olink [11:37 AM]
what are you doing to the login code now

olink [11:37 AM]
@nicatrontg:

nicatrontg [11:37 AM]
moved the entire system to bcrypt

nicatrontg [11:38 AM]
and added a migration system to move existing passwords to bcrypt

nicatrontg [11:38 AM]
it works, but once someone logs in

nicatrontg [11:38 AM]
it’s game over

nicatrontg [11:38 AM]
their hash is a bcrypt hash now

nicatrontg [11:38 AM]
and bcrypt hashes aren’t checked using just equivalence

olink [11:38 AM]
how are you migrating salted passwords to something else?

nicatrontg [11:39 AM]
we don’t salt passwords

nicatrontg [11:39 AM]
:keepo:

nicatrontg [11:39 AM]
at first login, we use the old code

olink [11:39 AM]
we do something

olink [11:39 AM]
Kappa

nicatrontg [11:39 AM]
verify that your password matches

nicatrontg [11:39 AM]
and then move it to bcrypt

olink [11:39 AM]
so you added a field that checks if its been igrated

olink [11:39 AM]
i reject

olink [11:39 AM]
bad solution

nicatrontg [11:39 AM]
no, didn't

olink [11:40 AM]
so you check against a normal hash first, everytime?

nicatrontg [11:40 AM]
bcrypt hashes are $2a$workfactor$salt.hashedpass

nicatrontg [11:40 AM]
if it doesn’t start with $2a it isn’t a bcrypt hash

olink [11:40 AM]
also uhmmm

olink [11:40 AM]
theres a reason we added crypto in the config

olink [11:40 AM]
so that its optional, no?

nicatrontg [11:41 AM]
the only reason why it’s in the config is to support xp

olink [11:41 AM]
not really

nicatrontg [11:41 AM]
aka lower crypto versions than sha256

olink [11:41 AM]
im pretty sure it supports md5

nicatrontg [11:41 AM]
md5 is shit

olink [11:41 AM]
yes, but we offer it as an option

olink [11:41 AM]
i dont agree with forcing a new crypto on people

nicatrontg [11:41 AM]
that was 2011

olink [11:41 AM]
make it optional

nicatrontg [11:41 AM]
no

olink [11:41 AM]
then you have a :-1:

nicatrontg [11:41 AM]
lol, I can prove you wrong scientifically

olink [11:42 AM]
because you dont just go change someones database

olink [11:42 AM]
if they dont want it

olink [11:42 AM]
if people want bcrypt they will switch to it

olink [11:42 AM]
if they dont care, which most dont, then its just a pita

nicatrontg [11:42 AM]
no, it’s trivial and automatic

olink [11:42 AM]
to you yse

olink [11:43 AM]
but to someone running a server

olink [11:43 AM]
they could care less

olink [11:43 AM]
also good job breaking bamboo!

nicatrontg [11:43 AM]
I broke bamboo?

olink [11:44 AM]
if you change workfactor

olink [11:45 AM]
wont it fail to find previous passwords

olink [11:45 AM]
based on older work factors?

olink [11:45 AM]
im not a bcrypt export

nicatrontg [11:45 AM]
Nope, the work factor is stored in the password

olink [11:45 AM]
expert even

nicatrontg [11:45 AM]
If you run verify, it uses the stored work factor

nicatrontg [11:45 AM]
which is why people call it future proof

nicatrontg [11:45 AM]
you can upgrade the workfactor silently, and new users get more security for free

olink [11:45 AM]
And the BCrypt lib doesnt support parsing a password

olink [11:45 AM]
thats rich for future proof

olink [11:46 AM]
>implement your own parsing of passwords

nicatrontg [11:46 AM]
what does “parsing a password” mean?

olink [11:46 AM]
:keepo:

olink [11:46 AM]
https://github.com/NyxStudios/TShock/commit/08fae75c0ccab2fab1e1b3b47c421c5cd27dacfe

olink [11:46 AM]
If someone is going to make a lib for doing bcrypto work, they should probably also provide the tools for working with an existing password

nicatrontg [11:46 AM]
that’s just my check to get the work factor

olink [11:46 AM]
yes the lib should do that

olink [11:46 AM]
hence why I said what I said

olink [11:48 AM]
did you verify that you didnt potentially break the login hooks?

olink [11:48 AM]
one of which passes password

olink [11:51 AM]
> This also changes User.Password to private set to prevent further accidents.

olink [11:51 AM]
> public string Password { get; internal set; }

olink [11:51 AM]
:keepo:

olink [11:53 AM]
also any reason you didnt obsolete or outright remove the old hashing stuff?

nicatrontg [11:53 AM]
please, wait for PR lol

nicatrontg [11:53 AM]
I’m explaining it all

nicatrontg [11:53 AM]
it’s a lot

nicatrontg [11:53 AM]
well, ask here*

nicatrontg [11:53 AM]
I’ll answer in PR

olink [11:53 AM]
im trying to save you time by having you address the problems before you pr

nicatrontg [11:54 AM]
the old hashing stuff is obsoleted, in Utils

nicatrontg [11:54 AM]
unfortunately, we need to keep it around somewhere

nicatrontg [11:54 AM]
so that we can still convert the old passwords

olink [11:54 AM]
if its still being used dont obsolete it I guess

olink [11:54 AM]
because this code will never be removable

nicatrontg [11:54 AM]
well, again, I obsolete the public code

bccccc [11:54 AM]
why would you want to parse a password?

nicatrontg [11:54 AM]
the private internal code is not obsoleted

olink [11:55 AM]
because apparently the password contains the information about the crypto algo

olink [11:55 AM]
because "future proof"

bccccc [11:55 AM]
suddenly we storing metadata in passwords

nicatrontg [11:55 AM]
@bccccc: please, learn 2 bcrypt

olink [11:55 AM]
bcrypt apparently does

olink [11:55 AM]
also, as iw as saying

olink [11:55 AM]
we cant remove that hashing code anyways

olink [11:55 AM]
because there will be one user donw the road

olink [11:55 AM]
in 2 years

olink [11:55 AM]
who will log into an account

nicatrontg [11:55 AM]
yes, exactly

olink [11:55 AM]
and itll still be sha256

nicatrontg [11:56 AM]
but the public code doesn’t need to exist

olink [11:56 AM]
hence why i think its stupid to half switch them

nicatrontg [11:56 AM]
(in Utils.cs, there is public code, that should be removed)

olink [11:57 AM]
whelp theres one failure

olink [11:57 AM]
should probably commit the dll

nicatrontg [11:57 AM]
oops

nicatrontg [11:57 AM]
bins are gitignored

nicatrontg [11:57 AM]
let me just go add that

nicatrontg [11:57 AM]
lol

olink [11:58 AM]
while you are there

olink [11:58 AM]
can you move all those folders into one References Folder, and move Newtonsoft up there as well

olink [11:58 AM]
also

olink [11:58 AM]
rip bamboo