5 ms·
Character login requires password, which is sent plaintext over telnet. Even if you get around that somehow, there are still concerns about session hijacking t
by cyanmagenta 3y ago
Character login requires password, which is sent plaintext over telnet.
Even if you get around that somehow, there are still concerns about session hijacking to steal someone’s in-game items and currency.
- troad 3y agoI suppose the threat vector seems incredibly low to me. Seems like a strange use of a capable hacker's time, in today's world of bitcoin and ransomware, to be preying on people's in-game currency / pets from ancient MUDs. Their saleability would seem to approach zero. Password reuse might be an issue, but in my experience people had their environments pre-configured to log in automatically, so a unique complex password would eliminate that risk. Personally, I think the complexity of implementing encryption for these services would outweigh the benefits. A big part of their appeal is the ease of setup and shell access.
- foobarian 3y agoI think you way, way underestimate MUD players :-)
- hhh 3y agossh is just as easy to use on the client side
- geoffmunn 3y agoI view it as an issue of best-practice password hygiene. Just because the stakes are low, and it's a hassle, doesn't mean you should skip it. The more you get used to implementing it, the easier it gets.
- o11c 3y agoSASL can secure the login without encrypting the whole session. And most other things benefit more from signing than from encryption, though I'm not sure how much support for this there is. That said, server software supporting SSH is getting common these days, so it might be a matter of just updating and/or reconfiguring the server. (It's difficult to make too general a statement about all servers though)
- wpm 3y agoWho’s looking though?