Got onto the PBE after a while without playing and found that my PBE account's summoner name had changed. And it also had a chat restriction for toxicity.
MAKE SURE YOU CHANGE YOUR PASSWORDS, PEOPLE.
Martensitic6 votesOr even better:
Don't re-use your passwords.
Don't use the same password for multiple services.
One of the reasons why database breaches like cloudbleed are so dangerous, is because people are surprisingly dumb when it comes to their IT security, and use the samepassword for facebook, gmail, league, wow, instagram, snapchat, whatsapp,...and that new webservice which just happens to get hacked.
Guess what the first thing someone who gets his hands on one of the lists does after hashbreaking passwords? HE TRIES THE EMAIL-PW COMBINATION ON EVERY OTHER WEBSERVICE.
And that isn't done by hand folks. There are scripts that do that. Automatically. Millions of passwords in a few minutes.
So: Start using different passwords, for different services!!
And learn how to use it. There are multiple open source options to be had in that area, that do not cost any money, offer great functionality, are super easy to set up and work on almost every operating system (including mobile ones, however, if you set up your pw manager on a phone, you are begging for security problem.)
All you have to do is remember ONE single password (which should actually not be a password, but a really really long and complicated pass-phrase) to unlock the PW manager.
And if you cannot remember one strong passphrase, well,...
elduris2 votes
#-------------------- GET A GODAMN PASSWORD MANAGER!! --------------------
I use 1password, it's really easy to use and will help generate unique complex passwords for every account. Takes a bit to set up and change passwords on your old accounts, but it's worth it.
Martensitic1 votesIt is not a bad solution, but I personally do not like proprietary password managers, for a very simple reason:
They are not open source.
I want to believe that this is not a problem. I truly do. I would love to live in a world where that could never be a problem. But: If the code I entrust the security of my personal informations to, is written by a company, without me having access to that code to inspect it....
...then at least for me, that is a no-go.
Riotcluvie3 votesYAASS.
EndlessSorcerer3 votesDo you happen to know if there are any plans for improving security around League of Legends accounts?
Even something like Steam's validation service (i.e. notice login from new device, send verification code to related email account, prompt for code to allow login) would be fantastic.
Curious if anything is planned or under development.
Riotcluvie5 votesHeyo --
I'm not on the team that is working on this, but I did poke someone there to see where we are at. Looks like they are currently exploring options for 2FA implementation, but don't have a solid timeline on when the discovery will be complete and work starts on actual implementation. A current proof of concept is live on PBE as SMS, but I think that may have been there for a bit already.
TL;DR - It does look like it's being explored a bit more this year!
EndlessSorcerer1 votesThank you for looking into it.
Much appreciated.
LostFr0st1 votesDo you know if they are considering an alternative for people who do not own a smartphone or the like?
Master Spookums1 votesHey Cluvie, would you be able to take a look at my post please? http://boards.na.leagueoflegends.com/en/c/player-behavior-moderation/8gKZHAPE-riot-support-please-read-this
I appreciate it!
Martensitic3 votesThis is always baffling to me, why people don't use simple sentences as passwords.
Naive brute force can't crack them, even word lists take a long time, and they are really easy to remember.
(Just: Don't use "correct horse battery staple" as a password, this is on basically every list since that comic came into existence :D
ProfDrDeath1 votesYeah.
You don't even need to relinquish numbers or special letters, either - simply put these in between words or as part of words.
Piltover Customs1 votesI just smash the keyboard for something like this:
tg4f311jf320asd
Then I'll throw in some special characters !@#$%^& wherever.
Then I actually remember that.
I'll write it down on a sticky by the computer (at home obviously).
After a couple weeks of inputting it, it becomes second nature :)
Martensitic1 votestg4f311jf320asd
The password you "randomly" generated is not as random as you may think. Lets have a look at it:
A) It contains only lower case letters and numbers, something that is common with "keyboardsmash" passwords
B) It contains patterns of key combinations, generated by physical proximity of keys on the keyboard and the way human hands work:
tgf...next to, or near each other, top down oriented (smash moves usually go top to bottom)
4312 as most of the interspersed numbers ... the leftmost numbers on the board.
**asd **... one of the most common combinations of "random" keyboard smashing, 3 bottons next to each other, ordered left-to-right
jf ... this will be in almost every "random smash" password written on an european/uk/us keyboard, because those are the two "rest-position" buttons (ever noticed the little heightened "bumps" on them? that's why they are there ;D)
All those are patterns, and patterns are where passwords become interesting to crackers, because they provide a way in. Its hard to brute force by trying every combination of 15 characters, even if they are only numbers and lowercase letters. But when one can reasonably predict that something like "asd" or "jf" is in there, with a possibility for slight variations, then the number of passwords that have to be tried, the "pool" suddenly becomes smaller by several orders of magnitude.
The special characters used make it a lot stronger, yes, but look at which ones you are using: The most common ones, which are used in most forms of writing. The only 3 your list is missing, are . ? and -
Would it surprise you to hear, that there are wordlists, with hundreds of thousands of entries, of "randomsmash" passwords of variable length available to security experts? Its pretty simple to do primitive statistics on this data, and the result is: The "randomness" of random smashing is shockingly low.
still, it is a way better method than most which are commonly used, I give you that =)
SSJTribe1 votespretty interesting, what would make a strong password then? Some people I know use a combination of favorite sports players names and numbers, like Tony9Romo or Michael23Jordan. Or create a random word with vowel-consonant-vowel pattern, like gomopur. Others will use their street address 12345FakeSt.
Martensitic1 votesa combination of favorite sports players names and numbers
Not a good idea. Lists of celebrity names exist as well, precisely because passwords using these names are so common. Some of the better lists are even updated regularly and automatically based on popularity and how much celebrities are mentioned on social media like twitter .D
Others will use their street address 12345FakeSt.
Street addresses are not much stronger.
Yes, there are a lot of streets, but actually not a lot of street names. How many "Main St." are there? How many "Park Av."? And addresses also have patterns. For example, most addresses in the US follow this scheme:
[Nr.] [Street Name] [Town], [State] [Zip-Code]
That's already a lot of information about a password given away for free.
Also, if ones password is stolen and broken, that's bad enough. There really is no reason to add insult to injury by also having ones reallife address revealed by that.
what would make a strong password then?
That depends what you define as strong. A 500 digit alphanumeric password would be almost unbreakable, but also impossible to remember, let alone type.
Some very good passwords are actually easy to remember pass-phrases, with some simple rules thrown in to increase entropy.
A few words in english, one word in a foreign language, and two different deliminators between the words is oftentimes a lot more entropy (a measurement for how many tries it would take on average to break a password) than an overly complicated word-to-leetspeak-with-some-special-characters or other "clever scheme" which may look like its secure, but is actually just hard to remember, while being very vulnerable to attacks.
Mig891 votesThat's why forheiialxh284857 is ok but forh Eiial xH284 857 is great. A couple spaces thrown in or special characters can make all the difference
Martensitic1 votesforh Eiial xH284 857
Absolutely, if you remember it.
Mig891 votesThe best thing to do is have all sorts of passwords like this saved in an encrypted excel file. Its really easy to do and it ensures everything is secure I rotate passwords in the spreadhseet so all my passwords are about that complex and when they need changed i still have them
Martensitic1 votesIf I remember correctly (and I am not sure that I do), excels encryption method does some truncating in the key generation, so there are "only" around 2^40 possible keys that can be calculated by using data available openly in the document.
Keys and Password are different things ... the password is used to generate the key, which is then used to encrypt/decrypt the data.
Its very hard to brute force the password of an encrypted excel file (if it is as strong PW). But not necessary. One can instead attack the key itself.
And that can be done pretty quickly. A modern CPU would have little trouble to calculate around 10^6 keys / sec and trying them, which means around 2 weeks to cover the keyspace. With a little code optimization and forking on a multicore processor, that goes down to a few days. With a strong GPU-server, it could be done in a few hours.
Not to mention that encrypted excel brings us right back to one of the problems I avoid like the plague: Security entrusted to proprietary software ^^
Mig891 votesthe point of it is having difficult passwords that you have stored locally. odds are a hacker isnt gonna break into your computer then try to hack your league account
Martensitic1 votesTrue, but what's good enough for my league account, certainly isn't good enough for my TAN codes, my bank account details, my email accounts (which connect me to other online services), my amazon account, my paypal account and my credit card information.
That's what I use password managers for.
I am not saying that Excel Encryption is a bad Idea. Its just not the right tool for the job.
Piltover Customs1 votesThey main thing for using special characters is that not all places allow you to use anything and everything. Same goes with spaces. As for capitalization wasn't there a post in the last couple years where some major corporation didn't differentiate between lower/upper case? So it made it a moot point to include that even when you thought you were being more secure?
And no it wouldn't surprise me to hear that there are "randomsmash" just as there are RNG books ;)
But I haven't had an account compromised in 17~ years of being online so I'm not too concerned about it to be honest.
Also as for people saying keeping passwords in an encrypted folder, that doesn't take that long to break. If your computer gets compromised now they have access to everything. The best way to keep a password safe is inside your head. Which can be a little confusing for some of the lengths/many websites but way less chance.
Mig891 votesI do the same thing with spaces added and some capitalized
ˉˉˉˉˉˉ1 votesWhat would you personally recommend to us "noobs?"
Martensitic2 votesFirst of all, you are not "noobs".
I understand that most people don't have a lot of knowledge in cyber security. And that's fine. I don't expect my physician to know how to fix my car, and I don't expect my companies human ressource manager to be able to pick a good side of beef for me at the butchers shop.
I think I made it abudantly clear what options people have to improve their online security.
Either memorize a multitude of strong passwords to give unique ones to all online services used (which is something that some people are actually able to do, same as some people can memorize and recall 20 or 30 telephone numbers at will without breaking a sweat)...
...or get, and learn how to use, a good password manager.
One can use open source software, which is usually free (as in: doesn't cost money) but most importantly, because the community has control over the code and independent parties can check it for anything fishy going on.
But open source comes with its own caveats, its usually not as user friendly and lacks the interface polishing that you find in commercial software. Also, sometimes the developer quits, and no one picks up after him, meaning if one is not careful, one could run into using an outdated (aka. insecure) piece of software.
And then there is the third option, which is what I did:** I wrote my own password manager**. However, I don't recommend doing that, unless you actually know quite a bit about programming and kryptography.
So there are the options. As to recommending specific programs, that is not a decision I can or want to make for others. You have internet access, and you are an independently thinking human being. That's all the tools you require to make your own choices.
But kudos for giving thought to the matter at all. Most people don't.
[slayer-jinx-wink]
ˉˉˉˉˉˉ1 votesThanks for the idea, I'm actually quite good at programming and general CS, I'll look into it. Thanks!
Martensitic2 votesGlad I could help :-)
One word of advice, If you actually want to write your own password manager, I recommend using an open source lib for the hashes, depending on what language you gonna use. Implementing a hash algorithm by yourself sounds fun, but there are lots of things one can do wrong, and either end up with something that's cryptographically insecure, or downright fails at the worst possible moment.
Have fun =)
ˉˉˉˉˉˉ1 votesAh, thank you for the warning bro!
ProtestantCaesar2 votesWhat's cloudbleed?
ComeVsMe1 votesgood
