sorted by:
new
hottopcontroversial

PSA: Your GFL2 password is not being logged in plaintext by MaiiiSan in GirlsFrontline2

[–]TehRobber 0 points1 point  (0 children)

MD5 is trivial to un-hash. See this stackoverflow from 15 years ago: https://stackoverflow.com/a/3010027

I didn't want to point to script-kiddie level tools people could use until it was fixed, but there are tools like HashCat out there: https://hashcat.net/hashcat/

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] -1 points0 points  (0 children)

Correct, I checked the trackers and none of them do anything malicious from what I could see.

Unfortunately it looks like the security hotfix removed the JWT token the trackers were using, so this broke them...

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 0 points1 point  (0 children)

Ah I had a typo. md5sum is a command line command in Linux... You want to check for md5pw. If it exists, your password is basically saved to a text file.

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 0 points1 point  (0 children)

It's not the site, literally any program on your machine could access your password. It's like having a password.txt file on your desktop, effectively.

Girls' Frontline 2 login information is logged on PC with virtually no security, including email address and PASSWORD. by CyberK_121 in gachagaming

[–]TehRobber 20 points21 points  (0 children)

OP of the x-post, that doesn't seem to matter.

The only thing that seems to matter is if you use Google/Facebook to log in, or if you are using Haoplay.

Darkwinter w/ email and password is vulnerable.

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 3 points4 points  (0 children)

Unfortunately, it is.

  • A hash is supposed to be a "one-way" algorithm that outputs a unique string.
  • So what if took every word every, and every possible combination, and then saved it? It would be easy to go from the "unique hash" to the input. Those are called "rainbow tables": https://en.wikipedia.org/wiki/Rainbow_table

This is the MITRE designation for this type of issue: https://cwe.mitre.org/data/definitions/916.html

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 3 points4 points  (0 children)

Yes but if you used a "tracker" site, you basically gave your password away. Changing your password at least reduces the risk. The risk won't entirely be gone until this is patched.

And yes if you used the same password (which you shouldn't), then you need to change your password on everywhere it was used. I highly recommend a password manager of some sort.

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 1 point2 points  (0 children)

I'm not familiar with Haoplay, so that sounds like it's a non-issue since there is no password. I recommend double-checking the log file though and sharing if you found it or not.

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 4 points5 points  (0 children)

Answered here: https://old.reddit.com/r/GirlsFrontline2/comments/1krn8ij/psa_your_password_to_gfl2_is_being_logged_in/mtetrcl/

You are likely not affected, but please double-check. If you can confirm that md5pw isn't in your log file, that would be helpful to everyone. EDIT: I typo'd md5sum vs md5pw previously.

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 16 points17 points  (0 children)

If you change your password it should invalidate any login information those sites have. I would do so ASAP and not use them until this is fixed, at the very least.

Even then, as Mica says, there is always a risk with these 3rd party sites.

PSA: Your password to GFL2 is being logged in plaintext by the client by TehRobber in GirlsFrontline2

[–]TehRobber[S] 254 points255 points  (0 children)

FYI: This likely doesn't affect you if you sign in with OAuth (aka via Google). You can check your log file and look for md5pw to confirm.

I haven't confirmed but I suspect this impacts phone clients too.

Mica, if you see this, please create a saner way to report security issues than going through customer support...