c25a644a33
Every ModernUO shard has always run Argon2, so the RunUO/ServUO migration shapes the repair path existed to recover do not occur in practice. It was never free: it retried a failed verify against the other phrase rule, and nothing in a stored hash separates a mis-migrated credential from a password that merely begins with the username -- which is why it needed a per-account tag on top of the config switch to be safe at all. Removing it takes accountSecurity.repairMigratedPasswords, the RepairPasswordTag opt-in and the forced rehash with it. The rehash on a successful login is now implicit: stale algorithm or stale parameters, nothing else. Also trims the development narrative out of the comments left behind. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Security | ||
| Account.cs | ||
| Account.Migrations.cs | ||
| AccountComment.cs | ||
| AccountHandler.cs | ||
| Accounts.cs | ||
| AccountTag.cs | ||
| IPasswordProtection.cs | ||