RBL - Ephialtes

[IkeTheGeneric]

Seriously stop using images as a way to talk that's not how you converse with other human beings

[Ad Bot]

[cucumberdude]

No, anyone intercepting it could NOT as good have the password since they can't reverse the hashing which means that they can't use it to use the account on other sites (assuming same pass, etc).

That's true. But it still doesn't offer much of an advantage as compared to serverside encryption.

Using AES for passwords would be entirely useless.

I was referring to a different project. I am fully aware that AES can be decrypted. I use md5 for this.

I assume that you mean "recovering the old password".
No, that would be impossible which is one of the points about it.
However, what you usually do when you use a password recovery feature is that the site sends a new password to your e-mail. That would not be impossible since the encrypted data is already known. What is not known is the encryption KEY. The thing is that you retrieve the encrypted data and the decrypted data from the database. Then you try decrypting it with the password as key and then if it succeeds you compare the decrypted data with the data from the database. If those succeeds, log me in, otherwise, refuse.

That's just over complicating things... Easier to apply a simple md5 hash, seeing as there aren't really any advantages to seeding with a password. Interesting idea all the same.

Actually some big sites allow both using "their" account system and OpenID. Drupal (which I personally like quite much) ships with an OpenID module by default (although disabled), I'm not sure about how it handles passwords though.
Some big sites (for example StackExchange (StackOverflow, etc) and SuseStudio) only allows login via OpenID.
Also, for example Google and Yahoo acts as OpenID providers which means that any site allowing OpenID-logins can be logged into with your Google/Yahoo account.

Interesting.

That was a nice tech discussion but, back on topic of the drama...

OpenID is fine. The problem here is that the dude was storing a massive amount of passwords provided by members of Blockland in plain text, associated with their name and email. This isn't OK.

That is incorrect. Re-read the ENTIRE thing, then post. Passwords are md5 hashed.

I agree about it being pointless

this service is a) completely loving pointless

Yall are right. What's the point of a rating system? Nothing but a lil' source of entertainment. Not really worthwhile. Hey forget it, while we're at it, what's the point of blockland? So loving pointless man. Just some bullstuff game that you enjoy. forget that stuff. Bro brb throwing computer out of window, that stuff is so pointless - I just use it for games and pointless stuff like that.

Come on, that's a terrible argument. It really doesn't matter what the service is - if it's safe and legitimate, it shouldn't be banned from the forums.

[Kalphiter]

It really doesn't matter what the service is - if it's safe and legitimate, it shouldn't be banned from the forums.

Obviously you have failed to fulfill that.

[DrenDran]

OpenID is fine. The problem here is that the dude was storing a massive amount of passwords provided by members of Blockland in plain text, associated with their name and email. This isn't OK.

But would you have known this if he didn't tell you?

[Kalphiter]

But would you have known this if he didn't tell you?

He admitted to not having any encryption at all, and at this point it's still not provable.

[Custard]

According to Ephialtes the reason of removal was 'because it stores passwords'.

There are many player owned web sites on the forums (take, for example, clan forums) that do the same. Why are they not removed?
This is just stupid. The forums has nothing to do with the constitution. It's not a democracy, and there aren't 'laws'.
You seem to think that this has to do with some sort of serious threat to members. While before encryption it was, it no longer was afterward. I'm not trying to somehow diminish the authority of an administrator - I'm questioning whether the behavior was abusive. Of course in a situation where it was likely that I was collecting passwords for some evil master plan, Ephialtes would have been unquestionably in the right. The grey zone here is when does selective, arbitrary administration outside of the written rules become abusive. That's a question that's important to consider - and that's really difficult to answer.

I'm not saying you're a threat to the community members, I'm just stating that Ephialtes has absolute authority over taking your topic down, and the necessary and proper clause was a prime example of this power. In this case, Ephialtes has the right to force rules that are necessary and proper for the safety of the community, whether they are actual rules or not.

Thanks to Ephialtes' good jurisdiction, however, there's hardly any corruption from the administrative branch of members. However, when taking laws, or rules, into ones own hands, one must elaborate and interpret what is right and what is wrong according to current rules. This is where Ephialtes has it hard in troubled situations like these.

Also, the process of forcing and creating laws has absolutely nothing to do with Democracy.

And in technicality, anything that must be followed in order to keep order in a certain community is called a law, and that applies towards the forum rules. Of course you're not going to find this rule under the rule list, but that's where this good interpretation and jurisdiction comes in. Ephialtes had a choice to make, and this decision made the most sense at the time.

Now, having been "fixed" of it's issue, I'd suspect Ephialtes would let you continue to advertise your website. I have yet to discover the reasoning behind that.

[cucumberdude]

Now, having been "fixed" of it's issue, I'd suspect Ephialtes would let you continue to advertise your website. I have yet to discover the reasoning behind that.

Sorry, I must have misunderstood you. This is how I feel as well. The problem being that

at this point it's still not provable

There's really no way I can prove that I'm using serverside encryption - people just have to take my word for it.

Of course, that's often the case, even RTB doesn't encrypt clientside, and the data they're handling is far more important (private mods and whatnot).

[DontCare4Free]

I use md5 for this.

MD5 is old and has been broken. Use SHA1 instead.

Of course, that's often the case, even RTB doesn't encrypt clientside, and the data they're handling is far more important (private mods and whatnot).

So you claim that private mods are more important than passwords?

Also, it would be possible to prove that you aren't storing passwords in plaintext if you just used OpenID instead.

[UncleNinja]

MD5 is old and has been broken. Use SHA1 instead.

Actually, SHA1 has some issues of its own, although they aren't as serious. Really he should be using a subset of SHA-2 like SHA256.

[cucumberdude]

MD5 is old and has been broken. Use SHA1 instead.

Eh, probably safe enough. These aren't bank accounts, and let's face it - I doubt anybody on the forums can even exploit md5's vulnerabilities.

I supposed I could go and SHA-2 hash on top of the md5... lol

[DontCare4Free]

Eh, probably safe enough. These aren't bank accounts, and let's face it - I doubt anybody on the forums can even exploit md5's vulnerabilities.

I supposed I could go and SHA-2 hash on top of the md5... lol

Just use OpenID and the whole problem will go away.

[DrenDran]

Just use OpenID and the whole problem will go away.

You're quite the supporter.

[Iban]

I'm not signing up any website Blockland related that is not on the blockland.us website, or on returntoblockland.com. That's just stupid.

[IkeTheGeneric]

I'm not signing up any website Blockland related that is not on the blockland.us website, or on returntoblockland.com. That's just stupid.

I think I'm going to sign up an account there with the password "forgetyoukalphiter"

lol

[DrenDran]

I'm not signing up any website Blockland related that is not on the blockland.us website, or on returntoblockland.com. That's just stupid.

Wait, you'd sign up for return to blockland but no other?
Assuming you use a new password, there's no risk at all, and if the webhost isn't handicapped, there wouldn't be any risk anyway. Granted this post isn't supposed to imply any opinions about OP or his website.