search

kyngs / LibreLogin

Open-source, multiplatform, and highly customizable authentication plugin with outstanding features and API.
Mozilla Public License 2.0
164 stars 53 forks source link

disable 'sessions' by default #252

Closed bacalhau-seco closed 3 months ago

bacalhau-seco commented 3 months ago

I'm talking about that feature that allows players to auto-login without a password as long as the IP stays the same. It can be a security risk on some circumstances, and for this reason it shouldn't be a default setting.

gamer50082 commented 3 months ago

Not a security risk as you can't change your ip to someone else ip unless you own their ip

bacalhau-seco commented 3 months ago

yes, that's exactly what the security risk is. People that have the same ip as you can join your account. This can happen on the same house, same building, same street. It can also happen if there is some kind of poorly configured proxy connected to the server. People joining thru the proxy can have the same IP and that becomes a bigger issue than just neighbors messing around. People can abuse this feature by tricking other people to join their proxy (I've seen it happen). And while i do think its the players fault for joining random proxies i believe that there wouldn't be problem, especially for begginers if it was just disabled by default.