Big security flaw

mikelolsuperman · 2019-05-03 18:03:01

I have some problems with my pc outside of ee so I had to change around some stuf and I got logged out from ee. When I went to log back in I typed my password but instead of pressing the Shift key I pressed caps lock and my entire password had uppercase and lowercase letters swapped. The problem is, ee didn't tell me it was a wrong password, so it's easier (while still hard) to guess someone's password since you don't have 62 characters for each digit (a-z, A-Z and 0-9) but only 36 (a-z and 0-9). I noticed caps lock was on when I typed uppercase without getting near the shift or caps lock key, so I couldn't have possibly turned it on after I typed my password.

Tomahawk · 2019-05-03 18:10:38

Yeah, PlayerIO's game passwords aren't case sensitive.

LukeM, Koya, Grilyon2

LukeM · 2019-05-03 18:35:06

We'd much rather this wasn't the case, but annoyingly we don't get a choice with PlayerIO so theres not much we can do right now...

We'll make sure to fix these problems for EEU though (passwords will be case sensitive and require at least a minimum level of security, email addresses will be validated and not changable without additional authentication, etc)

mikelolsuperman, Raphe9000, St1ckS4m(EE)

XxAtillaxX · 2019-05-03 20:37:51

It isn't a large security flaw at all. You can't efficiently brute-force passwords with Player.IO and if you took the five minutes to try it, you'd quickly find they already have taken measures against it (i.e. rate limiting)
In reply to Luke, you could already validate email addresses in the game if you wanted to. Player.IO doesn't hold your hand in that regard, but you're free to pay for those services if you feel it's necessary.

"and require at least a minimum level of security"
You could already do this if you wanted to. Stop pretending like Player.IO is at fault for your laziness.

LukeM · 2019-05-03 22:28:31

XxAtillaxX wrote:

It isn't a large security flaw at all. You can't efficiently brute-force passwords with Player.IO and if you took the five minutes to try it, you'd quickly find they already have taken measures against it (i.e. rate limiting)
In reply to Luke, you could already validate email addresses in the game if you wanted to. Player.IO doesn't hold your hand in that regard, but you're free to pay for those services if you feel it's necessary.
"and require at least a minimum level of security"
You could already do this if you wanted to. Stop pretending like Player.IO is at fault for your laziness.

I wasn't blaming PlayerIO for the second paragraph, I was just saying that those are the things we'll change in EEU. We could spend the time implementing email verification, but with EEU fairly close theres not much of a point doing it for the few new accounts that might sign up.

However, even though we could implement basic email verification and minimum password requirement systems, there would still be significant holes in those systems that we wouldn't be able to fix with PlayerIO. We can check the email and password during registration, but after that we're completely out of the loop, both email and password changes are done directly through PlayerIO, so we have no (meaningful) way of verifying that our requirements have been met.

XxAtillaxX · 2019-05-04 05:26:19

LukeM wrote:

We can check the email and password during registration, but after that we're completely out of the loop, both email and password changes are done directly through PlayerIO, so we have no (meaningful) way of verifying that our requirements have been met.

If you really wanted to (and I don't see why you would, if someone is adamant enough about having a weak password to directly change it through Player.IO) you could verify the account details remotely through an encrypted connection prior to allowing them to join the lobby (i.e. generate a temporary session token)

I find it rather ironic that you speak about security as though you're informed while being unable to contemplate very basic solutions to the problems you describe to be impossible.

peace · 2019-05-04 10:15:35

wait so it doeesnt matter if you wirte your pass in caps or not?! geee wtf PIO wtf

LukeM · 2019-05-06 14:41:43

XxAtillaxX wrote:

LukeM wrote:
We can check the email and password during registration, but after that we're completely out of the loop, both email and password changes are done directly through PlayerIO, so we have no (meaningful) way of verifying that our requirements have been met.
If you really wanted to (and I don't see why you would, if someone is adamant enough about having a weak password to directly change it through Player.IO) you could verify the account details remotely through an encrypted connection prior to allowing them to join the lobby (i.e. generate a temporary session token)
I find it rather ironic that you speak about security as though you're informed while being unable to contemplate very basic solutions to the problems you describe to be impossible.

Sorry, missed this reply somehow.

I'd agree with you if the standard way of changing a password was through a system we have control over, but it isn't, PlayerIO don't provide functionality to do it within the game. The problem with password requirements isn't that people have an option to change their password in a way that bypasses us if they look into it, its that this is the only way for people to change their password.

(And just clarifying that by "with PlayerIO" in my last reply I meant with the services that PlayerIO provide, we could technically set up our own account system on our own authentication servers that we would host ourselves, but the whole point of PlayerIO is that you don't need to set up your own servers, so this defeats the point)

peace · 2019-05-06 15:44:30

tho you can hack poeples EE acc if oyu can hack thier email aand use it to change their ee password nothign you can do about that

Official Everybody Edits Forums

#1 2019-05-03 18:03:01

Big security flaw

#2 2019-05-03 18:10:38

Re: Big security flaw

#3 2019-05-03 18:35:06

Re: Big security flaw

#4 2019-05-03 20:37:51

Re: Big security flaw

#5 2019-05-03 22:28:31, last edited by LukeM (2019-05-03 22:31:45)

Re: Big security flaw

#6 2019-05-04 05:26:19

Re: Big security flaw

#7 2019-05-04 10:15:35

Re: Big security flaw

#8 2019-05-06 14:41:43, last edited by LukeM (2019-05-06 14:42:14)

Re: Big security flaw

#9 2019-05-06 15:44:30

Re: Big security flaw

Board footer