this post was submitted on 28 Sep 2023
323 points (75.7% liked)

Games

32919 readers
2075 users here now

Welcome to the largest gaming community on Lemmy! Discussion for all kinds of games. Video games, tabletop games, card games etc.

Weekly Threads:

What Are You Playing?

The Weekly Discussion Topic

Rules:

  1. Submissions have to be related to games

  2. No bigotry or harassment, be civil

  3. No excessive self-promotion

  4. Stay on-topic; no memes, funny videos, giveaways, reposts, or low-effort posts

  5. Mark Spoilers and NSFW

  6. No linking to piracy

More information about the community rules can be found here.

founded 2 years ago
MODERATORS
quinten
shitpostpolice
Dremor
[email protected]
323
Larion Studios forum stores your passwords in unhashed plaintext. (lemmy.world)
submitted 1 year ago by Cabrio to c/games
217 comments fedilink hide all child comments
 

Larion Studios forum stores your passwords in unhashed plaintext. Don't use a password there that you've used anywhere else.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 107 points 1 year ago* (last edited 1 year ago) (2 children)

Your guess is confirmed here.

There are plans to update the forum, including for better security (the main issue with changing the forum software is concern over reliably migrating all of the existing content). After emailing (admittedly not current best practice), the passwords are hashed and only the hash is stored.

...and later...

The forum has been updated to https, and passwords are no longer being sent by email.

Which raises the question of how old OP's screen shot is.

Also, no, the password would not necessarily still be stored in plain text on their end. The cleartext password used in that email might be only in memory, and discarded after sending the message. Depends on how the UBB forum software implemented it and how Larian's mail servers are set up.

EDIT: I just verified that this behavior has resurfaced since it was originally fixed. OP would do well to responsibly report it, rather than stirring up drama over a web forum account.

[–] Asudox 7 points 1 year ago* (last edited 1 year ago) (3 children)

It is still a bad idea to send the password in plaintext via email. You never know when Bard will peek a look and then share your password along users as a demo account to try that forum.

[–] [email protected] 15 points 1 year ago* (last edited 1 year ago) (1 children)

There's a lot of reasons why emailing passwords is not the best practice... But AI bots stealing your password to give people free demos is a wild paranoid fever dream.

EDIT: Apparently, I replied to a joke.

[–] Asudox -1 points 1 year ago* (last edited 1 year ago) (1 children)

It is meant to be as a joke, of course the AI is not that dumb enough to give it away as free demo. Why am I being downvoted? Why don't people understand jokes these days? Do I always have to include /s when making a sarcastic joke even though it is so obvious?

[–] elephantium 9 points 1 year ago

I've seen people argue stupider things earnestly.

[–] [email protected] 6 points 1 year ago

Nobody suggested otherwise.

[–] nogooduser 3 points 1 year ago (1 children)

You should always change your password from the system generated one to prevent that from happening. The app that you signed up for should enforce that by making you change your password when you log in.

[–] Cabrio 2 points 1 year ago

It's not a system generated one they sent, it was user generated.

[–] Cabrio 1 points 1 year ago

OP would do well to responsibly report it, rather than stirring up drama over a web forum account.

¿Porque no los dos?

Took them 23 years to fix it last time, seems public awareness would be important in the interim, no?