so theoretically, people could lose their WoW, SC2 and Diablo 3 accounts all in one fell swoop.  Rather than say anything that could be perceived as unkind, I'll just say that at this point in time it appears it could be most unfortunate to be a patron of blizzard.

Originally posted by Gravarg
it happens, at least Blizzard is upfront about it, unlike SOE which tries to hide it (or doesn't realize it happend until months later).

This probably happened months ago. Oh I dunno, maybe sometime around May 15th.

(shrug) If you have a physical authenticator you're still safe :-)

I want a physical authenticator for EVERY game I play now if it's an option.

Changed my password. even though I have a real authenticator... that was an easy fix.

Might have some problems with people that don't pay attention to gaming news and people that don't play anymore though.

Originally posted by reignjuste
Thats what happens when u fail to deliver a diablo 3 game.They deserve it

Siding with hackers isn't a good thing. You could be their next target. 

Originally posted by kadepsyson
So much for blizzard being the Almighty secure authenticator protected infallible entity people claimed.

 Still don't know how secondary authentication works do you?

Originally posted by endgame1

Just one quick observation reading the faq below. They detected the security breach on August 4th, but there's no info about how long that breach may have existed before they found it. 

 

http://us.battle.net/support/en/article/important-security-update-faq

Geez what a crappy response.  Just tell everyone to change their passwords, rather than monitor their accounts .... or do a global auto reset.

WTF does monitoring an account do .. oh not hacked yet .. oh wait today I'm hacked .. lol?

edit: Blizzard is using it's customers as guinea pigs to see how far the damage actualy went, so they can spin a smaller amount of affected customers.  My initial reaction still stands - tell everyone to reset their password and suck it up.  Treat customers better?

Originally posted by kadepsyson
So much for blizzard being the Almighty secure authenticator protected infallible entity people claimed.

The autenticator itself is pretty solid, the only way around this is to either steal the key from the authenticator (requires physical access) or to do a Man-In-The-Middle attack, where your computer acts as a proxy to some other host.

Either way, it eliminates lazy crooks from obtaining your info, which composes most of thefts.

Originally posted by expresso
OK now Blizzard have been hacked, you see when Blizzard is really hacked they do tell people like all responsible companies do.

I'm happy that Blizzard is this quick with reporting the hack. But like all responsible companies do..? Most companies still won't report a hack to their customers, just look at $O€ last year. They waited over a month and only came out because Anonymous told the press...

Originally posted by expresso
The passwords taken were encrypted, no big deal but you should change it either way, plus if you an authenticator even if the password were plain text they could still not get into then account.

This, if you use the physical authenticator, they still cannot get into your account, even if they somehow manage to decrypt your password.

Originally posted by lotaparty
what more  bad can happen than this? someone took my six toons in my absnce and this the message that they gave me : 

/snip

So all in all considering all of these transfers were paid for using the same card that paid for *all* of the subscriptions on the account and furthermore said transfers were requested from the same geo-location that is regularly used on the account and said individual even contacted us verified all the security information. Unfortunately this leaves us two possible conclusions:
/snip
 

Highlighted for emphasis.

I think you have bigger issues than your 'toon' and I find it entirely reasonable on Blizzard's side due to that highlighted text.

We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually.

Nice spin on things. SRP secures the exchange of passwords between a client and server. It's even used as a protocol to ensure that cryptographically weak passwords are incredibly difficult to sniff. As a protocol however, it has nothing to do with how securely passwords are stored. I'm not saying Blizzard DON'T store their passwords securely, but inferring that SRP makes their passwords secure is at best...misdirection.

Think of it this way - "we use envelopes to secure your letters". Great, that takes care of securing the exchange of the letter (password) between the sender (game client) and recipient (server). It doesn't mean a thing if someone breaks into your house and reads the letter because you just left it lying around, opened on the kitchen table.

Originally posted by Mulli

We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually.

 

Nice spin on things. SRP secures the exchange of passwords between a client and server. It's even used as a protocol to ensure that cryptographically weak passwords are incredibly difficult to sniff. As a protocol however, it has nothing to do with how securely passwords are stored. I'm not saying Blizzard DON'T store their passwords securely, but inferring that SRP makes their passwords secure is at best...misdirection.

 

Think of it this way - "we use envelopes to secure your letters". Great, that takes care of securing the exchange of the letter (password) between the sender (game client) and recipient (server). It doesn't mean a thing if someone breaks into your house and reads the letter because you just left it lying around, opened on the kitchen table.

 

 

 

Ah...with SRP the server does not store straight password data since version 6. 

If the report in the the tech section of BBC web page this morning is correct.  They got away with millions of unencrypted email address.

This maybe way I am seeing a huge increase in spam mail the last few days with emails having my email address in both the from and to slots.

Originally posted by Acornia

If the report in the the tech section of BBC web page this morning is correct.  They got away with millions of unencrypted email address.

This maybe way I am seeing a huge increase in spam mail the last few days with emails having my email address in both the from and to slots.

Good chance this was a possible target.  Lots of money selling Email lists.  If  you have a big enough list.