BlueEG Posted June 22, 2019 Posted June 22, 2019 (edited) https://s2.europeangangsters.com/ Text based mafia game with the aim to provide a responsive layout for all users. Alot of time and effort has gone into this, feedback would be much appreciated. Username: MWGDemo Password: demo Edited July 2, 2019 by BlueEG 2 Quote
BlueEG Posted July 2, 2019 Author Posted July 2, 2019 (edited) 8 hours ago, radio_active said: Do you have a demo account we can try? Username: MWGDemo Password: demo Edited July 2, 2019 by BlueEG Quote
DAMINK Posted July 2, 2019 Posted July 2, 2019 Registered. No validation required.... Ok. Got an email sent to me anyway with what appears to be an attempt to send me my password back? "Dear DAMINK, you are now registered at European Gangsters, you used the ip xx.xxx.xxx.xxx To login, simply go to EuropeanGangsters.com and enter in the following details in the login form: Username: DAMINK Password: Please print this information out and store it for future reference. Thanks," If so then i have a couple of concerns. 1) Are the passwords salted? or secured in any way? 2) Sending info like username and passwords over email is a bad idea. A NO NO infact! Make a recovery form with some sort of token. Quote
BlueEG Posted July 2, 2019 Author Posted July 2, 2019 1 hour ago, DAMINK said: Registered. No validation required.... Ok. Got an email sent to me anyway with what appears to be an attempt to send me my password back? "Dear DAMINK, you are now registered at European Gangsters, you used the ip xx.xxx.xxx.xxx To login, simply go to EuropeanGangsters.com and enter in the following details in the login form: Username: DAMINK Password: Please print this information out and store it for future reference. Thanks," If so then i have a couple of concerns. 1) Are the passwords salted? or secured in any way? 2) Sending info like username and passwords over email is a bad idea. A NO NO infact! Make a recovery form with some sort of token. Passwords are encrypted with BCrypt And the password sending was removed after the testing phase, we just missed off removing from the email To reset password we have it send an auth code to the email which you enter upon a reset password page to change the password. Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.