LBPUnion
True Authentication for Users
It was described to me that there is no way to verify the authenticity of a login ticket.
I don't know about you but that uhh...sounds bad.
Some ideas I've heard on Discord,
- PSN users can add a code to their profile About Me that can be used to verify themselves.
- RPCN users can add a specific user.
- in-game CAPTCHA implemented through photos or within a level.
- 'Codex' method in game. Level generates a code, Lighthouse website let's you punch the code in. If it requires the client console to post to the server directly instead of from the website, use logic to punch another code back in on the PS3 that sends an encrypted score number and ends the level. Score is posted to the server and the server determines if it passes the security challenge.
Another note: methods should not be machine readable. Direct over HTTP information can be read by bots.
Any other ideas?
- Ask RPCN devs to provide additional API support for RPCN (suggested by @TorutheRedFox )
maybe working with rpcn developers to create an api for validating the tickets against a specific rpcn instance for rpcs3
maybe working with rpcn developers to create an api for validating the tickets against a specific rpcn instance for rpcs3
A viable option I'll add to the list, although I find it unlikely that RPCN devs will do that. I'd rather not rely on them if we can help it, but you are correct that is something we should consider
it'll in general help with many servers because a lot of games rely on the server knowing who your friends are to be able to send multiplayer invites
You're already edit the eboot, so why edit the login URL as /login?device_setup_password=blahblahblah. Sony already does with PSN accounts on the latest PS3 update.
You would be leaking your login information over HTTP. Even if the server was HTTPS the value in the url is still plaintext.
You would be leaking your login information over HTTP. Even if the server was HTTPS the value in the url is still plaintext.
HTTPS encrypts URIs though? but yeah using HTTP can leak it
You would be leaking your login information over HTTP. Even if the server was HTTPS the value in the url is still plaintext.
HTTPS encrypts URIs though? but yeah using HTTP can leak it
Yeah ur right about https, not a good idea regardless though.