A great idea ( I Think) : SWG Premium Discussions

I'd insist on tault_admin reviewing all the code being uploaded to the server, but you have a very good point on the inclusion in client programs. Idea for that would be that the client program opens up a taultunleashed.com hosted web page where you have to sign in, and that that session gets marked active on the server and the client program gains word of that... Thus the client never gets told the user's password. Idea for implementation would be:

Client->Server: Requests session ID
Server->Client: Have a session ID (f9ea827850ae6457edfade5b696c206c for example)
Client: Opens up webpage: Register to unlock hidden link
User: Logs in on webpage
Client: Checks periodically for to see if said session ID has been authenticated

But idk, this might become a bit of a hassle. Usage for that could be that a client could remember its session ID which, for example, could be linked with the computers hardware ID and IP number, and thus only need to login once.

Another simpler idea is: Give every user an 'authentication token' in their user profile that they can regenerate on will, which isn't connected to the actual username/password combo. Much like API keys.

Imo...

TU needs 2 scripts to support 3rd party logins.

1) A tool/widget on the forums that is available to premium accounts only. It will generate a random code thats only valid for that account and expires either.. in 5 minutes, when used to login with a 3rd party app or if they generate a new code. (Note: Adviced to setup a CAPTCHA on the generator)
2) People enter the code into the 3rd party app, it submits the code to a script on TU for validation. If validated the session is purged so it cant be used to login anymore.

So its a session-enabled password for 3rd party apps only, keeping the forum login seperate.

Possible Security Related Bonuses:
If more than two IP's successfully login/validate within 24 hours, suspend the account from using 3rd party apps pending further investigation.
Restrict login so the ip which generated the code is the only ip that can login using that code.
Three incorrect codes entered results in that ip being banned for 60 minutes.

Well what languages are you mainly coding in. I need a list. Then we can have a auto convertor that will put in the protection automatically.

Do you mean like a wrapper? Application that packs & encrypts the .exe in itself and then decrypts and executes it on the fly?

Yea thats the main plan r04r. It will take the app and encrypt it with protection automatically on the fly

That's awesome, unfortunately I'm not capable in assisting with creating that:P

or use a mid server that tault sets up that we contact with and use the serv er for the database queries? Secure easy and quite simple really