More secure way of authenticating players?

[National Rail]

That doesn't involve keys?

Is there even a way? Because I honestly don't want to be handling keys if my IRC is to progress to the next level.

[Ad Bot]

[Dannu]

If a player has authenticated with a game, you can check auth.blockland.us with their IP and their blockland BL_ID and it will tell you if that BL_ID is authenticated on that IP.

[Kyuande]

If a player has authenticated with a game, you can check auth.blockland.us with their IP and their blockland BL_ID and it will tell you if that BL_ID is authenticated on that IP.

Would would the fields be? I only got something like
auth.blockland.us/authQuery.php?NAME=Visolator&IP=<IP>

[Foxscotch]

Would would the fields be? I only got something like
auth.blockland.us/authQuery.php?NAME=Visolator&IP=<IP>

you have to use POST, and send that data in the body, but you've got the keys right

also, it's imperfect. as far as I can tell it only checks the first two parts of the IP (e.g. 27.12.x.x), which I guess is to cover for dynamic IPs, and isn't that big of a deal, but it could be, if someone happens to live near someone they want to pose as and also has the same ISP. a very unlikely situation, that you don't really need to concern yourself with
it goes without saying (hopefully) that people who live in the same house would be able to pose as each other, but I kind of doubt that would create a serious problem
lastly, and most importantly, is the issue of spoofed IP addresses. if your form of authentication doesn't rely on the user being able to receive the response, it would be very easy for someone to pretend to be someone else. however, if you do make it require them to get the response in one way or another, that problem is easily solved. I still think a better form of authentication would be nice, though

kinda funny you made this thread today, because I was just thinking about this last night. for the record though you should never ask for someone's key. that's crazy. not only do you then have access to their key, but if anyone finds their way into your server, so do they

edit: one last little note about the thing, if you don't send an IP address, it defaults to using the IP address that sent the request. practically useless information, but it could be important

[National Rail]

For the record though you should never ask for someone's key. that's crazy. not only do you then have access to their key, but if anyone finds their way into your server, so do they

Yeah that's why I asked because the way hosting services etc authenticate players is with the key its self.

Your idea about post reqests seems good except the part about only showing the first two parts of the IP, we may have to find another way of authenticating players if we are to have a website for users to chat on mobile etc.

[Foxscotch]

Your idea about post reqests seems good except the part about only showing the first two parts of the IP, we may have to find another way of authenticating players if we are to have a website for users to chat on mobile etc.

why would you have to use a different way? I intend to use authQuery.php for my website. they just have to provide their blockland name

[National Rail]

why would you have to use a different way? I intend to use authQuery.php for my website. they just have to provide their blockland name

Personally I'd do it by BL_ID since their name can be changed,  BL_ID can't. In effect BL_ID is similar to a key but without giving people who see it access to their key while remaining constant and unchangable while the particular key is in use for that instance of the game.

[Foxscotch]

Personally I'd do it by BL_ID since their name can be changed,  BL_ID can't. In effect BL_ID is similar to a key but without giving people who see it access to their key while remaining constant and unchangable while the particular key is in use for that instance of the game.

it doesn't really make much of a practical difference. if they make accounts on your website, you can just check once, and associate the blockland ID that authQuery.php gives you with their account from then on. if they don't make accounts, then it's just entering your name every time vs entering your ID every time, which isn't a big difference