XMPP Based Authentication - Revision history

Cadillac at 18:23, 24 August 2021

2021-08-24T18:23:38Z

← Older revision		Revision as of 14:23, 24 August 2021
Line 39:		Line 39:

	Since the involved packets would not be a regular message type, non-game clients would ignore it (at least from the user's perspective) and only (a little) bandwidth is wasted.		Since the involved packets would not be a regular message type, non-game clients would ignore it (at least from the user's perspective) and only (a little) bandwidth is wasted.

			[[Category:Development]]

Luke-Jr: /* Spam Attack */

2006-03-08T02:47:47Z

Spam Attack

← Older revision		Revision as of 22:47, 7 March 2006
Line 35:		Line 35:
	An evil server sets some innocent bystander's IM address as its own, clients will try to send messages to it, the bystander complains, and the players' accounts get suspended.		An evil server sets some innocent bystander's IM address as its own, clients will try to send messages to it, the bystander complains, and the players' accounts get suspended.
	Countermeasure: the master server protocol needs to be reworked to go over IM, so the master can verify the servers' accounts.		Countermeasure: the master server protocol needs to be reworked to go over IM, so the master can verify the servers' accounts.

			:: Since the master server protocol would need to be reworked anyway (to get IM addresses instead of IP/hostname pairs), that would be a good idea-- though it does create a dependency on the master server. --[[User:Luke-Jr\|Luke-Jr]] 20:47, 7 March 2006 (CST)

			Since the involved packets would not be a regular message type, non-game clients would ignore it (at least from the user's perspective) and only (a little) bandwidth is wasted.

Z-man: /* Spam Attack */

2006-03-07T07:30:07Z

Spam Attack

← Older revision		Revision as of 03:30, 7 March 2006
Line 34:		Line 34:

	An evil server sets some innocent bystander's IM address as its own, clients will try to send messages to it, the bystander complains, and the players' accounts get suspended.		An evil server sets some innocent bystander's IM address as its own, clients will try to send messages to it, the bystander complains, and the players' accounts get suspended.
			Countermeasure: the master server protocol needs to be reworked to go over IM, so the master can verify the servers' accounts.

Z-man: /* Spam Attack */

2006-03-07T07:28:51Z

Spam Attack

← Older revision		Revision as of 03:28, 7 March 2006
Line 33:		Line 33:
	=== Spam Attack ===		=== Spam Attack ===

	~~I login to a~~ server ~~using a random~~ IM ~~user ID repeatedly. The server sends~~ its messages to ~~that ID~~, the ~~user calls the abuse squad~~, and the ~~server~~'~~s IM account gets suspended for spamming.~~		An evil server sets some innocent bystander's IM address as its own, clients will try to send messages to it, the bystander complains, and the players' accounts get suspended.

	~~Countermeasure: have the client contact the server over IM instead. But then, an evil server can~~ get ~~the players spam-~~suspended.

Z-man: /* Attack Vectors */

2006-03-07T07:27:28Z

Attack Vectors

← Older revision		Revision as of 03:27, 7 March 2006
Line 30:		Line 30:

	DNS poisoning.		DNS poisoning.

			=== Spam Attack ===

			I login to a server using a random IM user ID repeatedly. The server sends its messages to that ID, the user calls the abuse squad, and the server's IM account gets suspended for spamming.

			Countermeasure: have the client contact the server over IM instead. But then, an evil server can get the players spam-suspended.

Z-man: /* Attack Vectors */

2006-03-06T23:24:09Z

Attack Vectors

← Older revision		Revision as of 19:24, 6 March 2006
Line 20:		Line 20:

	== Attack Vectors ==		== Attack Vectors ==

			All possible security issues of the used IM system will be inherited.

	=== The Phishing Server ===		=== The Phishing Server ===

Luke-Jr at 14:36, 6 March 2006

2006-03-06T14:36:28Z

New page

This page is intended for fleshing out the details of a simple authentication scheme.

== The Authentication ==

* The client logs into the player's IM account and sends a join request to the game server's IM address.
* The game server sends a random session identifier, along with its connection information (hostname/IP and port) to the client.
* The client connects to the game server's supplied connection info.
* The client sends the session identifier back to prove it is the original player to contact the game server.
* The server now knows that the client indeed represents the player it claims to.

== Stats and Conversation ==

The game server deals primarily with an IM address or, in the case of an anonymous player, a guest name, which is enclosed in double-quotes.
All conversation and stats are recorded by this identifier.
For example, when sending a chat message to another player, the server will transmit something along the lines of: luke@dashjr.org says, "Hi!"

== Displaying Names For Players (Name Resolution) ==

If the IM address luke@dashjr.org appears on the player's roster/buddy list, the associated nickname is displayed instead. If not, the full IM address is displayed.

== Attack Vectors ==

=== The Phishing Server ===

I can't see a possibility here.

=== Faking the Authentication Server ===

DNS poisoning.