5 ms·
I feel like some of the "inspired by cubeworld" stuff is a little too heavily inspired, but I really enjoyed taking a quick look at the source and logging in to
by daguava 5y ago
I feel like some of the "inspired by cubeworld" stuff is a little too heavily inspired, but I really enjoyed taking a quick look at the source and logging in to check things out.
Things seemed pretty clean, and because everything has source posted I was able to mess around with the apis, and try a few things against your services :) (hope I didn't set off any alarms lol). That said, what I'm assuming is Sha256 could always be a bit tighter, consider a strength upgrade on those credentials.
There's a bit of snobbery going on here for go / voxel hate, but I really enjoyed digging into a completely open source setup for something that is already a nice intro of game, services, and execution, well done :)
- AngelOnFira 5y agoLet us know if you find any holes! We currently have an MR where we're overhauling some of the auth, and I know in the future we do want to explore what else we could add/improve for our backends :)
- daguava 5y agoThe only hole I found was if you bypass UI hashing you can create an account that can never be logged in to, but... that's the most secure account I can think of.
- Jweb_Guru 5y agoCredentials use argon2.
- daguava 5y agoThanks for the info, I saw the length matched the usual sha256 so assumed it ended there. I'm from a bcrypt crowd which is why I offered the suggestion but as long as you're taking things seriously I'm all for it :)
- KyleBerezin 5y agoCubeworld was never completed. It makes sense that people try to take up the torch.