Strengthening hash

[PEMapModder]

Hash security can be strengthened with salt. If you add the username as salt (remember to make it case-insensitive) to the password, in case the database is leaked, it is less easy to find out that two people have the same password.

[Flavius12]

Thanks for the suggestion 👍

[PEMapModder]

Note the difficulty of backwards compatibility. You might need to hash with both algos, delete old hash and store new hash when players login so as to support hashes generated in previous versions.

[Flavius12]

Ok. I'll keep this in mind

[PEMapModder]

I just found this from php.net, explaining the danger of directly using a simple hash algorithm.

[PEMapModder]

This might give some inspiration PEMapModder/HereAuth@7e5836c

[Flavius12]

Thanks 😄

[legoboy0215]

Use password_hash. BCrypt 4 life.

[Flavius12]

A new multi hash feature is coming to the new version of ServerAuth.

[Flavius12]

Coming in v3.0