4 ms·

Any suggestions on protecting credential transfer in a MUD? I have been wanting to build one but honestly I'm used to the convenience of HTTPS and the passing o

Any suggestions on protecting credential transfer in a MUD? I have been wanting to build one but honestly I'm used to the convenience of HTTPS and the passing of credentials over a socket is preventing me from starting.

TheJoYo 7y ago
mbedtls is a bit annoying at first but the windows build process is less painful than openssl. ```powershell New-Item "temp" -ItemType "directory" -Force $client = New-Object System.Net.WebClient $client.DownloadFile("https://github.com/ARMmbed/mbedtls/archive/mbedtls-master.zip" https://github.com/ARMmbed/mbedtls/archive/mbedtls-master.zi..., "temp\C:\temp\mbedtls-master.zip") Expand-Archive -Path C:\temp\mbedtls-master.zip -DestinationPath C:\temp\; Move-Item C:\temp\mbedtls-mbedtls-master\ C:\mbedtls\ MSBuild.exe C:\mbedtls\visualc\VS2010\mbedTLS.sln /p:Configuration=Release /p:Platform=x64 MSBuild.exe C:\mbedtls\visualc\VS2010\mbedTLS.sln /p:Configuration=Release /p:Platform=Win32 ```
- TheJoYo 7y ago
  lets try that again https://git.thejoyo.com/JoYo/snippets/src/branch/master/mbedtls_msvc.ps1 https://git.thejoyo.com/JoYo/snippets/src/branch/master/mbed...
gtaylor 7y ago
Mudlet and a number of other maintained clients now support TLS!
crtlaltdel 7y ago
if you ran it over a websocket it seems like that could help the situation you mention. back in the day, honestly, as mostly 14-16yo kids....we really didn't think about that!
popotamonga 7y ago
Make a small api in whatever language for the login in https and return a token or something.
icedchai 7y ago
SSH? Server-side implementations exist in Python, Go, Java, and other languages. You can have a plain-text, telnet-style listener that informs people that they should use SSH instead.
romland 7y ago
https://github.com/dworkin/dgd https://github.com/dworkin/dgd and https://github.com/dworkin/lpcssh https://github.com/dworkin/lpcssh
oestrich 7y ago
You can wrap a telnet session in TLS pretty easily which then protects the plain text password floating by. I've also been playing around with OAuth inside of a telnet session, but it's a little wonky as you might guess. If you're signed into Grapevine (mentioned above as well) this link will have you auto signed into a telnet session: https://grapevine.haus/games/Spigot/play https://grapevine.haus/games/Spigot/play This is my draft spec (it's not completely filled in but the idea is there) https://gist.github.com/oestrich/1fc022a448c36ac2aa5a099f4ca3778c https://gist.github.com/oestrich/1fc022a448c36ac2aa5a099f4ca... Spigot and Grapevine are also open source if you wanted to poke around.

TheJoYo 7y ago

mbedtls is a bit annoying at first but the windows build process is less painful than openssl. ```powershell New-Item "temp" -ItemType "directory" -Force $client = New-Object System.Net.WebClient $client.DownloadFile("https://github.com/ARMmbed/mbedtls/archive/mbedtls-master.zip" https://github.com/ARMmbed/mbedtls/archive/mbedtls-master.zi..., "temp\C:\temp\mbedtls-master.zip") Expand-Archive -Path C:\temp\mbedtls-master.zip -DestinationPath C:\temp\; Move-Item C:\temp\mbedtls-mbedtls-master\ C:\mbedtls\ MSBuild.exe C:\mbedtls\visualc\VS2010\mbedTLS.sln /p:Configuration=Release /p:Platform=x64 MSBuild.exe C:\mbedtls\visualc\VS2010\mbedTLS.sln /p:Configuration=Release /p:Platform=Win32 ```

TheJoYo 7y ago
lets try that again https://git.thejoyo.com/JoYo/snippets/src/branch/master/mbedtls_msvc.ps1 https://git.thejoyo.com/JoYo/snippets/src/branch/master/mbed...

gtaylor 7y ago

Mudlet and a number of other maintained clients now support TLS!

crtlaltdel 7y ago

if you ran it over a websocket it seems like that could help the situation you mention. back in the day, honestly, as mostly 14-16yo kids....we really didn't think about that!

popotamonga 7y ago

Make a small api in whatever language for the login in https and return a token or something.

icedchai 7y ago

SSH? Server-side implementations exist in Python, Go, Java, and other languages. You can have a plain-text, telnet-style listener that informs people that they should use SSH instead.

romland 7y ago

https://github.com/dworkin/dgd https://github.com/dworkin/dgd and https://github.com/dworkin/lpcssh https://github.com/dworkin/lpcssh

oestrich 7y ago

You can wrap a telnet session in TLS pretty easily which then protects the plain text password floating by. I've also been playing around with OAuth inside of a telnet session, but it's a little wonky as you might guess. If you're signed into Grapevine (mentioned above as well) this link will have you auto signed into a telnet session: https://grapevine.haus/games/Spigot/play https://grapevine.haus/games/Spigot/play This is my draft spec (it's not completely filled in but the idea is there) https://gist.github.com/oestrich/1fc022a448c36ac2aa5a099f4ca3778c https://gist.github.com/oestrich/1fc022a448c36ac2aa5a099f4ca... Spigot and Grapevine are also open source if you wanted to poke around.