BE CAREFUL - DO NOT PLAY NOSFLOW!

[Tbp123]

Basically, NosFlow is a server, where his owner has the same nickname, and he is trying to decrypt passwords from his own database (and another one that he has) and steal items on vendetta or maybe in official too.

CHANGE YOUR PASSWORD IN VENDETTA AND OFFICIAL NOSTALE!

Proof:


TRANSLATION:

"Don't worry, I have 1,500 accounts from NosArmy" (an already dead server tho)

"I took the archive that was posted in epvp, there are passwords that cannot be decrypted and I have to use other programs, not only with the online decrypter" (basically he doesn't know nothing about decrypting and is an ******* without brain)

[AnimuNazi]

Kindly post the archive, " for research purposes". :P

[NT Z0ltar]

It is not possible to decrypt the passwords, because they are not encrypted, they use an hashing algorithm (Sha-512 for NosTale), so if he doesn't have clear passwords, he can't "decrypt" them.

[Tbp123]

Originally Posted by NT Z0ltar

It is not possible to decrypt the passwords, because they are not encrypted, they use an hashing algorithm (Sha-512 for NosTale), so if he doesn't have clear passwords, he can't "decrypt" them.

I know they use SHA512, but some of these passwords are kinda common and decryptable, I tried with some

[0Lucifer0]

Originally Posted by NT Z0ltar

It is not possible to decrypt the passwords, because they are not encrypted, they use an hashing algorithm (Sha-512 for NosTale), so if he doesn't have clear passwords, he can't "decrypt" them.

Unfortunately the client send them to the worldserver in plaintext iirc the only sha512 hashing is done for login server >< or maybe they fixed it since.

Edit:if (account.Password.Equals(EncryptionHelper.Sha512(p acket.Password), StringComparison.OrdinalIgnoreCase)) I confirm the Packet with password for world connexion is in plaintext

[Blowa]

Simply by adding a new column which will be filled at registration without an hashed password.

Anyway, if a server owner does not mean about its userbase security, it's true that people should not play there .

[NT Z0ltar]

Originally Posted by 0Lucifer0

Unfortunately the client send them to the worldserver in plaintext iirc the only sha512 hashing is done for login server >< or maybe they fixed it since.

Edit:if (account.Password.Equals(EncryptionHelper.Sha512(p acket.Password), StringComparison.OrdinalIgnoreCase)) I confirm the Packet with password for world connexion is in plaintext

Yes so if you know the password hash of an account, you can see the channel list without know the real password

[ThaRielFliege]

Metin2 Account.sqls + SentryMBA with Config for Nostale = Enough Accounts on the official servers

Just dont use the same id and password and you are fine.