Bungee Additional Security Plugin

Please Note: The TotalFreedom Forum has now been put into a read-only mode. Total Freedom has now closed down and will not be returning in any way, shape or form. It has been a pleasure to lead this community and I wish you all the best for your futures.

    So this is something that I've come across and seems to be popular and I wanted to get peoples thoughts.

    I know a lot of concerns have come up with removing IP auth because you can't 2FA Minecraft accounts. This is a plugin solution to that problem at the bungee level.

    I'd appreciate what you guys think.

    Plugin Link - https://www.spigotmc.org/resources/gsa-locklogin.75156/

    Wild1145

    Network Owner at TotalFreedom

    Managing Director at ATLAS Media Group Ltd.

    Founder & Owner at MastodonApp.UK

    If it adds another step for regular players to join, then I object. Playing should be a simple click, and from experience, any servers with "extra" security plugins have a large number of people who join, see that, and immediately leave.

    I object if it's a requirement for players to join. Also, I object in general, since Minecraft accounts are about to migrate to a platform that is 2FA-enabled anyway.

    Object, I am all for security however, I do not think it is necessary for us to have any kind of 2fa on the mc server (unless its backend stuff, that can have 2fa), as mojang is now making accounts migrate to microsoft accounts so that way they have extra security, and I belive microsoft accounts also have 2fa, so i think its up to the player to have a secure account rather than doing something like this

    In a way isn't this a security risk? If an admin runs /login ProtonNeutronElectron (ProtonNeutronElectron is the pass) and another admin sees it through /cmdspy this poses a security issue as that password could be the password for said admin's accounts..

    @Ashaz#5720 I think the idea is that this would only be implemented in the hub, however if we are allowing direct connections to the other servers without needing to go through the hub you would be correct, either way, if its needed we can add an exception so that any /login command is not logged in cmd spy, however it would still be shown in telnet, and i have no clue if we can do anything about that

    So for clarity, if I were to implement this sort of thing, it would be optional especially for players, and would be opt-in. It's possible we might want to make it a requirement for admins for good practice, but my suggestion here was more around an opt-in system.

    These plugins also prevent such items from being picked up by command spy, and NetworkManagers command spy which we should end up moving people to have a list of excluded commands which we would make sure things like /login and /register are part of, but even if it did get picked up from cmdspy, a TOTP token value isn't something that is a major concern anyway on it's own, because anyone seeing it would see /login 123456 and those codes are generally valid for no more than 30 seconds anyway, It's a concern if you collated enough and back-engineered the TOTP Seed, but in reality that tends to be fairly rare and need a lot of skill and compute.

    Wild1145

    Network Owner at TotalFreedom

    Managing Director at ATLAS Media Group Ltd.

    Founder & Owner at MastodonApp.UK

    @DragonSlayer2189#5737 Even if it did what information does that give that could be used? It'll give a 6 digit TOTP Code which has a 30 second life span... I don't think it would be logged anyway but would need to check, but it's all down to what risk we're trying to mitigate here... I'm struggling to see the risk in an admin occasionally seeing a 6 digit TOTP code in the logs?

    Wild1145

    Network Owner at TotalFreedom

    Managing Director at ATLAS Media Group Ltd.

    Founder & Owner at MastodonApp.UK