Quote:
Originally Posted by AngryUnibrow
Actually, alot of servers store their passwords as encrypted text.
|
Plaintext, encryption... that's all bad. Server owners should hash the passwords of their users. Some commonly used hash algorithms are SHA1 and Whirlpool (
plugin by ******), although I would suggest the latter because although SHA1 is not fully crackable with easy tools, some vulnerabilities still have been found. Hashed input cannot be reversed unless the hash is somehow vulnerable and the cracker has serious firepower in their computing machine! Some people claim that this is not necessary as they don't have the intention of using these passwords, but beware, there might be bad guys interested in exploiting them. The more popular your server and the more registered accounts it has, the more wanted it becomes by scriptkiddies. And oh god, if you also store e-mail addresses, these guys are like bees who have found a honeypot! I can bring an example from my personal experience with an official server from 2008 (that I was somehow involved with, but no, it was not DFSFv3 or Mini-Missions, I was lower level there) which had passwords stored in plaintext. A few months later some crisis started in SA-MP, I was confronted by a kid through Xfire, saying that he had a password that I used.
Another thing is "censoring" log files. I'm quite sure that if your script is large enough, you want to keep track of what's going on easily. So you most likely have inbuilt debugging that you can enable prior to compiling (personally, I have more than 30 of these "toggles" in my mode). And surely, something controls the debugging of command input and MySQL queries. Hackers might stumble on something in your logs, i.e.
Code:
[17:41:55] [command] Andre(96): /register toomuchmoneyinthebankaccount
[17:41:55] [query] INSERT INTO players (name,pass,ip) VALUES ('Andre',SHA1('toomuchmoneyinthebankaccount'),'127.0.0.1')
And oops, someone might get their hands on this data. And someone willing to go this deep into finding out your passwords is most likely not a random person. So this is why passwords should not even be printed in such scenarios. I also have fallen for this once when my server averaged 200 players, though luckily the passwords of only a few players were readable.
Sometimes when joining other servers to lurk for ideas or just have fun, I use passwords that are not only funny, but I also cannot remember them in the future. So try signing up with a password like "thefuckyoulookinatbro" and try to guess the look on the bad guy's face when they see that!
Edit
Encoding and encrypting are easily reversible! Hashing is what you guys mean and what's needed.
The topic will die and eventually get deleted as nothing will happen but bullshit stories coming from matrix and his clan, an old tradition.
