Originally Posted by Gaile Gray

Folks,

I need to know more information, from those of you reporting that you can try multiple times without a block on attempts to access the account. Is the account with which you are making this test linked, Guild Wars and PlayNC, or not? Are you putting in the correct user name and then using an incorrect password, or are you using an incorrect user name? If I can have the parameters of the testing, that will help, and thanks for that information.

Also, some time ago, there was a system whereby someone would receive an email if their account was being "pinged" for access beyond a reasonable number. Are any of you getting such an email with your testing?

Originally Posted by luinks

yes Str0b0 the thing is brute forcing a password could take even several weeks maybe months, but in the current state of the client, you can leave the brute force prog running wild every day and night until it would hit the nail, sure it will take a long time but is doable.

I'm just pointing this client side flaw is still there, and nothing has been done to fix it. However your suggestions are pretty useful and everyone should take into account next time they change their pass

Originally Posted by Str0b0

Originally Posted by Str0b0

Actually when I say astronomical I really mean astronomical. Even at current processing power a ten character password comprised of numbers and at least one capital and one lowercase letter would take an ungodly amount of time. http://geodsoft.com/howto/password/c...ds.htm#howlong
The table in that article, you can just jump to the how long section from the contents, demonstrates this. The table is based on 1.2million tries/second using just alphanumerics and no special characters. As you can see a ten character password, using both numbers and letters(not mixed case letters though and I'm not sure why) would take 1,160 years at current processing power levels to crack. That's longer than most hackers want to wait.



Those suggestions though apply to any password you make for any program or website. My only beef is that I can't link my biometrics to my guild wars client. That's the one and only 100% secure password protocol in existence, barring someone actually being able to lift and duplicate your fingerprints.

Originally Posted by Loviatar

REALITY CHECK HERE

if a hacker is reading your email he is probally reading everything else as well.

in which case.......

GW IS THE LEAST OF YOUR PROBLEMS

<this has been a reality check>

Originally Posted by topdragon147

That said, I do think the acount name should be able to be changed. I'm sure there is some (Alpha)numeric string that is already in place to identify the accounts, so account name shouldn't be a problem

Originally Posted by topdragon147

A good hacker wouldn't use pure brute force to crack the password. Usually, the password would be just one word and letters. They could use a program like "John the Ripper" to attempt a dictionary scan, coupled with brute force. There have even been some suggestions that a completely random password might be less safe then something a human might come up with. Regardless, a good hacker will find SOME way in, so the best things to do are to keep changing your password often and never give out your email address. That said, I do think the acount name should be able to be changed. I'm sure there is some (Alpha)numeric string that is already in place to identify the accounts, so account name shouldn't be a problem

Originally Posted by Str0b0

Dictionary scans are useless in the face of alpha numerics. You can't list a random number string with letters thrown in. The only thing you can do is try every possible permutation of the 62 possible characters in every single grouping from the minimum required password length to the maximum required password length. If you throw in the ASCII characters to make a total of 95 possible characters you begin to see the monumental undertaking that a hacker would have to go through just for an account. Couple that with the fact that all the hash information is server side and not client side and John the Ripper is useless, well provided you don't do something dumb like have the client remember your ID and password. I refuse to believe that ANet doesn't encrypt their hash info with ,at the very least, blowfish or better and I'm positive they have a full suite of NIDS and Behavioral monitoring software. Most modern networks encrypt their hash info with at least 128 blowfish comparable encryption, large companies or companies that depend on their networks heavily, like ANet, likely use a 256 or better encryption scheme.

One thing that amazes me though is how much credit people give hackers. Hackers prey upon stupidity. Common sense defeats them in most instances. It is a fallacy to think that you cannot create a secure system because a good hacker will always find a way in. I have been responsible for security managment on 5 9 networks and with the proper software you can create an airtight security layer around any network or system. It all depends on the software you choose to use and the password scheme you enforce on your network. My personal network is all based on biometrics, with a hardware NAT firewall, a software firewall, NIDS, and an inward facing software firewall for behavioral monitoring purposes. Now this is just me, a slightly above average user. Imagine what a company with an actual IT budget worth mentioning has on theirs. I think the worst we can expect from any hacker trying to crack your GW password is brute force techniques or pre-made dictionary lists. If you follow an alphanumeric scheme with a minimum of 10 characters then you should be more than fine.