The Mana World Forums

That just wanted to make me delete my own account.
Encrypt passwords for the next version, for god's sake...

Well it doesn't really matter at the moment. Accounts are going to be wiped once tmwserv is ready!

Will "old users" have a reward? :XD: Like an event of inauguration or something :3
I'm alredy 2X and I don't wanna lose my exp D;

I'm pretty sure there will be, but no one knows what yet. They've talked about it in the past but it should still be quite some time from now.

Why isn't anyone banning the offending IPs (189.62.210.0/24, etc) from the server and the forums?

Alxe wrote:That just wanted to make me delete my own account.
Encrypt passwords for the next version, for god's sake...

Don't use your bank / root password as tmw password, for go's sake...

It would be wonderful If you could understand these ebnr people...

Alxe wrote:That just wanted to make me delete my own account.
Encrypt passwords for the next version, for god's sake...

TMWServ stores hashes for password and email.

jaxad0127 wrote:

Alxe wrote:That just wanted to make me delete my own account.
Encrypt passwords for the next version, for god's sake...

TMWServ stores hashes for password and email.

Even better: Passwords are hashed when they leave the client using the username as a salt to foil any eavesdropping attempts en-route and then the hashes are hashed again on the server to preserve account security in the unlikely case that the database is compromised.

Unfortunately it would be impossible to introduce hashed passwords on the current server. It would be possible to change the client to convert the users password into the hashed form automatically and the server would just work with the hashes as passwords. But that would mean that all current passwords become invalid. We would have to convert the servers account database to hashed passwords so that people can login with the new client and from that moment on nobody could login without the new client.

It is also unnecessary in this case because the security leak was not that someone broke into our server. It was because people used the same password&login combination on an untrustworthy server. There is nothing we can do against this grade of retardation.

Crush wrote:It is also unnecessary in this case because the security leak was not that someone broke into our server. It was because people used the same password&login combination on an untrustworthy server. There is nothing we can do against this grade of retardation.

And we've looked.

Is it possible to change one current's password? Right now, please

-=Gui=- (VOQY, K2F5) Bem manuh, voçe nao tinha que me envolver, na sua historia
voçe quer hackiar alguem, hackei mas voçe tem que asumir, nao bote culpa em min......
Comigo quem quiser, Contra min quem Puder!!

eae mlk se ta markano tira meu nome dae mlk

english please?

what's the issue here ?