OFFICIAL NEWS


IMPORTANT – Please change your Ryzom password

Nixus (atys)
Damn, now I can't login to game. What a "smart" action to cause even more wreckage. Why can't you just allow me to enter and THEN ask to change password? Do you honestly think I remember mail I used to register few years ago? (not even sure if I will be able to remember password of this mailbox or that it exists).
You can still login to the billing account with your old password and change both your password and email there.
Nixus (atys)
On side note, if we speak about security! THIS FORUM does not even uses https. So what? Just some single connection over open wi-fi and it turns out you send your password over the air, well-visible to everyone. Don't you mind at least using HTTPS to make it a bit more secured?

Yep, HTTPS should be used (and forced) for the forum, but also for the API, the game login-system (yes, it uses HTTP), etc.
Nixus (atys)
Sure, HTTPS is crap but it is better than just shouting password in cleartext to open air, isn't it?!

No, HTTPS isn't crap. A properly configured HTTP server will protect the communication in a very effective way. The only "bad" thing about it is inherent to the X.509 certificates which have to be trusted by CAs (which is a problem) ; and DANE seems to be a good future solution to this CA issue.
Nixus (atys)
And bittymacod, his screen shows password cracker which has successfully recovered password. You see, DES uses 56-bit key so it can be brute-forced on modern GPU in foreseeable time, no matter what. Using DES in 2014? Makes no sense at all - DES can't protect anyone from anything these days. On other hand its quite slow.

Yes, hashcat recovered the 8 characters password in one minute.
Nixus (atys)
UPD: found way to change it w/o e-mail crap. On side note, you can't enter anyhow complex password: form only allows 8 chars and alphanumeric password. No even spaces. Ouch.

That's a problem from crypt(3) with DES: it considers only the first 8 bytes of the password.

---

Markanjio di Segafredo
Alkiane
Noble Gardien des Matis - Noble Matis Guardian
Fléau de l'Empire - Scourge of the Empire
Show topic
Last visit Friday, 29 March 12:04:28 UTC
P_:

powered by ryzom-api