HEROsMod icon indicating copy to clipboard operation
HEROsMod copied to clipboard

Passwords are saved in plaintext

Open DaedalusGame opened this issue 7 years ago • 0 comments

I just looked at my modloader folder to figure out what mod makes teleporters unplaceable in multiplayer and I just looked at the database json of this mod to see if there's something useful in there and I see that passwords are saved in plaintext. While we can argue that most people run private servers, since this mod requires you to login by applying a frozen debuff if you aren't logged this file can be used to read the passwords of any person that has connected to a server. This is generally bad because people will reuse passwords. Could you possibly look into saving and checking the password as a hash (with or w/o salt)? There's plenty of resources online how to do it properly, but I generally link this one even though it applies mostly to webdev but should be analog in C#.

DaedalusGame avatar Jul 05 '18 11:07 DaedalusGame