5 ms·

> In a similar vein, the new minecraft reporting features (https://www.minecraft.net/en-us/article/addressing-player-ch https://www.minecraft.net/en-us/article/

> In a similar vein, the new minecraft reporting features (https://www.minecraft.net/en-us/article/addressing-player-ch https://www.minecraft.net/en-us/article/addressing-player-ch.... ) affects private servers as well, and it's not an opt-in by the server admin. What does this mean? Do users not connect directly to private servers? Does every minecraft client have to authenticate with a central server before joining a private one? Or is it just an on-by-default "use official banlist" option?

OkayPhysicist 4y ago
> Does every minecraft client have to authenticate with a central server before joining a private one? Yes. The way it works is that when a client attempts to join a (private) server, it sends the user id to the private server, and then sends Mojang a message informing them they it's trying to connect to a server at this address. The private server then asks Mojang if the supplied user id is valid, and attempting to sign in to the server at this address. Mojang then replies to the server confirming the authentication of the client, and then the server lets them in. There's also an exchange of cryptographic keys mixed in there, but that's the basics.
wolrah 4y ago
> What does this mean? Do users not connect directly to private servers? Does every minecraft client have to authenticate with a central server before joining a private one? Minecraft servers in the default "online mode" authenticate users against Mojang's "session server". The clients get a token when they log in to their launcher and the servers then validate that token when the user logs in. This verifies both that the user is who they're claiming to be and has a legitimate copy of Minecraft. Server admins can turn off online mode, but this means that anyone can claim to be anyone else unless some independent authentication scheme is implemented. As a result it's usually only done for actual offline servers and those that want to allow pirate copies to play. I'm not super familiar with the current controversy but the understanding I have is that chat reports could potentially result in being unable to log in to online mode servers which seems likely to have overreaching effects.
chii 4y ago
> Does every minecraft client have to authenticate with a central server before joining a private one? yes - login is required by the user iirc. You need a microsoft account to play minecraft (and i believe they recently migrated all old mojang accounts to microsoft now?)
- ridgered4 4y ago
  You'll also need to provide a phone number, with the usual BS of the requirement appearing after you've migrated suddenly for "security reasons". They know people would bail on the conversion if they made this requirement so instead they take your account away and hold it ransom until you cough up the goods.
  - Handytinge 4y ago
    Oh, this is common practice? I noticed the account was suspended a few days after creation for "ToS violation" - requiring phone verification to reactivate - and have so far spent hours of supports and my time hunting down the why.
- xahrepap 4y ago
  Yes. They are forcing them all to migrate to Ms accounts.
- Akronymus 4y ago
  It used to be "Migrate voluntarily and get a free cape, we will never force you to migrate" So much for that.
xahrepap 4y ago
I haven’t looked into it because it seemed straight forward. But now you have me curious. The clients always authenticated before launching the game and required a valid session to join even private servers. I’ve assumed the change just disables the option to join any games similar to if they weren’t properly authenticated.
- deleted 4y ago
  [deleted]
Hanschri 4y ago
Yes, you do need to authenticate before joining a privately hosted server, unless you change 'online-mode' in server.properties in the server folder. This came with a few issues. Offline servers usually had a plugin which let you create a password connected to your name in-game, since anyone in theory could just change their name to yours and get your inventory and permissions, including OP. AuthMe is an example of an authentication plugin, if you're interested in checking it out. So central authentication has been a part of the game since the beginning of multiplayer more or less, but Microsoft has taken it quite a bit further with the recent changes. Quite a shame to potentially be banned from a private server I host myself, whitelisted only for IRL friends. How strict the criteria to actually get banned is irrelevant in my opinion, I bought the game over ten years ago, and now suddenly risk losing access to multiplayer, which was the only reason I bought the game. But we'll have to see how it actually gets implemented, I really hope it's opt-in, or at the very least possible to opt out for privately hosted servers, but I have no issue with it being implemented on Realms.
asherah 4y ago
they all have to use the central auth server, which does the banning you can turn off using the central auth server but it comes with downsides (no skins, no way to protect people from using your username without a separate auth plugin)

OkayPhysicist 4y ago

> Does every minecraft client have to authenticate with a central server before joining a private one? Yes. The way it works is that when a client attempts to join a (private) server, it sends the user id to the private server, and then sends Mojang a message informing them they it's trying to connect to a server at this address. The private server then asks Mojang if the supplied user id is valid, and attempting to sign in to the server at this address. Mojang then replies to the server confirming the authentication of the client, and then the server lets them in. There's also an exchange of cryptographic keys mixed in there, but that's the basics.

wolrah 4y ago

> What does this mean? Do users not connect directly to private servers? Does every minecraft client have to authenticate with a central server before joining a private one? Minecraft servers in the default "online mode" authenticate users against Mojang's "session server". The clients get a token when they log in to their launcher and the servers then validate that token when the user logs in. This verifies both that the user is who they're claiming to be and has a legitimate copy of Minecraft. Server admins can turn off online mode, but this means that anyone can claim to be anyone else unless some independent authentication scheme is implemented. As a result it's usually only done for actual offline servers and those that want to allow pirate copies to play. I'm not super familiar with the current controversy but the understanding I have is that chat reports could potentially result in being unable to log in to online mode servers which seems likely to have overreaching effects.

chii 4y ago

> Does every minecraft client have to authenticate with a central server before joining a private one? yes - login is required by the user iirc. You need a microsoft account to play minecraft (and i believe they recently migrated all old mojang accounts to microsoft now?)

ridgered4 4y ago
You'll also need to provide a phone number, with the usual BS of the requirement appearing after you've migrated suddenly for "security reasons". They know people would bail on the conversion if they made this requirement so instead they take your account away and hold it ransom until you cough up the goods.
- Handytinge 4y ago
  Oh, this is common practice? I noticed the account was suspended a few days after creation for "ToS violation" - requiring phone verification to reactivate - and have so far spent hours of supports and my time hunting down the why.
xahrepap 4y ago
Yes. They are forcing them all to migrate to Ms accounts.
Akronymus 4y ago
It used to be "Migrate voluntarily and get a free cape, we will never force you to migrate" So much for that.

xahrepap 4y ago

I haven’t looked into it because it seemed straight forward. But now you have me curious. The clients always authenticated before launching the game and required a valid session to join even private servers. I’ve assumed the change just disables the option to join any games similar to if they weren’t properly authenticated.

deleted 4y ago
[deleted]

Hanschri 4y ago

Yes, you do need to authenticate before joining a privately hosted server, unless you change 'online-mode' in server.properties in the server folder. This came with a few issues. Offline servers usually had a plugin which let you create a password connected to your name in-game, since anyone in theory could just change their name to yours and get your inventory and permissions, including OP. AuthMe is an example of an authentication plugin, if you're interested in checking it out. So central authentication has been a part of the game since the beginning of multiplayer more or less, but Microsoft has taken it quite a bit further with the recent changes. Quite a shame to potentially be banned from a private server I host myself, whitelisted only for IRL friends. How strict the criteria to actually get banned is irrelevant in my opinion, I bought the game over ten years ago, and now suddenly risk losing access to multiplayer, which was the only reason I bought the game. But we'll have to see how it actually gets implemented, I really hope it's opt-in, or at the very least possible to opt out for privately hosted servers, but I have no issue with it being implemented on Realms.

asherah 4y ago

they all have to use the central auth server, which does the banning you can turn off using the central auth server but it comes with downsides (no skins, no way to protect people from using your username without a separate auth plugin)