Page 1 of 1
Suppress display of password to administrator
Posted: Mon Oct 10, 2011 11:17 pm
by dcx135
For the players' privacy and security purposes, it would be good to suppress the display of their chosen password in the PM-Server (right now, it shows it as clear text). Since users have can reset their passwords when necessary, there's really no reason to show it to the administrator. Since many people tend to use the same passwords, it's just an unnecessary security risk.
Re: Suppress display of password to administrator
Posted: Mon Oct 10, 2011 11:48 pm
by Kent Briggs
dcx135 wrote:For the players' privacy and security purposes, it would be good to suppress the display of their chosen password
In the next major version, no passwords will be saved at all on the server. All security will be performed with one-way hashes.
Re: Suppress display of password to administrator
Posted: Tue Oct 11, 2011 4:01 pm
by Ozzy1969
Kent wrote ;
In the next major version, no passwords will be saved at all on the server. All security will be performed with one-way hashes.
does this mean players cant recover password?
Re: Suppress display of password to administrator
Posted: Tue Oct 11, 2011 4:17 pm
by Kent Briggs
Ozzy1969 wrote:
does this mean players cant recover password?
Yes, but I'll come up with some kind of password reset feature instead. Instead of emailing the password, the system could email a security code and the player could enter that code along with a new password in the client. Something like that.