Thanks everyone for participation.
We are very aware about the potential security issues this (same login/password for game and forum) could lead to.
At first, we would like to inform you, that this forum is constantly being modded by us. We had to rewrite the authorization module here in order to get it connected with authorization module of the game (it is a complex system).
Second, we don't store or transmit any passwords in plan text, so there is no way to retrieve it.
Even I don't have ability to change the password for anyone else except myself via forum software, and the Administrator's account is restricted from accessing the forum only from the internal network, where the web server is physically located.
Fifth shared some good info:
Now the password changing procedure. What exactly happens when passwords are changed?
If you change your password yourself, your old password is asked first, encrypted, sent to the server which will compare this hash with the hash stored in it's database. If this operation succeeds the old password hash is overwritten with the new password hash. Nowhere in the whole process is the encrypted password decrypted into human-readable form.
If it is administrator who changes your password for you, the administrator password has to be entered first, all the rest is the same. It's the administrators responsibility to have a good, safe password on his account.
You can read more about
password hashing and
salt by following links (wikipedia).
Next... the database itself is split into "parts", so there are no chances that gaining access to one section will give you ability to get to others. The access to the databases is restricted by some complex rules, and to get full access to the database is possible only from the devs' office (where servers are physically located).
Now, about integration of the
2 factor authentication or other ways (getting additional pin-code via SMS, like in Google)...
We would love to implement it, but we don't have funds for this atm.
In a close future we will implement additional protection like "lock to IP" and "lock to computer", so you will need to do more steps in order to authenticate yourself if you try to login not from your "home computer".
As of using open-source forum software... There are no 100%-secure forum software. We have chosen SMF over others because it is easier to change the authentication mechanism and integrate it with the game database.
We continue working on it by extending its functionality and improving the security. We have already changed internals on how the login/password are parsed, and will do even more on that topic.
Thanks again for sharing your ideas and thoughts, keep it coming. We are watching the discussion very close.
Show Posts