Diablo 3 Battle tags

[BETTEH]

Jeffpants#1420

[ShiftyDevil]

Warning to all Diablo3 players: there are currently reports of successful account hijackings which reportedly use a security loophole from playing in public games.
It's suggested that everyone sticks to private and friends-only games for the moment, might even be worth turning off quick-join to prevent a compromised account from joining.

As to the details, the most coherent guesses I saw were hijacking session IDs through shared games, or other packet-interception related "hacks".

No, the problem is that the session ID is discoverable. Simply steal somone's session ID, and use that to connect. You will disconnect the user, and you take control of the session.

This happened in Rift and it's incredibly stupid Blizz made the same mistake.

[Gizanked]

I cannot say how much i've appreciated having the authenticator attached to my account. If you don't want to spend the $7 or so then download the smartphone app. if you don't want to spend the money and don't have a smartphone then you deserve to have your account stolen.

[One_Medic_Army]

I stand corrected, not too sharp on network mechanics.

Any suggestions for limiting danger?
Would setting the authenticator to require code every log-on have any effect?

[MasterChef]

I cannot say how much i've appreciated having the authenticator attached to my account. If you don't want to spend the $7 or so then download the smartphone app. if you don't want to spend the money and don't have a smartphone then you deserve to have your account stolen.

Or people could just not click on links offering free gold


I may re-add the mobile authenticator to my account though just because it doesn't hurt. I had it removed from my account awhile ago when I forgot to take it off when I reset my phone. I never put it back on since I haven't played wow in forever.

[ShiftyDevil]

I want to be clear on what appears to be happening, since Bliz has not release the official word on how accounts are being stolen.

If you join a public game, it is possible to figure out the session ID from the hash that the user sends to the server. This happens AFTER you log in. This has nothing to do with your username and password.

Once the hacker obtains your session ID he sends THAT to the server (not your account credentials) and connects that way. Again, your account credentials are not being stolen, there's no key logger or something, they are bypassing login by stealing the session.

Do not join public games until this is fixed.

[bz]

I gave in:

spooked #1573

[Gizanked]

that puts us up to 23 people. wooo

this is a quick copy paste of the list. for fully updated listings check the first post.

BETTEH Jeffpants#1420
BigBiker05 BigBiker05#1103
booner booner#1859
bullet4o1 bullet4o1#1273
BuzzyBeetle BuzzyBeetle#1557
bz spooked #1573
Cpt._Keyes tvbkeyes#1583
crimsonshootingstar CrimsonDrozd#1909
darklin0 darklin0#1311
DDYzErO DDYzErO#1990
E.T. EddieTorrez ETEddieTorez#1883
Gizanked Gizanked#1235
Ignatius Ignatius#1872
Last of The Finest Badstreet#1968
MasterChef Barius#1160
metacide metacide#1958
muj0 muj0#1158
NoahTheBoa BobLoblaw#1936
One_Medic_Army OneMedicArmy#1429
Parade Kid Parade#1422
raindrop raindrop#1297
ShiftyDevil ShiftyDevil#1950
SilverOne silverone#1907

[somedude]

n0hup#1467

[wyowapiti]

wYo#1245

[ShadyJane]

Shadyjane#1803

[MateoTheBold!]

A wild Diablo 3 appears! It's super effective!

Guest codes for the lot of you.
EKKEG2-8FGG-6C49XJ-Z48P-64GE8Z
MY7YH8-FCX2-GZH8FW-MV42-M7CRPT

Claimed meta's last key.

MateoTheBold#1361

[ShiftyDevil]

A wild Diablo 3 appears! It's super effective!

Guest codes for the lot of you.
EKKEG2-8FGG-6C49XJ-Z48P-64GE8Z
MY7YH8-FCX2-GZH8FW-MV42-M7CRPT

Claimed meta's last key.

MateoTheBold#1361

Guest accounts can't play with full accounts sadly.