Quote:
To prevent any passwords stolen
Just do this
Save just a hash of the password into the database, not the real password.
So:
1) if the user enters the right password, the hash will be checked and if it is OK it's success
2) if the user enters wrong password, the hash will be checked and it will be not OK
3) if user forgets their password, they can't get it from the database because it's not there, so they will have to choose a new one via email
Advantage:
the password cannot be simply stolen because it's not there.
That's password hashing.
The password can be brute-forced from the hash, checking all passwords with that hash, but that might take some time. So there is still the rule that a more complicated password will take longer time to obtain.
Also the hash function must be a function that is not predictable from the password or from a part of the password (a.k.a. the output of the hash function is random)
Anyways I believe battlemaster does this so whats the debate here lol
Yeah i mean everyone that needs to know that + wants to make something solid probably knows that. I did not mean anything bad here i just appreciated that one guy that mentioned that players should not use the same passwords for multiple Servers. Thats probably how some people ripped their Accounts on PinkGalaxy. As you can probably guess there are some very sketchy Servers out there which probably saves passwords plain. :D