Public UIDs and Fabc's Awful Security 2018-08-25

A recent conversation reminded me about something that's been bothering me for a while; I decided I'd write about it here, since I have nothing better to do with my life atm, apparently. ;) When I first started posting here, people told me to engage more with the community, so when I used a little trick in-game, I figured I'd post a mini 'tutorial' about it. At the time, I didn't realize how public and important UIDs were in fabc community. I actually thought that it was an accident that the ID was shown in users' space URLs, due to the horrendous URL generation instead of the usage of routes (but that's another issue). This leads me to the one of the biggest issues with fabc's security.  Having UIDs public -- easily visible to everyone -- allows malicious users to spoof identities, and impersonate anyone they please. Making UIDs private and hashed, and having the session validated -- allowing only those with sufficient database permissions to query them, solves this problem, keeping attackers from accessing or intercepting them to change them.  Of course, this won't 100% solve all problems. There are other issues which can allow attacks through the cracks. That is why it is imperative for the forum pages to be secured with SSL, ASAP. Not having the login information encrypted is irresponsible. This is a tiny site, so it may never end up an issue, but you can not be too safe. I'll say it again, please make sure that your password is not at all related to anything you use anywhere else. As it stands, your info can be easily intercepted, and honestly, the more I find out about the security on this site, the more I worry about how passwords are stored. Another thing is that apparently this site is not version controlled. That is truly terrifying. 

(68) Views|(8) Comments

Update On Game 2018-08-05

   Between my job, working on my big site and blog -- on top of other projects, meetings, studying, cooking and cleaning, and dealing with disability I have precious little time to devote to this project. As such, I can make no estimate when I will launch the first demo.    Currently, I'm taking a moment to restructure and change the stack. I started with an HTML 5 template and plain old ES5. Actually, I'm still using ES5 because I want it to be as widely compatible as possible, but I needed a module loader (and figure I'll go with something that doubles as a task runner so I don't have to ship with MORE dependencies), so I'm going with webpack. I actually haven't needed a module loader before, so I'm having to learn it... And I'll be real, I'm not really sure how to properly unit test an HTML5 game. Of course, I resent it because then I'm dragged into using bloated Node just for one small thing. Plus I have to use JavaScript in the backend now, which makes me grumbly because I want to use as little of that horrible language as possible lol.

(48) Views|(1) Comments

View more