LoginCustom Beta 3 Dev 2 — Minecraft 1.16–1.20

LoginCustom Beta 3 Dev 2 — Minecraft 1.16–1.20

This beta focuses on account security for Bukkit, Spigot, Paper, Purpur,
Velocity and BungeeCord networks.

What's new

• Optional TOTP two-factor authentication with /2fa.
• AES-256-GCM encrypted authenticator secrets.
• Persistent protection against reusing an accepted TOTP interval.
• Ten high-entropy, one-use recovery codes stored only as HMAC hashes.
• External versioned password pepper keyring in password-peppers.key.
• Transparent upgrade of valid older password hashes after login.
• Database identity claim prevents starting with the wrong pepper keyring.
• Schema v4 for SQLite and MariaDB.
• Console-only, confirmed /logincustom reset2fa <player> [confirm].
• /logincustom doctor now checks the password pepper and 2FA subsystem.

Installation

Install exactly one server JAR: Paper or Bukkit. Networks additionally install
the matching Velocity or BungeeCord JAR and require shared MariaDB storage.
Every backend connected to the same database must receive an identical copy of
password-peppers.key and the network secret.

The complete automated suite, real MariaDB integration and Paper 1.16.5 smoke
test passed before publication.