e7ab7e8738
Accounts corrupted by the pre-fix SetPassword hold argon2(username + password) tagged with an algorithm whose phrase rule omits the username. Nothing in the hash distinguishes that from a forgotten password, so the only detection is to retry with the other phrase on a failed verify -- which doubles the cost of every failed login, and failed logins are the credential-stuffing surface. Hence accountSecurity.repairMigratedPasswords, default false: an operator turns it on for a migration window and off again. Repaired accounts are force-rehashed because their stored parameters may already be current, in which case NeedsRehash would decline and the account would verify once and stay broken. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Accounting | ||
| Engines | ||
| Gumps | ||
| Items | ||
| Misc | ||
| Mobiles/AI | ||
| Multis | ||
| Network | ||
| Skills | ||
| Spells | ||
| Utilities | ||
| WorldSaves | ||