If you know the right functions to modify then it is easy to "bypass" or re-route server-side authentication for clients, in fact it doesn't take much to completely separate the game and have your own auth + master server, but this isn't anything to worry about for unmodified/legitimate servers.
Some people are wondering if this was something that could be abused on every server. And just looking at what goes on authentication-wise when you join a server, no, the game requires you to be authenticated in order to obtain your BLID in the first place before it even updates the player list. Unless the auth server itself has a bug, it will just fail you and you disconnect before anyone sees.
So its just a scummy little script that benefits a small handful of users who don't have a key.. kind of boring when your server selection is so limited. I remember when dotdotcircle wanted to do something similar back in 2013 to just have a completely independent version of the game and reverse it from there (this is where the dso disassembler came in to play) but it obviously never worked out.. kind of neat finding out how authentication worked though!
And I wouldn't get mad at Port or anyone for figuring or re-figuring these things out unless they abuse it, its a touchy subject like trying to justify hacking games, but figuring out the lower mechanisms of game authentication and the algorithms that go behind it is just so damn interesting. Like its comparable to researching nuclear reactions and then nuclear explosions are weaponized, its not necessarily the researchers fault in that instance for creating deadly weapons, just the guys who took it and wreaked havoc with it. Example: key research gave us KeyUtils to help recover lost keys, but at the same time let us figure out how to authenticate offline easily. So don't get mad at Ipquarx for figuring that stuff out, its the guys who abuse the offline keys who are the problem.
