[Release] UltimateWar - WarRock Private Server

*Last* · 09/03/2015, 10:13

Quote:

Originally Posted by ✔Star✔

Thanks for your feedback, it's on our list.
We will reply to the topic when we switched over to password encryption.

So they not done it yet...and i wonder when...
I don't think they know how make a phpkeygen for encrypt the actual passwords.

Cyno™ · 09/03/2015, 11:33

Quote:

Originally Posted by *Last*

So they not done it yet...and i wonder when...
I don't think they know how make a phpkeygen for encrypt the actual passwords.

phpkeygen? wtf.
The only thing they need to do is the generation of a random string (find on google in 5sec) and add 2 more database fields (hash,salt).
salt will be set to the random string and hash will be sha(sha(salt).sha(password)) for example.
Then the password validation needs to be changed to

$valid_user = sha(sha($db_row['salt']).sha($input_password)) == $db_row['hash'];

MRx86™ · 09/03/2015, 12:05

i can give NSA Encryption AKA AES 5012 with 5012 key encrypition very strong and strong est password.

*Last* · 09/03/2015, 12:20

Quote:

Originally Posted by Cyno™

phpkeygen? wtf.
The only thing they need to do is the generation of a random string (find on google in 5sec) and add 2 more database fields (hash,salt).
salt will be set to the random string and hash will be sha(sha(salt).sha(password)) for example.
Then the password validation needs to be changed to

$valid_user = sha(sha($db_row['salt']).sha($input_password)) == $db_row['hash'];

you stupid as ever, how you call a php that from a string generate a hash key? i call it keygen but you can call it how you like for do the big mouth.
These days kids...

MRx86™ · 09/03/2015, 12:28

Quote:

Originally Posted by Cyno™

phpkeygen? wtf.
The only thing they need to do is the generation of a random string (find on google in 5sec) and add 2 more database fields (hash,salt).
salt will be set to the random string and hash will be sha(sha(salt).sha(password)) for example.
Then the password validation needs to be changed to

$valid_user = sha(sha($db_row['salt']).sha($input_password)) == $db_row['hash'];

Hello Frankly ...
how are you long time didn't see you on battle. what happen ? where Kozboh ?

ToxicData · 09/03/2015, 14:52

Quote:

Originally Posted by GHTheBoss

Hello Frankly ...
how are you long time didn't see you on battle. what happen ? where Kozboh ?

He's with me, sexy time and stuff.

wa-sta · 09/03/2015, 19:42

Store password upon registration

PHP Code:


			
<?php
$password = "abc";
$secure_password = password_hash($password, PASSWORD_DEFAULT);

//store $secure_password in database
?>

Check password matching

PHP Code:


			
<?php
//check 
$password = "abc";

//retrieve password hash for user
$password_hash = '$2y$10$I/ZI7e0xB9F4DVbDH6mTBOH7kwdCxUZnxa4EE2E6Ng78zphjLAIRq';

if(password_verify($password, $password_hash))
{
   //password correct, user logged in
}

1 minute of work to have secure passwords. salting and crypting taken care of.

NP

*Last* · 09/03/2015, 22:09

Quote:

Originally Posted by wa-sta

Store password upon registration

PHP Code:

<?php $password = "abc"; $secure_password = password_hash($password, PASSWORD_DEFAULT); //store $secure_password in database ?>

Check password matching

PHP Code:

<?php //check $password = "abc"; //retrieve password hash for user $password_hash = '$2y$10$I/ZI7e0xB9F4DVbDH6mTBOH7kwdCxUZnxa4EE2E6Ng78zphjLAIRq'; if(password_verify($password, $password_hash)) { //password correct, user logged in }

1 minute of work to have secure passwords. salting and crypting taken care of.

NP

That code require a form or a edit for every account, better a one-go code.
Access to db with a loop for read every row and into the loop the hash the string and replace into db.

~~Crystalize™~~ · 09/03/2015, 23:48

Server offline?

toxiicdev · 09/03/2015, 23:56

Quote:

Originally Posted by *Last*

That code require a form or a edit for every account, better a one-go code.
Access to db with a loop for read every row and into the loop the hash the string and replace into db.

You may do hash = sha1(sha1($password) . sha1(sha1($username) . sha1($salt)));

*Last* · 09/04/2015, 00:49

Quote:

Originally Posted by toxiicdev

You may do hash = sha1(sha1($password) . sha1(sha1($username) . sha1($salt)));

if they cant do the simple code (that default in public files) u think they can add username in the hashing code (php+c#)?

Sleutel · 09/04/2015, 06:32

Quote:

Originally Posted by toxiicdev

You may do hash = sha1(sha1($password) . sha1(sha1($username) . sha1($salt)));

Don't over hash, the next code is good enougn.

Code:

sha1( sha1($password) . sha1($salt) )

Al tough I recommend using wa-sta's method since it uses bcrypt which is more secure then sha1.
Keep in mind that bcrypt generates a string of 60 characters, a salt is included so you don't have to worry about it. You can store this in your table under the column password without needing to add an extra salt column, just keep in mind that you put the size to at least 60 or else you might truncate date. It's recommended to use a size of 255 for future expansion (which is mentioned in the PHP documentation).

You can use bcrypt.net (found

) to validate it inside your emulator.

Enjoy, here is some free advice now do something with it.

toxiicdev · 09/04/2015, 12:16

Quote:
Originally Posted by Sleutel
Don't over hash, the next code is good enougn.
Code:
sha1( sha1($password) . sha1($salt) )
Al tough I recommend using wa-sta's method since it uses bcrypt which is more secure then sha1.
Keep in mind that bcrypt generates a string of 60 characters, a salt is included so you don't have to worry about it. You can store this in your table under the column password without needing to add an extra salt column, just keep in mind that you put the size to at least 60 or else you might truncate date. It's recommended to use a size of 255 for future expansion (which is mentioned in the PHP documentation).

You can use bcrypt.net (found ) to validate it inside your emulator.

Enjoy, here is some free advice now do something with it.

Not overcrypted though, but creating an own way will sure be more safe than use a generic one, so if your database might be broken, well, if don't use generic way it will be very impossible to descramble the password

*Last* · 09/04/2015, 13:21

Quote:

Originally Posted by toxiicdev

Not overcrypted though, but creating an own way will sure be more safe than use a generic one, so if your database might be broken, well, if don't use generic way it will be very impossible to descramble the password

But also kept in mind that this is not a NASA project...who will spend months/years for decrypt a password? (except for the lifeless cyno)

~~Fliegex3~~ · 09/04/2015, 15:17

To the spammer here.
Can you prefer mutually your Wall spot than this issue?
It's all just spam.
You go a really nerve-sparing on the ..

Quote:

Originally Posted by Crystalize™

Server offline?

No, Online. Im playing it to