this post was submitted on 28 Sep 2023
320 points (75.6% liked)

Games

32943 readers
925 users here now

Welcome to the largest gaming community on Lemmy! Discussion for all kinds of games. Video games, tabletop games, card games etc.

Weekly Threads:

What Are You Playing?

The Weekly Discussion Topic

Rules:

  1. Submissions have to be related to games

  2. No bigotry or harassment, be civil

  3. No excessive self-promotion

  4. Stay on-topic; no memes, funny videos, giveaways, reposts, or low-effort posts

  5. Mark Spoilers and NSFW

  6. No linking to piracy

More information about the community rules can be found here.

founded 2 years ago
MODERATORS
 

Larion Studios forum stores your passwords in unhashed plaintext. Don't use a password there that you've used anywhere else.

you are viewing a single comment's thread
view the rest of the comments
[–] nickwitha_k@lemmy.sdf.org 65 points 1 year ago (1 children)

That's very unlikely. It's running UBB Threads, which, from what I can tell, has an auth subsystem, which au minimum would do hashing. If it's providing you with a default at sign-up, that's different and is what appears to be a configurable setting.

If it is completely generated for you, here's what probably happening:

  1. User creation module runs a password generator and stores this and the username in memory as string variables.
  2. User creation module calls back to storage module to store new user data in db, including the value of the generated password var.
  3. Either the storage module or another middleware module hashes the password while preparing to store.
  4. Storage module reports success to user creation.
  5. User creation module prints the vars to the welcome template and unloads them from memory.

TL;DR as this is running on a long-established commercial php forum package, with DB storage, it is incredibly unlikely that the password is stored in the DB as plaintext. At most it is likely stored in memory during creation. I cannot confirm, however, as it is not FOSS.

[–] Cabrio@lemmy.world 8 points 1 year ago (1 children)

It sends the user generated password, not an auto generated one.

[–] hex@programming.dev 31 points 1 year ago (1 children)

Yeah if they send the password in an email in plain text that's not storing it. You can send the email before you store the password while it's still in memory and then hash it and store it.