SimpleLogin
SimpleLogin copied to clipboard
SeraphJACK
suggestion for improving password security
when user creates a new password, store it as a hash. when user tries to connect to a server, hash the hashed password again and send that double hash to the server.
SimpleLogin is already doing exactly what you are asking. Not only that, SimpleLogin also utilizes a computational expensive hash function called Bcrypt with random salt to further ensure password security.
Sorry I didn't noticed that you are referring to the client-side storage.
I'm considering that it might be a inconvenience for players who forgot their password and want to view it again.
Also, I'm expecting that most users would choose a randomly generated password, in which case it doesn't really matter whether it's the plain text that is leaked or the client-side hashed one.
I modified your script so everytime you open the client, it delete's the .sl_password from the root directory, Encryption would be usefull, i also updated it to 1.19.4 so if you have a address to send the package im happy to send it to you, im new to github but not to programming.
Maybe using system keychain would be a better choice? (KeyChain, KWallet, ...)
