Blizzard Sued over Battle.net Authentication


Recommended Posts

LOS ANGELES (CN) - Publishers of "World of Warcraft" and other blockbuster video games make millions by "deceptively and unfairly" charging customers for an after-sale security product to protect their private information from hackers, a class action claims in Federal Court.

Lead plaintiff Benjamin Bell sued Blizzard Entertainment, of Irvine, and its corporate parent, Santa Monica-based Activision Blizzard.

Bell seeks class damages for consumer fraud, unjust enrichment, negligence, breach of contract and bailment. He claims that the same security problem, and after-market fix, occurs in defendants' games "Starcraft" and "Diablo."

Bell claims that game players have to pay $6.40 for a product called the Authenticator to protect their private information from hackers.

Sales of Authenticators, which come as a physical product or download, have brought in $26 million, according to the complaint.

Bell claims that Activision and Blizzard require gamers to use online accounts at the Battle.net website, which collects and stores customers' private information.

Blizzard puts the onus on gamers to buy additional products or tighten security on their devices, rather than making customer accounts more secure, Bell claims.

"Defendants negligently, deliberately, and/or recklessly fail to ensure that adequate, reasonable procedures safeguard the private information stored on this website. As a result of these acts, the private information of plaintiffs and class members has been compromised and/or stolen since at least 2007," according to the 33-page complaint.

"Most recently, on or about May 19, 2012, reports proliferated that class members' Battle.net accounts had suffered a security breach ('hack') at the hands of unknown parties ('hackers'), and on or about August 4, 2012, hackers massively breached Battle.net's security and acquired the private information of all of defendants' customers in the United States, as well as the remainder of North America, Latin America, Australia, New Zealand, and Southeast Asia."

Though account details for millions of gamers were compromised or stolen, Bell says, neither Activision nor Blizzard took "the legally required steps to alert" gamers.

Bell seeks class damages and an injunction to bar the defendants from "tacking on" undisclosed costs after customers have bought games, and from requiring them to sign up for Battle.net accounts.

The class is represented by Hank Bates with Carney Williams Bates Pulliam & Bowman, of Little Rock, Ark.

Activision Blizzard did not immediately respond to an emailed request for comment.

http://www.courthousenews.com/2012/11/08/52109.htm

-----------------------------------------------------------------------------------------------------------------------------------------------------------

Lawsuit alleges Blizzard "deceptively and unfairly" charged players to secure their data.

Blizzard is being sued over the Battle.net authentication used in multiple games including Diablo III. A class action suit led by plaintiff Benjamin Bell is seeking damages for "consumer fraud, unjust enrichment, negligence, breach of contract and bailment," claiming that Blizzard is "deceptively and unfairly" charging some users to secure their data from hackers.

Bell is specifically referring to Blizzard?s $6.50 keychain authenticators, alleging that Blizzard has made $26 million by selling them. The suit accuses Blizzard of unfairly requiring users to use Battle.net and says the company has continued to ?negligently, deliberately, and/or recklessly fail to ensure that adequate, reasonable procedures safeguard the private information stored on this website.? Bell points to multiple hacking incidents -- including May?s Diablo III hacks -- as evidence that Blizzard failed to take "the legally required steps to alert" players.

Bell is seeking damages and an injunction to bar Blizzard from ?tacking on? costs after games have already been purchased. He also seeks to stop Blizzard from requiring players to sign up for a Battle.net account.

We reached out to Blizzard about the suit and a spokesperson sent IGN the following statement:

"This suit is without merit and filled with patently false information, and we will vigorously defend ourselves through the appropriate legal channels.

We want to reiterate that we take the security of our players? data very seriously, and we?re fully committed to defending our network infrastructure. We also recognize that the cyber-threat landscape is always evolving, and we?re constantly working to track the latest developments and make improvements to our defenses.

The suit?s claim that we didn?t properly notify players regarding the August 2012 security breach is not true. Not only did Blizzard act quickly to provide information to the public about the situation, we explained the actions we were taking and let players know how the incident affected them, including the fact that no names, credit card numbers, or other sensitive financial information was disclosed. You can read our letter to players and a comprehensive FAQ related to the situation on our website.

The suit also claims that the Battle.net Authenticator is required in order to maintain a minimal level of security on the player?s Battle.net account information that?s stored on Blizzard?s network systems. This claim is also completely untrue and apparently based on a misunderstanding of the Authenticator?s purpose. The Battle.net Authenticator is an optional tool that players can use to further protect their Battle.net accounts in the event that their login credentials are compromised outside of Blizzard?s network infrastructure. Available as a physical device or as a free app for iOS or Android devices, it offers players an added level of security against account-theft attempts that stem from sources such as phishing attacks, viruses packaged with seemingly harmless file downloads, and websites embedded with malicious code.

When a player attaches an Authenticator to his or her account, it means that logging in to Battle.net will require the use of a random code generated by the Authenticator in addition to the player?s login credentials. This helps our systems identify when it?s actually the player who is logging in and not someone who might have stolen the player?s credentials by means of one of the external theft measures mentioned above, or as a result of the player using the same account name and password on another website or service that was compromised. Considering that players are ultimately responsible for securing their own computers, and that the extra step required by the Authenticator is an added inconvenience during the log in process, we ultimately leave it up to the players to decide whether they want to add an Authenticator to their account. However, we always strongly encourage it, and we try to make it as easy as possible to do.

Many players have voiced strong approval for our security-related efforts. Blizzard deeply appreciates the outpouring of support it has received from its players related to the frivolous claims in this particular suit."

http://ca.ign.com/articles/2012/11/10/blizzard-sued-over-battlenet-authentication

Dumb. #1 It's optional and not mandatory. #2 It's a free app on smart phones. #3 You're not actually paying for a physical authenticator if you get one you're paying for the shipping. #4 Dumb.

  • Like 1

some people just don't get it.... Its a device to help the end user keep their password safe from forces OUTSIDE blizzards control.

side note: been playing for 6 years WITHOUT an authenticator and not once had my password compromised. For those without malwarebytes pro, yes, use an authenticator! ;)

some people just don't get it.... Its a device to help the end user keep their password safe from forces OUTSIDE blizzards control.

side note: been playing for 6 years WITHOUT an authenticator and not once had my password compromised. For those without malwarebytes pro, yes, use an authenticator! ;)

If you use more than one PC and/or move your laptop between two or more locations you pretty much need an authenticator or Blizzard will close your account for suspicious behavior or possibly having been hacked. Happened to both me and my GF several times now before we just added the authenticator to our smart phones, which is annoying since we both have secure passwords and this adds another annoying step to logon, granted you only need to really do it once per computer but still.

And you don't need malwarebytes to be secure, you just need common sense,

  • Like 2

If you use more than one PC and/or move your laptop between two or more locations you pretty much need an authenticator or Blizzard will close your account for suspicious behavior or possibly having been hacked.

Rubbish. Might happen to a small portion of people. I have D3 and/or SC2 and/or WoW on one machine at home, one at work for years, no issues at all, no software/hardware authenticators ever.

If you use more than one PC and/or move your laptop between two or more locations you pretty much need an authenticator or Blizzard will close your account for suspicious behavior or possibly having been hacked. Happened to both me and my GF several times now before we just added the authenticator to our smart phones, which is annoying since we both have secure passwords and this adds another annoying step to logon, granted you only need to really do it once per computer but still.

And you don't need malwarebytes to be secure, you just need common sense,

common sense comes in many many forms, some of which not everyone has, including you, and including me. I have 3 machines that i play wow on, not including my sons laptop so that makes 4. No log in issues.Maybe you are doing it wrong.

common sense comes in many many forms, some of which not everyone has, including you, and including me. I have 3 machines that i play wow on, not including my sons laptop so that makes 4. No log in issues.Maybe you are doing it wrong.

Nope, Blizzard even said it was because we moved our laptops and used multiple computers.

Sorry

common sense comes in many many forms, some of which not everyone has, including you, and including me. I have 3 machines that i play wow on, not including my sons laptop so that makes 4. No log in issues.Maybe you are doing it wrong.

If your using the same IP with the laptops you should not have any issues its when you change ips like myself because i use a VPN service. I have contacted blizzard twice about being locked out and the annoyance its caused me at having to change passwords for them to send two copy and pasted emails saying the same crap that its there for my added security to protect me against hackers and even then its taken five days per email to be responded too (probably because others are complaining).

As for the optional authenticator its overpriced and 9/10 cases just gathers dust its a waste of money and could be sent for users at a lower price.

"Free" smart phone app, another pointless thing that would just take up space on a phone that i dont use in fact right now it been off for a month and is sat on the table i see it as bloatware because i would never use it.

All in all i think blizzards "added" security is crap and a nuisance to those that use a vpn service as there is no way to add extra ips or to even turn it off if we wished to do so. Anyway im off for a full english.

It's almost a given that if you DON'T use an authenticator, your account WILL be compromised.

Blizzard is basically forcing their customers to pay because Blizzard's security is abysmal.

It's almost a given that if you DON'T use an authenticator, your account WILL be compromised.

Blizzard is basically forcing their customers to pay because Blizzard's security is abysmal.

umm no, that's BS. use a good password and you won't get hacked. neither me nor my girlfriend ever got hacked before we added our athenticators this summer.

It's almost a given that if you DON'T use an authenticator, your account WILL be compromised.

Blizzard is basically forcing their customers to pay because Blizzard's security is abysmal.

Nonsense, I played for six years and was never hacked. Use a proper password and some common sense. Certainly having an authenticator is a good idea, it's one more layer of security but saying you WILL get hacked without one is absurd. That said this lawsuit is ridiculous and should be thrown out.

if blizzard sells them for free and only charges shipping couldn't blizzard save a ton of money and time by shipping them en-masse to walmarts/target/etc to distribute for free to people who buy blizzard games?

No, because then people will complain that Blizzard didn't provide them with free transportation to pick them up from Walmart.

i was forced to use one by blizzard after my account was comprimised or they wouldnt reinstate my account, and hell it was thier fault my account was comprimised not mine

someone stealing your password because of your actions is their fault?

this suit is really stupid. they are claiming that they force people to buy something to guarantee security when they don't need to buy anything there are several free options and it is OPTIONAL additional security not mandatory. they are not suing saying that the servers not insecure they are suing about making money from the authenticators.

umm no, that's BS. use a good password and you won't get hacked. neither me nor my girlfriend ever got hacked before we added our athenticators this summer.

Nonsense, I played for six years and was never hacked. Use a proper password and some common sense. Certainly having an authenticator is a good idea, it's one more layer of security but saying you WILL get hacked without one is absurd. That said this lawsuit is ridiculous and should be thrown out.

Why pick a good password when you can pick a very strong and excellent one? Well, even if you do there's still a chance that your account can become compromised. Also, just because it hasn't happened to you in x amount of years doesn't mean that it can't happen to someone else in x amount of hours.

Case in point, I stopped playing WoW in December of 2010. In November of 2011, some Chinese farmer started running around on my toon. He was able to level my character to 85 and get a few achievements done before getting my account locked. So, my question was, how did someone just guess my password that contained a bunch of random upper and lower case letters, numbers, and symbols? It was a fairly new password that I only used for Battle.net. I did a deep system scan of OS X, and nothing turned up (note: nothing turned up in the years that I did scans.), and I make it a point to stay 100 miles away from UI addons, gold buying services, using the password for another service, or anything else under the Sun that could compromise one's account.

tl;dr, my **** is pretty locked down, but my account was still compromised.

Just two weeks ago, someone maliciously got into my Google account. However they managed to do it, (the password was even more random, longer, and stronger than my battle.net one) Google flagged it immediately and blocked them from accessing it, so now I use the two step verification.

I'm sorry, but the days of using just a good password and some common sense are long over. I don't even think that there were ever days doing only so was acceptable. Just because it hasn't happened to you yet doesn't mean that you're smart. It just means that you're lucky.

they don't need access to your computer to hack your WoW account, they could have hacked your gmail which you just said got hacked, they can do a man in the middle attack. they could have tricked you with one of the better versions of those scam emails they send out. there's any numbers of ways to do it and most of them is your fault not Blizzards.

Also I replied to a post that said, and I quote

It's almost a given that if you DON'T use an authenticator, your account WILL be compromised.

And lets face it, the majority of players don't get "hacked".

It's almost a given that if you DON'T use an authenticator, your account WILL be compromised.

Blizzard is basically forcing their customers to pay because Blizzard's security is abysmal.

This is pretty true. I had a secure password and stopped playing. About half a year later my account was hacked.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I notice how you dodged the questions I had about the racism shown by ignorant, gullible, cowardly people when the Poles, like your partner, were the immigrants. Ahem. I wonder how you'd feel if native born Brits suddenly treated you as "dirty crooked immigrant" for being half Trump-American? If they ordered you to leave and "go back to your corrupt country" (on the other side of the Atlantic), would you go? The truth is based on facts as supported by evidence. As requested in your previous posts, I have used the facts in your own post to show everyone the truth.
    • US citizens are paying to their government, who could use that to fund healthcare and tuition and relieve the costs of these for citizens instead of making tax breaks that overwhelmingly favor the rich. I'm not saying that tariffs are the correct solution, but what else would they be used for? What else could Trump have in mind for wanting them, if he hasn't figured out that labor costs are higher in the US?
    • I’m in need of a new chair and it sounds like the backrest cannot be locked? I also sat on a Herman miller and was devastated that it couldn’t be locked also, what is going on with chairs. I want to be able to lock the backrest into any position but not even the Herman’s do that
    • Sihoo Doro C300 Pro V2 Ergonomic Office Chair review: The Ikea of chairs by Steven Parker I've reviewed a few gaming chairs over the past three years or so and generally found them to score well in our reviews. SIHOO reached out asking if I was interested in taking a look at their flagship chair, the Doro C300 Pro V2. I never got the chance to check out its predecessor, but the V2 is described as an "Adaptive Ergonomic Chair." It became available to buy in April of this year. Let's get things rolling with a closer look at the specifications and features. Specifications Doro C300 Pro V2 Model Ergonomic Materials Mesh Back and Seat; Soft PU Coated Armrests Height adjustability 45.5 - 53 cm / 17.5" - 20.9" Seat (w+d) 52 x 43 - 47 cm / 20.5" x 16.9" - 18.5" (adjustable) Backrest 52 – 60 cm / 20.5" - 23.6" (adjustable) Lumbar support Mesh built-in (adjustable) Armrest adjustability 8D Bionic Armrests Rocking angle 105°, 120°, 135° (fixed) Neck support Mesh built-in (adjustable) Net weight 27.3 kg / 59.64 lbs Weight support 150 kg / 330 lbs Colors Black, White Warranty 5 years (upon registering) Price $499.99, $539.99 Introduction At first glance, it looks like a chair that in another life wants to be a Herman Miller; It certainly looks like my Aeron Remastered, but the Doro C300 Pro V2 has quite a few more features and costs quite a bit less. SIHOO says that it is made up of a "DynaCore" system that tracks your movement and synchronizes the headrest, backrest, lumbar support, and armrests as you shift, twist, or recline. They also say that the "SyncroFlex Backrest" molds to your spine, which kind of describes how the mesh fabric works in most ergonomic chairs, but anyway. Below are the meat and potatoes measurements for the chair. Here is the same tech sheet, but in inches. Durability I would be remiss to not talk about the various durability testing this chair underwent before coming to market, as this is claimed on the product page. First of all, the chair is BIFMA-, SGS-, and TÜV-certified. As for durability, the tests undergone were: 100,000 Castor cycles tested 120,000 Armrest cycles tested 120,000 Recline cycles tested 120,000 Gas lift cycles tested 60,000 Armrest durability cycles tested 120,000 Rotation cycles tested Nothing about weights testing, though. Now that's all disclosed, now onto my own personal findings. Assembly The Doro C300 Pro V2 came in two large boxes (1) (2), and everything was packed very well, protecting the different parts of the chair. In the box, there is a folded sheet that explains the 12 steps to assemble it; they are: Remove the bottom cover on the aluminum base; Insert the five legs into the aluminum base and use ten screws to fasten them; Insert the castors into the legs; Replace the bottom cover on the bottom of the aluminum base; Place the Class 4 Hydraulics gas cylinder into the aluminum base; Screw the bottom part of the arm rests, taking care of the orientation using two screws on each side; Use three torx screws to fasten the footrest to the bottom of the seat; Fasten the backrest to the seat using four torx bolts; Fasten the armrests to the backrest using four Torx bolts (two on each side), taking care to note the orientation; Place the chair onto the Class 4 Hydraulics gas cylinder; Insert the headrest into the top of the backrest; Use two torx screws to fasten the headrest to the backrest. There's also an online guide you can refer to. Carefully unpacking the two boxes took around 15 minutes because almost everything is wrapped in plastic and protective foam; the chair assembly itself took around an hour. I say in the above assembly steps to take note of the orientation, because it's not obvious which way around the bottom portion of the armrests go, and although there is an L and R on the bottom of the armrests, it also wasn't clear from the instructions which was actually left or right, facing the chair, or in the seated down orientation? Anyway, I ended up putting the bottom portions on the wrong sides, and after securing one of the armrests, I discovered that although it was on the correct side, the armrest base could rotate a full 360°, but not when bolted to the chair, so I had to remove it, rotate it, and then bolt it back on. Truly an Ikea experience! Also, to complicate things further, although all the parts are labeled from A to X (yes, that's 24 parts) unhelpfully, these letters do not appear on the parts themselves or the package with the bolts, screws, and washers. There's also a pair of protective gloves in the box, but I think they were made for much smaller hands than I have. Even my friend, who is 5.1, had difficulty putting them on. Once assembled, I needed to sit down. Anyway, as I said, it looks quite similar to my Herman Miller. And here is the back of it. If you look at the product page and on Amazon, it seems like a lot of thought has gone into the chair itself and what it's capable of, but there is no mention at all about the castors, and this is an area where I think the chair trips up quite quickly. I found it difficult to move the chair in any direction. I asked a friend who came to visit me earlier this week to test my findings, and she said that the wheels were "no good," so it definitely isn't just me. I am 6'2 myself and a big guy, I work from home and gained a few pounds from mostly staying in and the hell away from other people. However, the Doro C300 Pro V2 is rated for up to 150kg (330lbs), which in my case is used well within its max rating. Ergonomics The number of adjustments you can make, right up to setting it in nap mode — which I haven't fully tested yet — is what you'd expect from a premium chair. Yes, you can go up and down (max 7.5 cm adjustment), rock back and forth (with tilt adjustment), and lock the chair between three stages of 105°, 120°, 135°, which is not quite as flat as the AndaSeat I tested at 160°. Some thought has also gone into the "8D" armrests, too, which are cushioned but quite firm; you'll only know it if you press hard into the PU-covered tops, which give about half a centimeter, but it's enough to ensure your skin won't get awkwardly stuck to it in warmer (or sweatier) conditions. It almost feels like plastic and is very easy to keep clean. However, the armrest positions move far too easily, and I am not sure what that "elbow" function is. Maybe it is good for a short person with short arms, anyway, I never used it and kept it flat at all times. There are eight levels of adjustment for the armrests, they are: backwards, forwards, swing left/right, height up and down, tilt, and 360° rotation, which can be handy for desk clearance. As I said, the armrest pads shift far too easily, which could give off an ergonomic vibe, but who wants the armrest sliding when you are shifting weight? The height adjustability does lock into place when lifting and adjusting. Comfort This is ultimately what it boils down to at the end of the day, right? Quite a lot of reviews praise the comfort of this chair, and I don't disagree that the mesh seating is quite comfortable. I am used to the material from my daily Herman Miller. However, the backrest cannot be locked into place, and this is actually a feature; as you shift or recline yourself on the chair, the backrest moves with your body. It took some getting used to. The lumbar gives ample support, but I would have preferred an adjustable one built into the seat base, as this causes the backrest to move up and down at will. Again, as with my previous chair review, this chair is also rated for tall people, but nowhere in the product documentation does it say how tall. Being 6'2 myself, I'm happy to say that the backrest is tall and wide enough, and thought has been given to being able to adjust the neck rest, but as others have mentioned in their reviews, people as tall as 6.2ft is about the limit for the neckrest. Conclusion What I didn't like The footrest is rated for 15kg (33 lbs), which to me seems a bit light, and after looking online, it seems like a chair footrest for adults must be at least twice that rating. In all honesty, they are just hollow metal tubes, so it is not recommended to let a kid sit on them. I also feel like it doesn't really go out far enough for my height, so that kind of puts the dampener on me being able to use it regularly. I'll just have to continue to use my subwoofer as a footrest! I do not like the armrests being able to shift around as easily as they can, and they are a little too forward-positioned in the chair to comfortably sit close to my desk, because even in the lowest height position, they don't allow me to go under the desk like is possible with my Herman Miller. I also feel like this chair could have been delivered partially constructed, especially the armrests on the seat, and why the aluminum base wasn't already pre-constructed (without the castors) is baffling, considering it would have fit in one of the two boxes that way. The instructions also need to be clearer. On the pamphlet, there's an A to X listing (which is also used in the steps), but none of the physical parts use this lettering system! What I did like I'll be honest, I haven't used it for very long, just one week, and seating comfort is subjective after all! Any spills wiped straight off it, the stitching, and the lines look great, not a fray to be seen or stitch out of place. It looks kind of cool, too. My favorite feature of these seats is the nap mode. While you're not lying completely flat, it leans far back enough to make you easily doze off after a heavy gaming or working session. Overall, this chair offers plenty of comfort features. The MSRP does vary quite a bit depending on the region, at £549.99 in the UK, and €580 in Europe, and $599 before tax in the U.S. However, shipping is free, which is a bonus for such a heavy item. Is it worth it, though? At three years' warranty, I think it's a decent deal. Another firm out of Germany sent me a free replacement hydraulic gas spring for a chair that failed after almost four years, so it was well outside its two-year warranty. My advice is to always try, as you might have the same luck I did. If I could fault it at all, it would be the constant shifting of the armrests and backrest. Where to buy Although the footrest variant normally costs $539.99, it has been discounted to $469.99 on the official website in Black or White. In fact, the non-footrest variant is only $40 cheaper. On Amazon, it currently costs more at $499.99 links below. Sihoo Doro C300 Pro V2 for $469.99 (official website) Sihoo Doro C300 Pro V2 for $499.99 at Amazon US SIHOO provided a free sample without any review or pre-approval. Good to know This Amazon link is U.S. specific, and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
  • Recent Achievements

    • Conversation Starter
      jessse3334 earned a badge
      Conversation Starter
    • Reacting Well
      JuvenileDelinquent earned a badge
      Reacting Well
    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      506
    2. 2
      +Edouard
      207
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      73
    5. 5
      macoman
      62
  • Tell a friend

    Love Neowin? Tell a friend!