26F-Studio / 26F-Studio/Techmino

More secure server communication

Open
#246 21 comments 0 reactions 2 assignees View on GitHub

@MrZ626 is already working on this.

Since Sep 15, 2021.

enhancement hang on multiplatform REMAKE
Dominant language
Lua
Stars
899
Forks
88
PR merge metrics
No merged PRs in 30d

Description

[tl;dr: don't store or send passwords in plain text, instead use a salted hash; use SHA2 and not MD4/MD5; use secure connection for server communication; add 2-factor authentication (unless if you want to use OAuth, which is also another pretty good way for accounts)]

Currently, the game remembers your account by storing it in a file that has the email and password of your Techmino account in plain text. This is extremely insecure, because hackers can easily take over your entire account just by grabbing the file, and if you use the same password for everything, then they can take over everything you own on the Internet.
Youtube: How not to store passwords (shortened: only store a salted hash of the password, or use OAuth to log in. Use SHA and not MD4/MD5.)

Secondly, I've noticed the game sends the email and password to the server in plain text. This is also another security flaw. Either use a secure/encrypted connection (HTTPS), or send it as a salted hash, or more preferably, both.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.