Blizzard obviously knows about the hacking, so one would think they would be investigating possible exploits to see if they had any vulnerabilities. If the hacks were on their end I have to assume they're not so incompetent they have no way to discover where it originates from.
Blizzard's official stance is that the users are being compromised. Blizz themselves might be the ones who are compromised.
Actually a lot of banks/CC companies spend most of their money on post-hack solutions because it's cheaper/easier for them to fix the effects of the hack than to prevent it. The password sensitivity thing is disturbing however. That's so mind boggling stupid that I don't understand how that's true. They would have to go out of their way to make it like that. Have they commented on this directly? That makes me worry/rethink more than anything else I hear.
I imagine financial institutions are very proactive with their security. Vendors don't update their security only after an attack. They perform internal audits all the time. A lot of browsers and OS' are patched because a dev discovers a possible exploit.
That case-sensitivity thing freaked me out. I didn't believe it, I had to test it myself!
If they were so incompetent however, I would have expected this kind of thing to be an issue in WOW, whose accounts more often have CC information attached. How exactly do they get less proficient with security as time goes on?
Lots of coding, lots of coders. Someone made a mistake in D3 that isn't there in WoW. The WoW server and Diablo3 servers are running different versions of software possibly?
Besides, I thought this
was an issue in WoW, hence the authenticators. I don't remember UO needing authenticators.
This sounds like you're trying to hand wave the issue of authenticator protection away too easily. Unless you know the specifics of the server architecture, I don't think you can dismiss this so easily. I see no reason why it would run on a different server, that would be terribly cost-inefficient for a product I wager the majority of players don't use.
I think the authenticators work well.
The authenticator is made by Vasco. They more than likely provide the hardware. If not, then it's on a virtualised server. You need separate servers to handle the accounts, and to generate the auth keys. At the very least, people with authenticators are making a call to the authenticator software. There is most likely an exploit, and the exploit doesn't work when an account is tied to an authenticator.
All your other points I didn't respond to because they're reasonable points. I like my points better, but as you say, there is a lot a lot of speculation going around and no one outside of Blizz or the hackers know exactly what the issues truly are.
This meme has got to die. People break into bank accounts. Have you never heard of identity theft? Credit card theft?
Truth. And it's not as if people don't get arrested for hacking websites and other "small potatoes" targets.