GUID security

[Ligustah]

The current events have convinced me that we are indeed in need of better protection against GUID spoofing. I therefor will continue working on my authenticator plugin for the servers.

Each time a user connects to one of the servers, his info will be checked against a database that will be able to tell if that person is a GUID stealer. To do that, all members are required to 'claim' their GUIDs in that database (go here and upload your GUID to do that: http://board.twcclan.org/misc.php?twc=ident ). The database can then check if the person using your GUID on the server is really you (it will do so by comparing the IP used on the server to the last known forum IP). If not, it will simply disallow usage of !commands.

I think that's a fair trade, since it will stop any script kiddy GUID stealer, but won't stop you from playing, in case the system should fail for some reason.

This will probably go live sometime next week, so please report any problems you might encounter.

Thanks in advance.

-- Ligustah

[Chuck]

Lets hope for the best and we will see how its working.

[Andre]

Just a thing, since i use both pc/phone for check forum and while pc has a static ip instead phone not... I wont have commands right? ( correct me if im wrong, im a nab in these things :S)

I guess i should check forum with pc before playing.

Anyway i ll upload guid asap , thanks

[johny danger]

Before i upload my etkey, i want to be sure i upload the right file. I have Windows 7 Ultimate/32 bit, and i found an etkey here: C:\Users\andy\AppData\Local\PunkBuster\ET\etmain. Is this the good one?
Also i want to say that i have more ET instalations on my pc, so how can i now what Etkey to upload?

[Ligustah]

@Andre That is correct. I might provide an easier way for situations like that in future, but for now, I'm afraid you will have to login to the forum from your PC at least once every time your IP changes.

@Johny You can just as well upload all etkeys you find on your PC. It will list all your GUIDs then.


Also, I didn't mention: I'm not saving your etkeys anywhere on the server. They are only temporarily used to calculate the GUID (i.e. to prove that you own that GUID).

[Destroy666]

@Andre That is correct. I might provide an easier way for situations like that in future, but for now, I'm afraid you will have to login to the forum from your PC at least once every time your IP changes.

Can't check it maybe by getting an unique key for submitted GUID on forum and entering it as cvar in console/cfg like /twc_adminkey F56KAgD? But that may be problematic when 2 people use same ET with another GUIDs.
But yea, last IP ain't a bad solution even though it may be annoying in some situations.

[Ligustah]

Setting it via cvar (in an unmodified client) will automatically broadcast it to all servers you will connect to, which more or less undermines the purpose.
I thought about adding some sort of pin code that you can use to authenticate even if your IP is different.
Like a 4 digit code you can look up on your profile.

-- Ligustah

[John]

When you upload your etkey it says name: blaaaa and access: bluuuu
Will this change when the plugin goes live?

---

i don't see a problem in checking in on forum before playing btw, its just a few clicks

[Ligustah]

I'm currently working on that, yes.

The new page will be over here: http://board.twcclan.org/misc.php?twc=ident
Though I will probably break it quite some times throughout the day.

Also, now that you are asking, you can try connecting to one of the servers to see if it actually works :P

[John]

Seen: 2012-12-14 12:48:43
Name: ^3-^7TWC^3|^7John^3|^8MST^3-^7

Gues it works