Wruczek/ts-website

Protect query_password

molidev opened this issue · 4 comments

molidev commented

Good morning, I saw on the database that query_password it´s store on text-plain.I would recommend you that store this field encrypt with (for example SHA-512)

Wruczek commented

Query password is not used for user authentication, it is send to the TeamSpeak Query Interface in the plaintext form. One-way hashing functions (like SHA*) will not work for that purpose.

The only option here would be not to hash, but to encrypt it. But I don't think it's worth it.

  • 👍2
Bluscream commented

The only thing we can do is base64encode/decode so it's not completely obvious

  • 👍1
Wruczek commented

Yeah, that will improve security by a lot XD

Bluscream commented

Yeah, that will improve security by a lot XD

Well, it will scare people that think everything with a = at the end is encrypted and the people that are too stupid to decode it.

  • 😄1