Use Argon2ID as the password hashing algorithm #26

WildEgo · 2024-06-01T12:44:27+03:00

WildEgo commented

2024-06-01 12:44:27 +03:00

No description provided.

WildEgo added 3 commits 2024-06-01 12:44:28 +03:00

21e028f186 Merge pull request 'nightly' (#1 ) from metin2/server:nightly into master

Reviewed-on: WildEgo/server#1

ae708d9315 Merge pull request 'nightly' (#2 ) from metin2/server:nightly into master

Reviewed-on: WildEgo/server#2

65a81ec4a1 change: Ignore build files, replace mysql password with Argon2.

add: Missing .gitignore.

Exynox commented

2024-06-01 13:03:38 +03:00

Hi, thanks for the PR! I was going to use Bcrypt, but I did some reading and this seems a better technical solution at first glance. I'll check it out!

WildEgo commented

2024-06-01 14:20:31 +03:00

Hi, thanks for the PR! I was going to use Bcrypt, but I did some reading and this seems a better technical solution at first glance. I'll check it out!

Argon2ID is super nice and super balanced, also works with Laravel with just a change from what I remember which is nice, as well as anything recent, if you need a password this should work for you $argon2id$v=19$m=16,t=2,p=1$MTIzNDU2Nzg$Dhk8fwnes+f9vzOwgdALlA <- That's password, also had some issues setting up the server after the update but I got around it (locale changes)

> Hi, thanks for the PR! I was going to use Bcrypt, but I did some reading and this seems a better technical solution at first glance. I'll check it out! Argon2ID is super nice and super balanced, also works with Laravel with just a change from what I remember which is nice, as well as anything recent, if you need a password this should work for you `$argon2id$v=19$m=16,t=2,p=1$MTIzNDU2Nzg$Dhk8fwnes+f9vzOwgdALlA` <- That's `password`, also had some issues setting up the server after the update but I got around it (locale changes)

Exynox merged commit 8ed1e7879e into nightly

2024-06-01 14:32:22 +03:00

Exynox referenced this issue from a commit

2024-06-01 14:32:22 +03:00

Merge pull request 'Use Argon2ID as the password hashing algorithm' (#26) from WildEgo/server:master into nightly

Exynox commented

2024-06-01 14:38:29 +03:00

Yeah, sorry for the undocumented locale changes!

I've merged your request and I also did some changes, mainly the password doesn't get passed around to the database, and the fact that the game would yield different results messages for a "account not found" and a "wrong password" status, which doesn't sit right with good security practices.

Make sure to update the client as well.

Yeah, sorry for the undocumented locale changes! I've merged your request and I also did some changes, mainly the password doesn't get passed around to the database, and the fact that the game would yield different results messages for a "account not found" and a "wrong password" status, which doesn't sit right with good security practices. Make sure to update the client as well.

WildEgo commented

2024-06-01 14:40:36 +03:00

Yeah, sorry for the undocumented locale changes!

I've merged your request and I also did some changes, mainly the password doesn't get passed around to the database, and the fact that the game would yield different results messages for a "account not found" and a "wrong password" status, which doesn't sit right with good security practices.

Make sure to update the client as well.

No worries mate, anything I do on the server side or client side is more "proof of concept" then anything since I'm not familiar with cpp in the least so I just puzzle logic together, any improvements to what I do are appreciated.

Any stuff you'd want added or modified that I can play around with?

> Yeah, sorry for the undocumented locale changes! > > I've merged your request and I also did some changes, mainly the password doesn't get passed around to the database, and the fact that the game would yield different results messages for a "account not found" and a "wrong password" status, which doesn't sit right with good security practices. > > Make sure to update the client as well. No worries mate, anything I do on the server side or client side is more "proof of concept" then anything since I'm not familiar with cpp in the least so I just puzzle logic together, any improvements to what I do are appreciated. Any stuff you'd want added or modified that I can play around with?

Sign in to join this conversation.

No reviewers