Mojang Reveals How Minecraft Passwords Were Stolen
Minecraft developer Mojang revealed on Wednesday how the usernames and passwords of 1,800 accounts were recently stolen. The studio reassured gamers that it wasn't hacked and instead blamed the theft on a phishing attack. Essentially, these Minecraft gamers were tricked into providing their usernames and passwords when directed to fake Mojang/Minecraft websites.
"If you haven't received an email from us, you don't need to worry. No one has gained access to the Mojang mainframe," Mojang reported. "Even if they did, we store your passwords in a super encrypted format. Honestly, you don't need to panic."
Mojang didn't go into detail about the phishing attack, but instead requested that Minecraft players use a unique password when logging into their account. That way, if Mojang does get hacked in the future, the crooks won't have access to other online accounts used by Minecraft gamers such as email and banking.
Microsoft, which purchased Mojang for $2.5 billion back in September 2014, indicated on Wednesday that there was no sign of foul play on the server side. However, the company admitted that it quickly reset the passwords of the affected Minecraft accounts after the published list of account info surfaced.
Mojang and Microsoft provided instructions on how to create a great password right here, noting that a good password should be easy to remember but difficult for hackers. Avoid using obvious phrases like a pet's name or a birthday. Passwords should also not only include a long line of numbers and letters, but at least one capital letter.
"You need to pick a really strong password, something that not even the most powerful computer can crack within a reasonable amount of time," Mojang stated.
Follow Kevin Parrish @exfileme. Follow us @tomshardware, on Facebook and on Google+.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
-
canadianvice You could stand to read the article - it was a phishing attack.Reply
Stupid people being duped into giving up passwords to illegitimate sites.
No pity for them. -
agnickolov Hashing is a one-way transformation - there's no way to obtain the password from the hash alone other than guessing. Therefore it's actually more secure than encrypting and storing the password. Doing both, e.g. encrypting the hashes is obviously better than either one in isolation of course. Then there's also salting that additionally improves security by pre- or appending text before hashing and/or encryption.Reply -
Kelthar I'm pretty sure they know how to hash passwords with a salt. The communication they put out had a low level of tech involved, getting into details of how passwords were stored/checked seemed unnecessary, at least as I see it.Reply
But I'm pretty sure Mojang knows that they're supposed to use a hash, and a unique salt for each password. -
Christopher1 You could stand to read the article - it was a phishing attack.
With all due respect, phishers are getting VERY VERY good at obfuscating the fact that you are not on the actual legitimate website of the game maker.
Stupid people being duped into giving up passwords to illegitimate sites.
No pity for them.
Sure if you look at the urlbar in your browser, you might see that instead of mojang.com it is going to steal-your-password.kr but many people just click on links in e-mails and do not bother to do that.
-
canadianvice 15144222 said:You could stand to read the article - it was a phishing attack.
With all due respect, phishers are getting VERY VERY good at obfuscating the fact that you are not on the actual legitimate website of the game maker.
Stupid people being duped into giving up passwords to illegitimate sites.
No pity for them.
Sure if you look at the urlbar in your browser, you might see that instead of mojang.com it is going to steal-your-password.kr but many people just click on links in e-mails and do not bother to do that.
Then they should be checking that. People shouldn't own what they can't use properly. The only way phishing works is because of stupid, lazy people.