From b95be044bd666de12899d8c215c9e2f94b9f0c68 Mon Sep 17 00:00:00 2001 From: Kamron Batman <3953314+kamronbatman@users.noreply.github.com> Date: Sat, 8 Aug 2026 22:43:48 -0700 Subject: [PATCH] docs: say why a cheap digest still earns its thread hop The comment conceded a needless hop for MD5 and SHA1. It is not needless: AccountSecurity.Configure refuses anything below SHA2 as the configured algorithm, so those only ever appear as a stored hash awaiting migration. That makes NeedsPasswordUpgrade true, so the job carries the upgrade hash and the microsecond digest is never the whole job. --- Projects/UOContent/Accounting/AccountHandler.cs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Projects/UOContent/Accounting/AccountHandler.cs b/Projects/UOContent/Accounting/AccountHandler.cs index 17ee2f809..4f32b3e62 100644 --- a/Projects/UOContent/Accounting/AccountHandler.cs +++ b/Projects/UOContent/Accounting/AccountHandler.cs @@ -398,8 +398,12 @@ public static class AccountHandler /// /// Hands the password check to the worker, whatever algorithm it uses. Every protection is safe - /// to run off the loop, so there is no carve-out; a cheap digest pays a thread hop it does not - /// need, but login latency is not what this is protecting. + /// to run off the loop, so there is no carve-out. + /// + /// Nor is a cheap digest worth carving out. AccountSecurity.Configure refuses anything + /// below SHA2 as the configured algorithm, so MD5 and SHA1 only ever appear as a stored hash + /// awaiting migration -- which makes NeedsPasswordUpgrade true, and the job carries the + /// upgrade hash that dominates it. The microsecond digest is never the whole job. /// private static PasswordCheckDispatch DispatchPasswordCheck(AccountLoginEventArgs e, Account acct, string pw) {