As noted here, our security is, well, sub-par from what it could be. We need to change some stuff up.
Security Snip Begin
Thanks for the feedback!
It looks like your "compromise" detection is /op.
It certainly is at the moment, and that is pretty disappointing, really.
Maybe the admin can specify a list of commands to watch for, with a point based system? e.g. running op makes you 50 points more suspicious, and it requires 100 points to ban?
[ ] That certainly is a good idea. I didn't think of a points based system at first, but I definitely planned on allowing server owners to appoint their own commands / do some funky stuff with permissions managers that detects what commands are "admin level" commands and restricts them.
it looks like every time a player executes a command, they're required to have ServerDefender and be verified.
[x] That might've been an oversight on my part. This system is supposed to only be for Users who have the permission, and nobody else. Additionally, you aren't required to re-enter your password if your location is "trusted" (aka similar location)
it might not be best to just auto assume people are bad if they're in a different location (People travel sometimes!).
[ ] I was planning on something like /verify traveltrust that would temporarily trust a location for 3 days after the location is no longer being used. /verify trust would be for permanent trust updates.
--security snip--
[x] I will, for sure, update my code to use a better crypt and actual salting. I used a simple hardcoded salt mostly because I was unsure that it was safe to use individual user salt, but...
Stored in a seperate plain text source.
[x] the salts certainly will be stored somewhere else, so no worries!
But yeah, at least it's a hash and I wasn't lazy and went "lol plain text passwords"
:stuck_out_tongue_winking_eye:
Finally, thanks for the informative post. I'll make sure to put up an issue on GitHub with a snippet of this so I remember to do it.
As noted here, our security is, well, sub-par from what it could be. We need to change some stuff up.
Security Snip Begin
Thanks for the feedback!
It looks like your "compromise" detection is /op.It certainly is at the moment, and that is pretty disappointing, really.Maybe the admin can specify a list of commands to watch for, with a point based system? e.g. running op makes you 50 points more suspicious, and it requires 100 points to ban?it looks like every time a player executes a command, they're required to have ServerDefender and be verified.it might not be best to just auto assume people are bad if they're in a different location (People travel sometimes!)./verify traveltrustthat would temporarily trust a location for 3 days after the location is no longer being used./verify trustwould be for permanent trust updates.--security snip--Stored in a seperate plain text source.But yeah, at least it's a hash and I wasn't lazy and went "lol plain text passwords" :stuck_out_tongue_winking_eye:
Finally, thanks for the informative post. I'll make sure to put up an issue on GitHub with a snippet of this so I remember to do it.
Security Snip End