[RELEASE] Register Page with password backup

C0D3R4ID3R · 09/01/2010, 00:45

Today im going to release a helpful tool i made some time ago

Now this release is a basic reg page "Without Captcha" that has an extra query to a second account table. If you have modified your register page or use captcha just use this as a guide and add in the new table and the 2nd mysql query.
Below is the queries from the reg page and i will show you the extra section

mysql_query("insert into account (name,Password,Reg_date) values ('".$userid."','".$hash."','".date("y-m-d H:i:s", time())."')");
mysql_query("insert into account_log (name,Password,Reg_date) values ('".$userid."','".$password."','".date("y-m-d H:i:s", time())."')");

now in red is the standard script that adds a password hash to the main account table
in the green is the password backup script wich sends a plain text password to the 2nd account table.

Instructions for use:
1. Backup your MYSQL and Web
2.Open Navicat and paste the create table query from the account_log(ReadMe).txt
3.Copy the register page to your pages folder and link it to your site(please check your own reg page first before replacing you may have more features this is only a basic page)
4. Register a character as normal and check the account_log table to see your unencrypted password

Note this is intended for the use of server owners not Password theft

Hope this will be handy

~~~Sword~Stalker~[PM]~~ · 09/01/2010, 01:25

hmm dude nice try but u didnt explain anything

u can check my post about that

2- that post was made more than 10 times until now ,,,,

C0D3R4ID3R · 09/01/2010, 04:50

id like to see where i said it was a guide? it doesnt get much simpler than this either $hash or $password!

and maybe people have talked about how to do it but there isnt any releases i could find. And i didnt release it to act cool or be better than others so if this was no use 2 you why put on it ?!?!

No wonder EO dev on this forum is dieing you cant even help without people putting on you

DEADP00L · 09/01/2010, 05:07

ok time to clear this up

#1 A register pages has been released before. NOT this register page. this register pages offers a few features that the orginal one released dont. Plan and simple this is not a repost.

@coder nice release just watch the language bud.

PowerChaos · 09/01/2010, 05:20

Quote:

Originally Posted by C0D3R4ID3R

id like to see where i said it was a guide? it doesnt get much simpler than this either $hash or $password!

and maybe people have talked about how to do it but there isnt any releases i could find. And i didnt release it to act cool or be better than others so if this was no use 2 you why put on it ?!?!

No wonder EO dev on this forum is dieing you cant even help without people putting on you

its a nice modification to the register script
but i dont like it for a few reasons

why giving the users a option to steal passwords ??
why does the md5 hash secure it now if you just store all passwords in plain text ??

it doesnt feel right to do it this way (maybe thats whhy it was never released this way ??)

anyway , its just personal and other persones can think the same over it as me and others thinks differend over it as me

but for me it doesnt looks good , if you see forums , there passwords are secured , the forgot password just generate a new password in md5 because of the security

if it got a safe option does it seems useless for me to release a unsecure version

if you want to have a challenge (and a lot of persones would like it ) then it would be nice to release a pass reset option (forgot password , linked to email and security question ) so it genererate a new md5 secured password on the old place and emails it

but thats up to you
anyway , Thanks for the nice release

Greetings From PowerChaos

King_Arthur · 09/01/2010, 05:30

As I see it, there is no reason to store a reverse-able password as an owner. Why send the current password in plaintext over email when you can set it to a new password and have the user change it to something they can try to remember.

As easily as databases get leaked in this scene, an owner would be doing a great disservice to his userbase if he stores passwords in plaintext. At the very least do a little encryption.

However, I would be lying if a said this would actually shy away a lot of players, as the people who actually think about how their passwords are being stored on private server's aren't the ones using their msn/bank/paypal/computer/work passwords for games...

PowerChaos · 09/01/2010, 05:54

a human is a strange persone

if you are like me , i played about 35+ games online
if i need to use a differend password for every game i play ?? a differend login name for every game i play ?? and a differend email ?? then i am keeping a big notepad in my pocket to remember everything

so i just do it easy and everyhting the same (not 100% ^^)

but for private games i use differend passwords/usernames , as i know that they are not that good and secure as normal games (co is non encrypted in case of intrest)

but for the official games , why would i care about that , they dont even care about me so they wont care about my password and my other 'value' games eather

thats the difference betwean a company and a private server ofcourse

but if you play a lot of private servers, do you going change your pass every private server ??
you will use the same password to

and the best question of all
you know how humans are , you know how the most persones on this forum are (whats a search button) so you can definaly guess how mutch problems it can give and what profit you can make from it ( 65% will suceed )

anyway , i still hate this system and i still dont care about it eather , i dont play private games anymore (basicly no games anymore) so its good for the other users that they know that they need to watch out

Greetings From PowerChaos

Eurion · 09/01/2010, 06:03

Quote:

Originally Posted by The Crasher

but if you play a lot of private servers, do you going change your pass every private server ??
you will use the same password to

Greetings From PowerChaos

Yes sir, Every private server I play, I use a different password. It helps me keep my mind thinking I am safe.

To the original Poster,

Nice release, but I would suggest staying away from a plain text password, if your database is ever leaked, your players are screwed. You can always use a custom salted password that can be reversed if you know the correct salt's.

Or if you're worried about them losing their passwords, Just set up a forgotten password script that emails them a random password.

C0D3R4ID3R · 09/01/2010, 09:23

i only gave it out cos i have seen many people asking the same old "can we reverse a hash" question, also sorry deadpool 4 the bad language and before i leave this forum i wanna say thanks to all the people that i have learnt from over the last 3 years with your releases, guides and helpfull info

bye....

ljstewart · 09/03/2010, 20:42

that the passwords should be kept safe, and with a table like that on your db you would have to limit the access more than normal, just a worry for security...better if we had a way for the ppl to reset their own pass. We all know that if you have db access you have no need for the original owners pass anyway....

.Ash · 09/03/2010, 23:34

I think its a invasion of privacy, But eh... Woot for Con men?