Ah well, I'm still glad people like us are doing what we can, and voting with our wallets.

(Piracy is not an option in my house.)

Honestly, I don't expect voting with my wallet to have any real impact. However, Torchlight 2 should provide roughly the kind of fund I'd been hoping for from D3. So even if Activision doesn't care that I go for T2 vs. D3, at least I can still have my fun.

Re:Yah

[LordLucless]

Are they doing the same thing they did when they said they broke the pre-order record? That is, counting all the copies of D3 they gave away to WoW subscribers who signed up to the Annual Pass as pre-orders. That's the only reason I have the game. I played it for maybe 2 weeks. Then it got old. I played D2 for years.

Re:Yah

[blahplusplus]

"I said no to star craft two and diablo 3 as well."

Not a loss, the original developers are long gone. D3 and SC2 are bland and the magic is long gone. They survive through sheer inertia and new bodies without a long history of gaming.

Re:Yah

[letherial]

Well i spent 60.00 before i realized it was always online, Accutuly, the only real reason why i bought the game was to find out the rest of the story; i wasnt awed like i was in diablo 2, but it was cool...azmodan was cool...diablo...not so much. I dont know what i would of done had i figured out that it was always online. Maybe i would of bought it, i bought GW2 and all its expansions; i am a pirate at heart though, so buying any game is a big deal.

However,

I did get my 60.00 back cause somone wanted to buy something from me for real money shenanigans, so i guess i sorta pirated it? not realy, but it was still free hooray!

Re:Yah

[kat_skan]

"Yes." -Runic

Re:Yah

[trawg]

Speaking just for myself, I'm skipping both StarCraft 2 and Diablo 3, because of the onerous DRM and always-online requirements Blizzard now uses.

Just to provide a different viewpoint (not that I have any problem whatsoever with you doing that), I play StarCraft 2 exclusively online in multiplayer mode.

I tried the single player game and got an hour or two into it before getting bored. I haven't really enjoyed single player games for many years; I prefer the competitive (or co-operative) aspects of multiplayer games.

With online multiplayer games, "always on DRM" has never really been a big deal for me - though I certainly have avoided buying games from Ubisoft and other publishers because of their onerous DRM requirements, even though the games have interested me (e.g., the recent From Dust, which looks as close to Populous as anything has for many years).

So I totally understand your perspective, but just wanted to chime in and say that - for me at least, and I assume a few others like me - single player offline is not a feature we want any more.

Re:Yah

[guttentag]

Sucks, but I guess that's how the cookie crumbles.

Blizzard's cookies don't crumble. They persist until Blizzard no longer has a use for them, and then simply blink out of existence when they expire. It's rather cleaner than the old crumble method in which bits of data would slowly break off and go all over the place.

Re:Yah

[DoofusOfDeath]

Amen, brother. And so Activation has lost my business to Runic.

I doubt Activision will really notice or care about the small % loss of money, but it only takes a small number of people buying TL2 instead of D3 to give Runic a huge % increase in revenue.

Re:Yah

[cpricejones]

I doubt there are that many people like you who would really not play because of DRM (i.e., many people don't even know what the big deal is). In my mind, many of these people who profess to be anti-DRM would have downloaded a hacked or cracked version of game. I could be cynical, but I can understand why the companies want to protect their games even if the method is BS.

In any case, it seems like more people would skip these two games in favor the free-to-play League of Legends, which appears to be eclipsing both in terms of no. of players. Different game type of course ... but not to burst any bubbles, SC2 SCBW and Diablo 3 D2

Re:Yah

[benhattman]

Ditto. Moreover, I no longer get a thrill in my medula oblongota every time a Blizzard game is announced. They are just another manufacturer to me now.

And, if we're all being truly honest, even Warcraft III seemed to have lost a little bit of it's soul. Blizzard wasn't into shenanigans then, but I found that game a little less fun than their earlier RTS. I think it's the RPGization of the gaming industry. RPG characteristics like leveling up can be addictive, but they DO NOT make every game better even if they are being added to every game.

Re:Yah

[the_Bionic_lemming]

Still doesn't work.

How much more time you got left in that 10-15 minutes and trivial setup?

Re:Yah

[the_Bionic_lemming]

So, you give up then?

Thought so.

Re:Yah

[Kalriath]

In that case, when did Mike Morhaime become an asshole?

No, I don't believe you at all that ActivisionBlizzard doesn't control any of Blizzard's decisions. The rapid about-turn in the way Blizzard treats customers since the merger tends to be at odds with your claim.

Re:Yah

[Rakarra]

Wow, way to be a dick to someone that was trying to be helpful. If you can't figure out Dosbox then you should probably get back to making a living picking up trash or sweeping floors.

If you start with an insult, expect to get one back.

Remember "just saying what's on my mind" == "Just calling it as I see it" == Being a dick.

Re:Yah

[the_Bionic_lemming]

Nope, it wasn't Niggers.

Cryptographically Scrambled Passwords

[PhrostyMcByte]

I'm going to go out on a glass-half-empty limb here and say that means encrypted, not salted and hashed. "Cryptographically Scrambled" is too obviously ambiguous. I hope I'm wrong!

Re:Cryptographically Scrambled Passwords

[GerardAtJob]

It smell like XOR... ;)

Re:Cryptographically Scrambled Passwords

[ericloewe]

Yeah, but the salted hashes aren't of much value then...

Re:Cryptographically Scrambled Passwords

[safetyinnumbers]

The 'additional info' link in the announcement says they use SRP, which I'd not heard of but seems to be a hash-based system. http://srp.stanford.edu/

the server carries a verifier for each user, which allows it to authenticate the client but which, if compromised, would not allow the attacker to impersonate the client

Re:Cryptographically Scrambled Passwords

[Mashiki]

SRP is augmented by PAKE, I've heard people call it the latter before which is wrong. Some info here for those that have never heard of it. But it's not new, but it's very useful.

Re:Cryptographically Scrambled Passwords

[JesseMcDonald]

On the contrary, it is much easier to brute-force the password matching a known salt and hash on your own workstation, cluster, or botnet than it would be to brute-force it through repeated logins to a remote server, particularly if basic security precautions are implemented, such as rate-limiting login attempts and locking the account after several failures.

Salted and (repeatedly, as with bcrypt) hashed passwords are much better than merely hashed passwords, which are in turn somewhat better than plain-text passwords, but you really don't want any of the three out in the open. Actually reversing the hash is unlikely, but if a user with a valuable enough account picks an insecure password, not even salting will prevent it from being brute-forced from the password side.

If you really need all your accounts to be secure in the face of server data leaks, you're looking for public-key cryptography and challenge-response authentication. Server-side password checking against a hash isn't sufficient. However, if you must use passwords, at least generate them randomly on the server rather than letting users pick their own. Humans are really bad at randomness and pick passwords subject to trivial dictionary attacks far too often.

Re:Cryptographically Scrambled Passwords

[VortexCortex]

Which is still very secure if they used a one time pad with the XOR.

The only thing stronger than XORing with a one time pad, is XORing the input with itself.

Re:Cryptographically Scrambled Passwords

[ericloewe]

I'd agree with you, if there were a real very high value to the accounts, which is doubtful. The computing power needed to brute force the salted, hashed passwords is probably more expensive than the reward is valuable. It's not worth the hassle.

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

It doesn't matter if they're salted and hashed because someone can just use the answer to the security question to reset the password.

Re:Cryptographically Scrambled Passwords

[Stormy Dragon]

The letter from Blizzard itself says they use the Secure Remote Password protocol, so this is what they mean by "Cryptographically Scrambled":

http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

Re:Cryptographically Scrambled Passwords

[Anonymous Coward]

Since they say that they use SRP for authentication, so in their database they most likely save username, a salt and g^hash(salt, password) in ZN , where N is a large prime.
g and N are known to both the server and client, an attacker would first have to extract that from their client. As is the hashing algorithm.
Then the reference implementation uses sha256 for hashing.
So your password should be quite hard to bruteforce as it has a salt. They could even implement multiple rounds of sha256, but that is just speculation.

for more about that : http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol

( AC because Im too lazy to register )

Re:Cryptographically Scrambled Passwords

[Nemyst]

For storage, possibly, for authentication, I'd say it's quite the opposite ;)

Well now.

[Frosty Piss]

Since I''m over 25 and work for a living, this does not effect me.

Re:Well now.

[Razed By TV]

Since I'm over 25 and work for a living,
and since I got into Diablo and Starcraft when I was under 25,
this does effect me.

Re:Well now.

[Svippy]

Since I am 25 and do nothing for a living, your incorrect spelling of 'affect' affects me.

Re:Well now.

[Anonymous Coward]

Because the only people that play games are young and don't work? As if playing games for entertainment is somehow immature, as opposed to camping out on a couch and watching ESPN?

Nonsense.

Re:Well now.

[Sir_Sri]

Since I''m over 25 and work for a living

making you the target market for games, and modern MMO's. Especially so if you're male. Because you know, the people who actually work at blizzard want to play their own game, and they're mostly over 25 and have jobs. So if you're one of the 40 million or so people who ever created a battle.net account for starcraft or diablo or WoW then yes, this effects you. Because what was your security question, have you ever reused it, and was it publicly available information?

Re:Well now.

[Mashiki]

Since I''m over 25 and work for a living, this does not effect me.

Well this will surprise you then. The prime market for MMO's and gaming in general is...

Male, 25-41, working, with an average yearly income of $38,000

Re:Well now.

[Charliemopps]

is that Average income when they START playing or after they're living on disability?

Re:Well now.

[Mashiki]

You might want to you know, go and live outside of a large city sometime in your life. https://en.wikipedia.org/wiki/Household_income_in_the_United_States

Oddly, this is the first time that Canada has a higher median income than the US though. About 44k, even surpassing men. You'd actually be surprised at how well you can live on $30k/year, heck even $25k/year depending. Especially if you don't have anything else tying you down.

Re:Well now.

[antdude]

And you shouldn't be working for using the word word. :P

Re:Well now.

[Frosty Piss]

"Spelling Nazi" bullshit is no longer funny. Now get back to taking my order. And I could I get my burger without spit?

Re:Well now.

[Svippy]

Considering the mistake, I am more offended by people modding my comment 'Funny'.

Re:Well now.

[Svippy]

Calling it an 'incorrect spelling' was a joke. I guess all humour is triumphed by pedantics.

So, looks like I'm cancelling that e-mail address.

[DRAGONWEEZEL]

and removing my CC (oh, wait, I already did that).

This is going to be bigger than the Sony breach

honestly

[ganjadude]

If they got my passwords now, I dont care. After the hassles i have had with D3 from day 1 I dont even care anymore,

Re:honestly

[failedlogic]

I bought D3 about 1 week after launch. Was very disappointed. Asked for a refund - four times. Blizzard refunded me.

Re:honestly

[ganjadude]

I pre ordered the game. I know I dont have 24/7 access so my results may be different than others however. I have been able to play no more than 35% of the times I have attempted to.. I have had to redownload the.... almost 8 gig file 8 different times because it does not seem to understand the "forced update" every other day they push. I simply want to play by myself, which I cannot do without "checking in with mommy" and that is when it lets me connect. I assume (hope) I am in the minority here, but either way, I asked for a refund about 3 weeks after the game was released... however because I pre-ordered, I was unable to get a refund because i "bought the game more than 30 days aggo" even though it was unplayable until 20 days ago in my case. I was one of the biggest supporters of the blizz, and I had a feeling things would go bad with activision buying the place out (which I got a feeling from the 10 or so techs I talked to trying to fix my problem is the feeling in the office..off the record of course..) but I dont think I can buy another blizz game after the way I feel i have been screwed here. Time to find a new dungeon crawler.

Re:honestly

[exomondo]

If they got my passwords now, I dont care. After the hassles i have had with D3 from day 1 I dont even care anymore,

Yeah i gave up on it too, the having to wait to play because the servers were full, the lag, the crashes...there's no reason it couldn't have just been an offline game like its predecessors. Very disappointed with it.

Re:honestly

[lgw]

I pre ordered the game.

Why would anyone do that in this day and age? A game is something you download, so paying for it more than a day or so before it comes out seems pointless. Waiting until there are some reviews seems better still.

Having D3 at the launch did you little good - the servers were so overloaded that playtime was quite limited the first week.

Re:honestly

[ganjadude]

I pre ordered it for the extra goodies you get by pre ordering, it was the digital download.

Re:honestly

[Woldry]

Sometimes a pre-order gets you benefits, like in-game rewards, access to the beta, or the ability to log in several days before everyone else. These are my reasons for having pre-ordered Guild Wars 2.

Re:honestly

[lgw]

Yes, good point. I was thinking specifically of pre-ordering the physical box. MMOs (and MMO expansions) have had some pretty enticing rewards for pre-orders.

Re:honestly

[Kalriath]

Of course doing that also locks you out of every other game from that vendor. A chargeback against Blizzard means you lose access to WoW, Starcraft II, Diablo III, and any future products (because you can be damn sure they won't let you keep an account). A chargeback against Valve means you lose access to a metric fuckton of games, and means a metric fuckton of future games become inaccessible to you.

Anyone have real information?

[Kenja]

Nothing on battle.net, blizzard.com or any other location but marketwatch. Link in the article goes to a non-existant page on blizzard.com. Not saying shenanigans just yet, but some real information would be nice.

Re:Anyone have real information?

[Kenja]

Found it. http://us.blizzard.com/en-us/securityupdate.html URL in the article is wrong.

Re:Anyone have real information?

[safetyinnumbers]

They messed up the link in the article.

http://us.blizzard.com/en-us/securityupdate.html

Re:This is not news

[DRAGONWEEZEL]

meet me.

I have a maxed out Mage on Rexar that hasn't yet been hacked, BUT I do agree w/ you. Everyone 'else' I know has had their accounts just trashed.

Naked Gnomes everywhere...

Re:This is not news

[SomeJoel]

When my account got hacked, it was the final straw that led me to quit WoW. All signs pointed to it being an inside job. I had a dedicated (hard) password for the site, I had not visited any questionable websites, and I hadn't installed any addons in months.

Whoever hacked it had a seriously weird sense of priorities too. They had sold the starting gear off my level 1 bank alt types and mailed off the money (at a loss!) but hadn't bothered to strip my midrange characters. They used my level 85 main character with bot-aided speedruns through Karazhan. Ironically, when I regained control of my character, I had a ton of gold from their most recent run. I donated it all to my guild and quit the next day. Since I was an officer, they'd looted that too - but since it was a casual guild the gold they got me easily replaced any items in there we'd cared about.

Re:This is not news

[Anonymous Coward]

My account keeps being hacked*, despite the fact I don't login, have no real interest in playing the games, change it to random passwords even I don't remember, run linux day to day, and have it associated to a gmail account which hasn't had any suspicious activity. I've tried to reason with them, but they refuse to listen. I've come to the conlusion that Blizzard are incompetant in this area.

* I've never seen any proof of my account being hacked besides their e-mails telling me and locking my account. I managed to get them unlocked the first few times, my characters still has all items and gold I remember. Now they want me to fax a passport or some 'real identification'. I honestly don't want the games that bad, I'm just annoyed they're taking them off me.

The Responsible Thing To Do

[TranquilVoid]

Technically I'm working from home today, but I guess good security dictates I log into WoW to change my password and check for any foul play.

Re:The Responsible Thing To Do

[VortexCortex]

While you're at it, edit the realmlist.wtf file and point it at a private server...

Who cares?

[PhilistineGuillotine]

They didn't get billing information and can easily revert any accounts that get messed up.

Re:Who cares?

[PhilistineGuillotine]

Blizzard can easily revert, I mean.

Re:Who cares?

[wiredlogic]

Many people use the same password for all accounts including their e-mail. You can also assume that the same login and/or e-mail username is used in other places by many people and attempt to access other outside accounts. This creates a huge security threat for those affected.

Re:Who cares?

[c0lo]

They didn't get billing information .

The didn't get girlfriends either... so stay tuned, they'll try again.

Re:Who cares?

[TCM]

If you use your domain, why aren't you using battle.net-$rnd@$yourdomain, for example?[1]

The luxury of your own domain is precisely the ability to use one address per "consumer" and disable individual addresses at will.

[1] $rnd being 4 random chars to keep people who know your scheme from guessing websites you use.

FYI, "secret" questions can not be changed.

[Kenja]

Once a Battle.net account is created, the first name, last name and security question can not be changed. Since these questions are now compromised, everyone is SOL.

Re:FYI, "secret" questions can not be changed.

[dgatwood]

That hasn't been true for over a year.

Also, they're going to en masse make everyone change their security question/answer real soon now.

Re:FYI, "secret" questions can not be changed.

[Sir_Sri]

They said they're working on a change to the security question.

But yes, in general this is bad. Although that's sort of the idea behind salting and hashing passwords, that even if someone gets the passwords they still can't recover them.

Re:FYI, "secret" questions can not be changed.

[Kenja]

The link you provided says that only Blizzard can change them, so it sounds like its still true for now unless you want to argue with them on the phone and provided a photo id.

Re:FYI, "secret" questions can not be changed.

[Anonymous Coward]

The real problem here is not that you can't change it, it's that, unlike a password that probably has (or at least should have) no relevance to your actual life, the security question is likely to be something that is a constant, such as "last 4 of SSN" or "City of Birth" and are also likely to have been used elsewhere.

Re:FYI, "secret" questions can not be changed.

[Seumas]

Unfortunately, your mother's maiden name never changes, so you're basically SOL at your bank, broker, utilities and other services, too.

Re:FYI, "secret" questions can not be changed.

[dgatwood]

You mean my mother, née Oklahoma, or my mother né Icosahedron?

You don't mean to say that you actually give them the real information, do you? :-)

Re:FYI, "secret" questions can not be changed.

[arth1]

You mean my mother, née Oklahoma, or my mother né Icosahedron?

You don't mean to say that you actually give them the real information, do you? :-)

No, but you have to remember what answer you have at each and every site. When there are a lot of them, that becomes a very difficult task unless you keep the answer the same everywhere.
And if you do, or did, the crackers now know that your mother was once named Slimyfootdisease.

Re:This is not news

[spire3661]

Same WoW password since 2004, never been hacked once. I might not even change it after this because , frankly, i dont care.

Re:This is not news

[Sir_Sri]

Of the 56 unique players in my guild when we quit, only 2 had ever been hacked. We've certainly had people who were hacked off and on over time, (and most of them left the guild) but once they brought in authenticators it was pretty rare for people to get hacked. Even before that, you usually had to do something stupid to get your account hacked.

The most common culprits for it were from re-using passwords (especially on WoW fansites, because duh...) and people buying gold. Then there was the usual keyloggers and so on.

Re:This is not news

[Macgrrl]

I got hacked back in Vanilla when I was running on a Windows machine. It was a result of a key logger I picked up from the Curse addons site after they were compromised. Since moving back to a Mac for my primary WoW machine I haven't been compromised since. I also avoid using Curse as my primary source of Mods, preferring WoW Interface.

Ironic. . .

[Limburgher]

I seem to recall reading in the Security Question comments how Battle.net's system was excellent. That portion of it may have been, and they seem to be responding well to this, but the timing is interesting.

Re:Ironic. . .

[mapsjanhere]

If anyone gets an email for the hackers - I forgot my battlenet account info years ago, maybe they can send it to me?

Re:This is not news

[Sir_Sri]

That's actually pretty common when people do get hacked. If you have gold they immediately mail it off and sell it, and then try and bot farm whatever the best gold/hour is. That might be tradeskilling, that might be cash runs through bosses, sort of depended.

My lingering suspicions is that WoW was vulnerable to a session spoof attack at some point, or the usual exploit of a flash vulnerability to get your password, but their systems became overall pretty robust with authenticators added in.

In your case I'd guess a flash vulnerability, possibly a 0 day one, those are much less of a problem today than they were 2 or 3 years ago when browsers weren't well sandboxed etc. etc. But those sorts of things always got a few people.

Re:This is not news

[Sir_Sri]

As I mentioned below, because i'd forgotten about them, when I typed this flash exploits as well (which of course had keyloggers of various sorts). Strategy videos and all that.

Secret questions are a weak auth mechanism

[hackertarget]

So were the passwords salted or only encrypted? Do we have yet more passwords in the wild?

The use of secret questions are a weak form of password retrieval. Finding someones home town or mothers maiden name is not exactly difficult.

Rainbow tables

[Coolhand2120]

Oh the passwords are cryptographically scrambled? Do they mean hashed or encrypted? I imagine anyone with enough skill to steal all of those accounts knows how to operate a rainbow table. Why not just come clean an tell everyone their passwords are compromised too. Why leave everyone with a nebulous message like "cryptographically scrambled". Are they encrypted? Or did you just hash+salt them? I for one would really like to know!

Re:Rainbow tables

[VortexCortex]

scrambled? Do they mean hashed or ... Or did you just hash+salt them? I for one would really like to know!

I think what's best is unsalted, over easy, and hash browns on the side.

Re:Rainbow tables

[Anonymous Coward]

Oh the passwords are cryptographically scrambled? Do they mean hashed or encrypted? I imagine anyone with enough skill to steal all of those accounts knows how to operate a rainbow table. Why not just come clean an tell everyone their passwords are compromised too. Why leave everyone with a nebulous message like "cryptographically scrambled". Are they encrypted? Or did you just hash+salt them? I for one would really like to know!

Read the announcement if you "would really like to know" I guess (or maybe you actually just want to be a jackass)

http://sea.blizzard.com/en-sg/securityupdate.html
We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually. As a precaution, however, we recommend that players on North American servers change their password. Please click this link to change your password. Moreover, if you have used the same or similar passwords for other purposes, you may want to consider changing those passwords as well.

Who cares..

[SD-Arcadia]

Diablo 3 was DOA. It is a hamster-wheel farming game revolving around the auction house with no depth nor creativity.
Summary: It's fun but too easy going through normal, nightmare and hell if you gather a party. Then you hit the inferno act 2 brick wall, and your only hope for punching through that is either the RMAH or something like 100+ hrs into cheese-farming spots like dank cellar (gold) or the ancient path goblin (rares).
I found myself wishing someone else would "play" for a while because the game part peeled away and it was revealed to be a stupid repetitive virtual item farming-trading game. I bought the game mid-May, and haven't touched it past June and don't plan to either. Gonna keep it around for a couple more weeks and then give my login info to the first friend who shows interest when I go back to school for TA'ing in september.

Re:Who cares..

[Anonymous Coward]

Gonna keep it around for a couple more weeks and then give my login info to the first friend who shows interest when I go back to school for TA'ing in september.

Gave my credentials to a friend after beating the game. Blizzard locked me out of my account, claiming it may have been hacked. Oh, the irony.

Re:Who cares..

[Anonymous Coward]

The thing everybody seems to be missing is the rare feature offered by D3 - hardcore mode and hence consequences to your actions or ineptitude. Suddenly when permadeath is introduced the first 3 difficulties aren't a careless walk in the park. Suddenly you realize there's things in the game before Inferno. For example the 12 acts before that. Suddenly items you find (even gems and tomes) are worth something and just by playing you get a few million gold that you can then invest in some pretty good Inferno gear. Yes, you need the auction house. Or maybe not, because you can just trade with friends or form a "clan" like you used to have to do in D2. But unless you want the best-of-the-best gear (or you completely suck as a player) you don't ever need RMAH.

Using scrambling rather than cryptography

[tlambert]

Using scrambling rather than cryptography gets around cryptographic export and import restrictions. This is why it was possible to decypt a lot of Windows and Microsoft Word scrambled content, and why Windows NT password recovery tools existed.

Unless you want to lock yourself out of most Asian countries where videogaming comes close to a religion, and is therefore worth gobs of money, you will not build something which violates their import restrictions. See also:

http://en.wikipedia.org/wiki/Restrictions_on_the_import_of_cryptography#Status_by_country

Re:Customer service amateurs

[VortexCortex]

Last week my friend has his D3 account hacked, and they treated him as if it was his fault! What a bunch of assholes. Get your shit together Blizzard!

Their shit IS your shit, and being all together is actually the problem; Both in terms of security and bandwidth bottlenecks...

Been a while

[Xtifr]

Oh man, I think I created an account for Starcraft I. Do you suppose it's still active? I doubt I can remember what password I used all those years ago, or what email address I might have had at the time.

Re:Been a while

[HPXX]

Well, it seems to be the Battle.Net 2.0 data that has been leaked whilst you had an account on Battle.Net classic. If it was a long time ago I would assume you are safe. In the earlier days B.Net didn't even have email (until they introduced password recovery) and accounts were removed if inactive for a certain period of time (3 months iirc). Today Bnet classic accounts are not removed after this period of time. The accounts will however be open for re-registration if you have not logged in to your account during these 3 months someone else can register that account and your stored information would effectively be deleted. Unfortunately, I don't know when this introduced.

Defeating your own security 101

[fisted]

Store password hashes in the database, but the answer to a security question, which enables resetting the password, in plain text. Cool story Blizzard

Re:Defeating your own security 101

[Kalriath]

Most companies use authenticators that can only be associated with one server. Blizzard's is one of these. A Blizzard Authentication is not compatible with anyone except Blizzard.

Generally, the only ones that work with multiple companies are the Verisign and RSA ones.

Re:This is not news

[SilverJets]

My account keeps being hacked*, despite the fact I don't login, have no real interest in playing the games, change it to random passwords even I don't remember, run linux day to day, and have it associated to a gmail account which hasn't had any suspicious activity. I've tried to reason with them, but they refuse to listen. I've come to the conlusion that Blizzard are incompetant in this area.

* I've never seen any proof of my account being hacked besides their e-mails telling me and locking my account. I managed to get them unlocked the first few times, my characters still has all items and gold I remember. Now they want me to fax a passport or some 'real identification'. I honestly don't want the games that bad, I'm just annoyed they're taking them off me.

If I had mod points I'd vote this up.

My battle.net / wow account was fine for years. Never had a problem. Then I installed StarCraft2 and its updates. A day later I get a legitimate e-mail from Blizzard telling me my account had been used to spam the chat channels on wow. Changed my password, and started using their iPhone authenticator app. Nothing from any of my characters was missing. Not a single thing.

When it comes to security I don't think Blizzard knows what it is doing.

Re:This is not news

[Cat_Herder_GoatRoper]

Authenticator! Oh yea it is free, if you have a smart phone.

So where is all the pure hatred?

[Anonymous Coward]

When sony got hacked everyone and I mean everyone could not spewing unadulterate bile and hatred at sony for getting hacked and it went on for a year where no one couldnt post something without acting like a immature, bratty, uninformed child. Dozens of companies were hacked and now blizzard is but no one is pissed off.

This is for real

[tangent3]

Real links here: http://us.blizzard.com/en-us/securityupdate.html
http://sea.battle.net/support/en/article/important-security-update-faq

The important thing to note is that the passwords were encrypted with Secure Remote Password protocol, meaning that Rainbow Tables are ineffective since each password is individually encrypted instead of using a common hash. Also, the process is CPU expensive so brute forcing is highly unfeasiable for reasonably length passwords.

Re:This is for real

[Nos.]

That's all fine and dandy until you realize that Blizzard doesn't differentiate case in passwords. They either covert them all to upper or lower case, not sure which. The forums were alive with this recently. So, all of a sudden brute forcing isn't so tough, especially when they also only allow a reduced set of special characters.

Re:This is for real

[Anachragnome]

" Also, the process is CPU expensive so brute forcing is highly unfeasiable for reasonably length passwords."

Tell that to the 10 million Chinese willing to do it manually for $.18 an hour.

Re:This is for real

[ildon]

Password length is far more important than number of possible characters in each position. Ignoring case in a password actually does not affect its cryptographic security in a meaningful way. Look it up.

Re:This is for real

[Nos.]

Lets look at the possible number of passwords (so we're talking about a brute force attempt on the hashed password).

Blizzard's setup is not case sensitive, and they disallow a significant number of special characters. Lets say they have 40 possible values for each. A good password setup should have around 75 (or more).

So lets see how many possible values there are for a 7 character password in each setup:
Blizzard 4.456764032636319e+34
Good: 1.6883055225799413e+64

That's quite a difference. Lets see how many characters it would take in a Blizzard password to get into the same ballpark. Turns out its 37 which gives: 1.9782022283855447e+64

So, I guess a restricted character set is okay, if you go with REALLY long passwords.

(I used the password calculator at http://www.csgnetwork.com/optionspossiblecalc.html with 4 for a minimum length to determine those numbers).

Fool me once...

[DJ Particle]

Before I got an auth'er, I once logged into the armory app on my iPhone over an insecure wireless. Yeah, stupid, I know. My account was compromised shortly after. A couple weeks later, I got it back, intact to the way it was before the hack.

Now, I have a password I don't use anywhere else, a mobile auth'er (that I changed the serial number on after I read about this breach), and I have it set to *always* require the auth'er to log in. Now that whatever mobile auth'er info they got regarding my account is useless, I should be relatively okay.

Re:Customer service amateurs

[webdog314]

Your "friend" is likely an idiot who has a key-logged, malware-ridden machine. 99.99% of the time, what someone calls "hacking" is nothing more than poor personal security on their own machine.

Stupid SHIT

[darkain]

There is a ton of stupid SHIT being posted here on the slashdot comments. I don't blame the commenters one bit, thought. Why? Because the article was a regurgitated rehashed pile of shit in comparison to the actual Blizzard press release... which was really hard to find, ya'know, being the top post on Blizzard.com after all... A very key detail, the usage of SRP, is completely missed by the article, which is leading to the majority of the confusion here and elsewhere.

http://us.blizzard.com/en-us/securityupdate.html

Re:Stupid SHIT

[Cimexus]

Welcome to Slashdot. :)

Re:Customer service amateurs

[powerspike]

Well it probably wasn't their Fault. A few accounts hackers have admitted to hacking fan sites and getting usernames and passwords from there, and trying them against battle.net, quite a few people use the same logon details.. and account hacked. Not Defending them what has happened (according to this article), But alot of people are blaming blizzard for hacked accounts that had nothing to do with Blizzard. They have really F'd up big time with D3, but account hacking issues up to now haven't been because of them.

Re:Proof Linux is more insecure than Windows

[Gaygirlie]

I know I am replying to a troll, though I am not actually expecting any kind of sane reply from him, I'm rather replying to his post so that other users would notice the obvious flaw here.

The thing is, if the hack does not actually use any of the OS-specific features to gain access to privileged data then the OS is wholly irrelevant. All the hacks and attacks mentioned by the troll have been because of faults on the Internet-facing software that runs on top of the OS and would've happened just the same if the software was running on *BSD, OSX or Windows. Operating systems simply cannot protect against stupid people or faulty software, that is merely a pipedream. As an example if there is a bug in your latest Windows-based MMORPG that lets attackers gain access to your data do you blame Windows or do you blame the MMORPG for the failure? I sure would opt for the latter. With that in mind the troll in question here is simply trying to associate bugs in 3rd-party software with the OS, shifting blame from one party to another.

heh

[niix]

Trading 40 SoJs!

Re:This is not news

[Zaelath]

My account had a max level character in every slot of my main server. Never got hacked.

Next theory.

Re:Proof Linux is more insecure than Windows

[Gaygirlie]

I don't think you've realized the magnitude of his insanity or trolling... the smoking crater from his last post here.

As I said, I don't expect any sane reply from him. In fact, I'm not expecting a reply at all. I merely wanted the...um, "less attentive" commenters not to fall prey to his obvious attempts, other than that I don't care who he is or what he has posted before.

Re:This is not news

[SydShamino]

I played from release day until last year. My account was never hacked.

I use noscript and, when I could get one, an authenticator. I also don't use the same email address for my battle.net authentication as I did for other WoW forums, so phishing was even easier to identify.

Re:This is not news

[TheLink]

Actually depending on what the hackers do, changing your password might actually make things worse[1]... Plus Blizzard don't seem to have figured out the details of the hack, so why waste time creating an uberstrong password if they could get hacked again?

BUT if you happen to use the same password in other sites/services, change it at those places.

[1] They might then get the plaintext of your password instead of the "scrambled" version.

Re:This is not news

[Billly Gates]

The flash exploit I believe. My ex had terrible securith with her gaming Vista laptop. I was more ignorant back then too with security issues as I have not worked in a pc shop yet and seen the machines coming in and the steps people took. I thought AV software was a waste too as I do not visit bad sites on this machines etc. I was quite stupid.

Nowdays I am so paranoid I tend to avoid firefox because it has no sandboxing, use flash that updates automatically, use Chrome which does it for me and has double sandboxing, am very serious with a good AV package and also run Malware bytes.

My kids run ancient java still probably on the old desktop out of my control to run minecraft and I shudder. I thought it was safe back then too in 2009/10. GOD. Windows 7 thankfully is much more secure as well as the steps I now take.

But still mac users back then were getting hacked and the ones who had access to the guild vault were always hacked. hmmm .... sorry something is up with that.

And the counter argument

[SmallFurryCreature]

How many paying customers see other people getting it for free and decide they also no longer want to pay?

Proof of this behavior? Walking through a red light, once one person does it, others follow.

Guarding against theft is not just to stop active thiefs, it is also a way to keep non-thieves from turning to thieving.

Proof with regards to copyright infringement?

Whenever a story runs in the main stream media on thepiratebay or napster or whatever, every geek gets asked by non-geeks how they can get in on the action.

What do you expect?

[SmallFurryCreature]

It is a console game first of all. Console games do not have depth or replay value, rather they have difficulty levels that are locked forcing replay.

And Diablo has ALWAYS been a repetitive dungeon crawler/hack&slash game. That is what it is. And the only way to increase difficulty without improving AI is to add more monsters with more hit points and more resists and this creates the brick wall then your "skill" level is reached.

My advice for Diablo? Play it once, just like other games. Then STOP.

There are people who play Final Fantasy games to max everything or speed run RPG's and for THOSE people there is Inferno. They don't "play" a game for story or novelty, they play to get REALLY good at doing the exact same thing over and over again. If by some miracle of scripting a game company made every boss unique on every play through, these people would be REALLY upset. It stops them from using skillX at 3904872 HP followed by Y and Z in 2.322334 seconds.

Basically, the above poster is complaining that a porn movie gets a bit repetitive after the 100th play through. DUH!

Re:What do you expect?

[RogueyWon]

You know it's not a console game, right?

Right?

Blizzard have mulled over the possibility of a console release from time to time, but there's nothing announced. The game's not that different from its predecessors - as you yourself note.

In fact, the Diablo series is historically a PC/Mac series. There was a Playstation 1 version of the original, but it never got much traction. This series is as computery as a very computery thing that was just made even more computery by the injection of a big pile of computer.

I think you're using "console" as a shorthand for "shallow and repetitive". Well, I can certainly agree that Diablo games are shallow and repetitive. Absolutely. Definitely. With cherries on.

But then, I look at some of the console games I own and I don't necessarily see much in the way of shallowness or repetition in some of those. Valkyria Chronicles (PS3 exclusive) is absolutely brimming with depth and complexity, packaged beneath a highly accessible exterior. Dark Souls (360 and PS3, belated PC version due later this month) is more action oriented, but has one of the deepest and most precise combat systems I've come across. The Forza Motorsport (360 exclusive) games have depth coming out of their ears.

By all means criticise the Diablo series for its core gameplay - god knows it deserves a bit of a grilling as a counter-point to the fawning it got from some review sites. But if you're claiming it's a console game, you look ridiculous and if you're claiming that all console games are shallow, you look ignorant to boot.

Re:What do you expect?

[Krojack]

You know it's not a console game, right?

Yet the game could be a console game. Blizzard has also been tossing around the idea of releasing a console version. They are looking for a Game Systems Designer (Console) Diablo III. It's clearly no proof but still something they are considering.

Re:What do you expect?

[RogueyWon]

Well yes, but Creative Assembly have "considered" the idea of a console version of the Total War games before. And I challenge you to find a more definitively "PC" series than that.

not just the application that gets hacked

[dutchwhizzman]

With most hacks, the application gets hacked and the attacker gets access to whatever users privileges the application is running as. That user usually is an administrator when you're on windows, or it has access to local exploits that target administrator or system accounts. On linux, chances that someone gets root after compromising an application are smaller, or require more manual work at least. That makes the OS safer, but as you said, the chance to get hacked is just as big. Mind you, the OS is safer against automated attacks and script kiddies. Someone that really wants to get in and knows what they are doing, often can still find a privilege escalation.

Found it funny

[Alarash]

I went to Battle.net to change my account password. I use KeyPassX to generate reasonably safe password. I can remember each generated password but that is fine, I usually copy/paste them. Oddly enough, Battle.net doesn't allow you to copy/paste passwords when you change them (not in the old password input, nor the new one).

So how are they infomring customers?

[Shivetya]

Especially those of us who have taken a break from Blizzard games?

No one I no of nor I have received any notification about this breech. It is not like they don't have my email address.

As for the part about credit card information, I can believe them for one reason. A while back we had an account deleted per our request because we wanted no CC information stored with any game company. Well we had to have the account deleted and you do that through an email to the Blizzard privacy group.

Guess what, they delete the account and all related information EXCEPT for the credit card. How did we know? Because we got billed on it six months later by Blizzard.

Re:Hacked, and hacked for a long time.

[RogueyWon]

Well, it might be an "inside job", but not in the way you're thinking.

There was a issue with MS Xbox Live accounts being compromised recently. I was one of the ones affected by this and, until I learned more about it, I was utterly puzzled as to how it had happened.

See, prior to the Sony breach, I had been guilty of a bit of password sharing between accounts. After the Sony breach, I get more sensibly paranoid and, other than random don't-really-care forum accounts, everything gets its own password. As part of this, I change my Xbox Live password. I go for something reasonably strong - 10 characters, mix of lower case, upper case and numerals (spending your teenaged years learning Latin and ancient Greek is great for your memory). This password is only ever entered into my (stock, unmodified) 360. I'm pretty sure my PC is free of keyloggers - but even if it isn't, this particular sequence of characters has never been typed into a PC.

A few months later, I find I'm locked out of my Xbox Live account. The password and e-mail address have been changed (the e-mail address is now some German one) and around 50GBP has been spent on MS points, of which around a quarter have been spent on FIFA DLC. Fortunately, I notice within a few hours of this happening. Half an hour later, I've spoken to MS, who have locked the account and to my bank, who have refunded the credit card transaction.

The account then spends about 3 weeks locked while MS perform an investigation. At the end of this period, I get profuse apologies from them, a free 2 month extension to my gold subscription and my account back. This takes me by surprise - I'd previously thought that, except in cases of Sony-style security breaches, almost all compromised accounts were down to the behaviour of the user. Despite the circumstances of my case, I'd been torturing myself trying to think of all the ways I might have slipped up (god knows how many rootkit scanners I ran on my PC). I'd certainly not expected MS to be bending over backwards to make amends.

Anyway, Eurogamer picks up on stories from people who've had similar cases and investigates. A few months later, we quietly get our explanation. The security breach is at MS's end, but isn't in their software - it's in the protocols that their phone support guys use. Basically, it was possible to use social engineering techniques against MS's own support staff to get them to do password resets and e-mail address changes on an account, without actually knowing anything more than the name of the account. I gather the issue has since been "rectified", but it's still alarming.

Apparently my account had raised many of the flags that makes it desirable to the scumbags who do this. It's an old account (created on the day that the Xbox Live service for the original Xbox was launched in the UK), so it's a bit like having a low UID account on slashdot. It has a reasonably high gamerscore (though not exceptional). Perhaps more importantly, a few days before my account was taken, I'd got my first 1000/1000 gamerscore on a game (and not on one of the titles that are known to be quick and easy to do it for). This apparently meant that my account was desirable not only for the ability to spend on my credit card (FIFA DLC can apparently be traded for real-life cash, and hence is a way to re-monetise XBL currency), but would also have had a high resale value.

Re:Customer service amateurs

[RogueyWon]

This used to be true, but an increasingly popular means of compromising accounts involves using social engineering techniques not on the end user, but on the host company's support staff. Look around a bit and you'll find some shocking examples of how easily certain companies *cough* MS Xbox Live *cough* have been giving their support staff protocols which make it trivial for scumbags to compromise individual accounts via phone-call while knowing nothing more than a username.

But I agree that "hacking" is the wrong word in 99% of cases. If an account's compromised through a Sony style breach, that's "hacking". In other cases, it's best to use a different term.

Re:So, looks like I'm cancelling that e-mail addre

[BenJury]

Frankly its about time the credit card companies \ bank sorted themselves out. What we need is a number that can be given out but links to one merchant only. So if these numbers are retrieved by a third party damage is limited as they can only be used on the original site, and it would be trivial to revoke them when the intrusion was discovered. Unlike right now as when you discover someone might have your cc information, you have to cancel the card, wait for the new one to be issued and re-enter the new information into all the other sites.

The same goes for bank details. When we need to transfer cash electronically from one person to another, why not give us 'deposit only' details to give out?

I know the banking sector moves at a snails pace on things like this, but seriously, how hard can it be?

Great, Blizzard, to receive this thru 3rd party!

[freaker_TuC]

As a long-term Blizzard customer, I am outraged; to have this news delivered through third party.

No notification came from Blizzard thru e-mail. Cool way to support your customers..

Re:This is not news

[Sqweegee]

How do you know your account is getting "hacked"? E-mail notification?

Checking my spam folder I've found that my account gets hacked every couple of days and there's a easy link to verify my identity and login credentials... It seems you don't even need an account to get hacked!

Change your secret question and answers

[kenp2002]

"...the answer to a personal security question, and information relating to Mobile and Dial-In Authenticators..."

Bluntly now they have an email and an sample of your secret question. Given a question of "What is your Mother's Maiden Name" then script kiddies now have your email address and one of your potential secret question responses. WTF wouldn't you hash the answers....

They now have an email address, your phone number, a secret answer response. Christ all might Activision.... way to fuck up. Now ever script kiddie with that data dump is going to spam every major site with those email address and now with at least one potential secret question response... just wow...

Re:So, looks like I'm cancelling that e-mail addre

[Shompol]

And then you have buddy@ and significan_other@, and then it's your birthday and both buddy@ and significan_other@ send you a FREE postcard, and suddenly all your accounts are flooded with spam.... I guess you have all your emails redirected to /dev/null by now.

Re:This is not news

[Krojack]

If you have an android phone get the Google Authenticator also. It's that added wall that makes you feel a little more at ease.

Re:Hacked, and hacked for a long time.

[Krojack]

No, not Trojan or key logged or phished or anything stupid like that.

Sorry but every time I see someone say that I laugh. It's like they think their computers are impervious or perfect and there is no way in hell they can be at fault. It's ALWAYS the other guy!

Back in the WoW BC days I was hacked. I thought I was pretty good with security. Come to find out I visited some website blog that was exploited with an iframe/XSS logger. That's how my password was logged. You don't have to have something installed on your computer to get keylogged.

Re:Customer service amateurs

[Krojack]

The chance it was in fact your friends fault is still very high. Blizzard hasn't given a date span as to how long ago this occurred so you can't say your friend is a perfect little saint just yet.

Re:So, looks like I'm cancelling that e-mail addre

[Anguirel]

What we need is a number that can be given out but links to one merchant only. So if these numbers are retrieved by a third party damage is limited as they can only be used on the original site, and it would be trivial to revoke them when the intrusion was discovered.

I know everyone hates on Bank of America, but they have exactly that. It's the main reason I didn't cancel my account there (during all of the other recent issues they've had) - the ShopSafe system they have for their CCs is pretty amazing. You generate a new CC# for online purchases. Once it has been used once, it's linked to that merchant, and will fail if any other merchant attempts to use it (which can be a bit of a hassle on occasion -- Amazon is not the same as Amazon Kindle is not the same as Amazon Marketplace, even if all of those are in a single account system from my perspective -- also fails if the merchant ever randomly changes their listed name or accounts on their end).

I won't defend anything else they may or may not do, since I barely touch most of their services, but as a basic direct-deposit-account-and-credit-card service they've been pretty good for me and the ShopSafe option is pretty cool (and likely patented or something which would explain no other institution managing to do it).

Re:So, looks like I'm cancelling that e-mail addre

[BenJury]

Sounds about right! So it can be used for subscriptions, etc? Are listening First Direct?!

Re:Then you don't have time to play Warcraft 1

[the_Bionic_lemming]

So, it's not 10 to 15 minutes, but rather I should devote hours to setting it up?

Gee, that sorta makes the first anon coward post in the thread look - totally idiotic then.

Re:This is not news

[Kalriath]

Uberstrong password? You CAN'T set an uberstrong password! Case insensitive, alphanumeric only, 16 characters max. It's like requiring that a bank vault be secured with a sturdy rope.

Re:So, looks like I'm cancelling that e-mail addre

[Anguirel]

Yes, it can be used for subscriptions (up to a year at a time - you choose how long a given number is valid, between 2 and 12 months). It also has a capped amount of cash associated with it (that you set when creating a new number), so even if the site you're buying from isn't on the level, you'd still only be at risk of losing whatever amount you expected to be paying (until fraud protections kick in), rather than suddenly having your card unusable until you can get the charges reversed.