Replay Mod Forums

Truncation of long passwords when creating account
    • User
    • 2 forum posts
    User9754
    #1

    Aug 25 15, 10:40 PM

    When creating an account through the Minecraft client when starting the mod for the first time I have filled in a 64 character password (using KeePass to store passwords so why not use proper ones). Creating the account went fine and the client logged in, however when I tried to login to the website with the saved password it said that the password was incorrect.

    A problem I encountered on a couple other sites/services is that the filled in password is (silently) truncated before saving to the database, and therefore the password is incorrect.

    With the "Forgot password" link I have recovered my account, so there is no immediate problem, but it would be nice if this issue could be looked into (in my opinion there should not be a limit on password length, or at least one that is stupidly high).


    • Developer
    • 818 forum posts
    User1

    in response to User9754

    #2

    Aug 26 15, 12:07 AM


    When creating an account through the Minecraft client when starting the mod for the first time I have filled in a 64 character password (using KeePass to store passwords so why not use proper ones). Creating the account went fine and the client logged in, however when I tried to login to the website with the saved password it said that the password was incorrect.

    A problem I encountered on a couple other sites/services is that the filled in password is (silently) truncated before saving to the database, and therefore the password is incorrect.

    With the "Forgot password" link I have recovered my account, so there is no immediate problem, but it would be nice if this issue could be looked into (in my opinion there should not be a limit on password length, or at least one that is stupidly high).

    The password is not being silently truncated, the input field in-game only accepts up to 30 characters, which is truncated when pasting the password.
    I will however change this in a future version to disallow passwords longer than 30 characters by increasing the text input's max length and showing an error message, if that's good. Alternatively, I could raise the max password length to 128, if that's any better.


    • User
    • 2 forum posts
    User9754
    #3

    Aug 26 15, 12:37 PM

    Thanks for your reply, increasing the maximum length would indeed be a good idea, and showing some kind of error message is indeed helpful for finding out that the password cannot be longer as X characters.

    Something that might be useful here for the forums are email notifications if someone replies to your thread, I saw your reply because I went to the website, but I imagine that a lot of people forget to do this.


    • Developer
    • 818 forum posts
    User1
    #4

    Sep 04 15, 01:29 AM

    The maximum password length was increased to 1024 in Version 1.0.4 of the Mod.