@valrog: I've seen some VERY convincing phishing emails that would have fooled about 50% of people regarding my b.net account. To the point that the only tip-off it wasn't legit was it came to an email not associated with my account. There are many ways "hackers" get your login info though, it doesn't have to be you blindly entering your password on a direct phishing scam. Keyloggers are still very common, and some may be "in the wild" for a few days before AV software picks them up, and you might get one of these from something as innocuous as downloading a mod for wow, clicking on an email with a poorly secured email client etc.
More importantly, people are pretty much idiots when it comes to password security. Using the same login info across multiple sites, forums, and accounts is very very common, though almost no one wants to admit to it. If you use the same login info on a random D3 forum, they know you have D3, and if that forum has mediocre security (lets face it, these places aren't paying a ton for securing their free BBS), its only a matter of time before someone gets their hands on your info. Password guessing schemes are much more efficient at weeding out shitty passwords than most people think. There are very complex algorithms and very sophisticated methods of generating a probable list of passwords that is much much smaller than guessing every random ascii possibility in a given range. Building strong passwords without references to real names, places, or even any real words helps keep you more secure, but no password is invincible.
The real thing to remember is there is real, nearly untraceable money being made off this scheme. No one is going to sue for lost D3 shit(value of maybe 15 bucks per account?), and if they did finding who to go after is basically impossible. Bank passwords, credit account info etc is all trackable and leaves a money trail and eventually they get busted, and even that can take a very very long time. With video game gold, they get in, steal the stuff, sell the gold, and get out. By the time anything is done they've sold your gold to a third party (thank the gold buyers for making this lucrative) and have their money, blizz shuts down the account, they make a tidy profit. *If* blizzard decides to take away the purchased gold from the third party they can file a credit card dispute, which may or may not work, that's the only risk in the whole plan. Any time there's real money involved in something, someone somewhere is going to find a way to get the most profit in the least time, and that includes password theft and stealing virtual items. There's plenty of money in that industry to make the time spent finding the passwords weeelllll worth it for many people around the world.
All this can be avoided with a physical authenticator (which has been confirmed blizzard is selling those items *at cost*, manufacturer says they should be about 30 bucks retail) for 7 bucks. Alternatively like this guy, smart phone authenticator is 100% free, and works very well, and either one will stop virtually ALL compromised password type "hacks".
Log in to comment