SRL Archive - Discussions and Debates

One thing I dislike about the usermanager is that it stores passwords in plain text in the chars.srl.
Anyone else thought of a need for something different?

Such as an encryption that needs a master password/key to unlock.

If theres no way to get an encryption scheme in scar, then Ill make a php script that can do it.

Id do this, but look at my sig.

lol the only problem is you cant encrypt the encrypter so how the hell can you have a safe encryption :P

EDIT: make it a plugin and it would work lol

what are you worried about?
somebody hacking into your computer just to steal your runescape passwords from a file?

most "hacking" is done through keylogging or straight up password guessing, which encryption wouldnt protect against

if you are worried about somebody that uses your computer stealing your stuff, i suggest your set your file permissions carefully

do you really have someone who uses your computer that wants to steal your RS passes? Prob not. Anyway the only real problem would be if you sent the file to soeone else who didnt have it and they got the passes……So people rember to whipe it clean before giving your friends SRL.

Just make sure your runescape password is diffrent form everything else e.g. hotmail and i dont see the problem if you realy want a dll to do encription i have one alreadly made it would jsut need a small mod to make it work with scar. i made it for DBpro a while back so if you want it just email me and i will send it to you.

What if we put it into a SaveSettings array kind of thing.

So:

for I := 1 to AmountOfChars do
  SaveSetting('SRL', 'Blah', 'Blah' + IntToStr(I));

Then just vice versa for loading. It would require a bit of SCAR knowledge to find out the password. I mean, a normal, everyday leecher would have no clue.

Or like Mutant said you could use a plugin. But honestly, I don't really care too much.

Mad Cow

From: t3h ub3r k1tten
One thing I dislike about the usermanager is that it stores passwords in plain text in the chars.srl.
Anyone else thought of a need for something different?

Such as an encryption that needs a master password/key to unlock.

If theres no way to get an encryption scheme in scar, then Ill make a php script that can do it.

Id do this, but look at my sig.

This is overkill but very effective… just use this for your whole SCAR folder and you will never worry again about anyone stealing any of your scripts or passwords again. Here's the link => True Crypt

T r u e C r y p t Free open-source disk encryption software for Windows XP/2000/2003 and Linux

Main Features:

• Creates a virtual encrypted disk within a file and mounts it as a real disk.
• Encrypts an entire hard disk partition or a storage device such as USB flash drive.
• Encryption is automatic, real-time (on-the-fly) and transparent.
• Provides two levels of plausible deniability, in case an adversary forces you to reveal the password:
1) Hidden volume (steganography – more information may be found here). 2) No TrueCrypt volume can be identified (volumes cannot be distinguished from random data).
• Encryption algorithms: AES-256, Blowfish (448-bit key), CAST5, Serpent, Triple DES, and Twofish.
Mode of operation: LRW (CBC supported as legacy).
• Conceived in 2003. Further information regarding features of the software may be found in the documentation.

No, nobody gets it.

If you used something like a Sha1 encryption, and it required a key to decrypt.
At least keep novices from being able to read it.

So, like a php script called from scar.

I wish I had time to make it.

The problem with this is that anyone could read it if it had a key to decrypt

lol bam bam, thats the whole point, the key is like a password that only you know

i looked at that true crypt, its a nice little program, i dont acctually have a use for it, no-one who cares about runescape uses this computer

I use true crypt all the time on my laptop… all my work related stuff goes there just in case someone steals my computer. It is an amazing little program and best of all its open source and free!!!!

*goes and gets open source*
*steals your comp*
*decrypts it because the program was open source*
*has all you st00f*

reasons to hate open source and reasons to love it…..

either way all someone has to do is take your script with your encrypted pass. Keylog himself and run it having it login and type the un encrypted password…. not that hard to get around lol

I don't think you have looked at this program yet… key logging me will not give you enough info to decrypt my computer, nor would looking at the source code… it is a trully remarkable program. If your fanatic about security… this is the answer. Don't argue with me about it, I just use the product, go to thier site and post questions so guys who actually code it can give you the breakdown. If you do find a hole, they will fix it in no time flat (that's the power of open source).

From: Mutant Squirrle
*goes and gets open source*
*steals your comp*
*decrypts it because the program was open source*
*has all you st00f*

reasons to hate open source and reasons to love it…..

either way all someone has to do is take your script with your encrypted pass. Keylog himself and run it having it login and type the un encrypted password…. not that hard to get around lol

Stay on topic lol ;)

Thinking of something different though, how bout an online based system?
Ill design and/or host it.

A web interface to add players under a master user/pass.
The master pass would be md5 encrypted

Srl calls various php scripts using the internal webbrowser like:
Login using session cookies
login.php?user=foo&pass=bar

Get number of users for later
usercount.php

Get username of a user within the amount above
getusername.php?id=1

Get pass
getuserpass.php?id=1

Get loc
getuserloc.php?id=1

…
etc.

logout.php

All of this would be done in mysql and php.
And everything would be mysql safe escaped you naughty hackers ;)

And there would be a special ability where a script could put status reports in a field to tell you whats going on, like how much mined randoms etc.
That could be accessed anywhere :D, and maybe even allow commands to be sent to the script.

Of course, some may not like that, which is totally understandable, as everything is stored elsewhere.
Post opinions, im getting started on it.

i would be very inersted in helping you if you wanted to do this project idea i think it would be very helpfull to lots of people to get script reports online and also stop start and basicly control the scripts i know delphi and i am able to make dll plugins for scar so if you still want to do this then just drop me a line.

No thanks warship.

Just to let people know, the php/mysql scripting for it is nearly finished.
So far:
Registering
Logging in
Getting Users

To Do:
Making users
Changing user stats
(These are all php scripts I hand made, the todo things I currently have to manually use phpmyadmin to do)

It will be hosted at cyberdesignhq.com (Unless someone wants to give me a cool domain like srl-online.com or something :D)

http://www.serviceuptime.com/users/statistics.php?Id=919

Currently Closed Beta, and any admins who want a look at the source ask.

i know you've already made most of the site, but a simpler solution could be to put Chars.srl on a USB storage device or floppy disk and carry it around with you (you can hang some USB devices around your neck)

MD5 'em all!

Your system will get penetrated if you browse xxx sites without any knowledge of security :-)

So don't browse xxx sites, instead buy pr0n magazines! (You can take them everywhere!)

I'm very good at building encryptions if i say so myself, i could possibly code an encryption plugin for these strings…

From: c0de
MD5 'em all!

Your system will get penetrated if you browse xxx sites without any knowledge of security :-)

So don't browse xxx sites, instead buy pr0n magazines! (You can take them everywhere!)

im not 15 send me!

From: c0de
MD5 'em all!

Your system will get penetrated if you browse xxx sites without any knowledge of security :-)

So don't browse xxx sites, instead buy pr0n magazines! (You can take them everywhere!)

im not 15 send me!

ín scripts that are selled.. the auth username and password are (usually) example in this type:


var password: integer;
//setup;
begin
password = xxx; //this it the password thingy.
if(not(password = chr(24) + chr(24) + chr(24))then
begin
terminatescript;
writeln('Incorrect Password')
else
begin
if(password = chr(24) + Chr(24) + chr(24))then
begin
Writeln('Password Correct, Script Executed')
end;

something like that not sure if it will compile