@bazola does the files contain anything other than usernames and passwords? What about hashing the passwords? Why not name the files to the same name as the username?
right now no, but i am thinking i will add the player data string on the third line. you are definitely right that I should just check the file name, as that is the same as the players username. I thought about using the encrypted value of the password instead of the decrypted version but I am still not totally sure of the best practice. I could implement something like bcrypt since this is on the server
right now i am using a cipher encrypter so that at least it is not plain text. ssl would be best but that is complicated because of the websocket thing
@bazola Where did you read this ? I really think it's a good idea, the less time the password is in clear, the less time it is more vulnerable.
It protects against attack where you don't have access to the client machine but you can listen or orchestrate a MITM between the client and the server
Personally, I would say you're doing it wrong. I wouldn't hash a password on the client side (which is what GWT is). If you hash your password, you will undoubtedly want to salt it, otherwise you will be susceptible to rainbow attacks. If you hash + salt it on the client side, your salt will be a...
@Marc-Andre i think the basic reasoning that I have been reading is that if you hash on the client side, then a man in the middle could use that hashed object to authenticate itself with the server without actually knowing the password
You can use gwt-crypto to generate SHA-1 hashes on the client side using:
String getSHA1for(String text) {
SHA1Digest sd = new SHA1Digest();
byte[] bs = text.getBytes();
sd.update(bs, 0, bs.length);
byte[] result = new byte[20];
sd.doFinal(result, 0);
return byteArrayToHexString(resu...
@bazola If you can make a MITM attack, you have many more things to worry than using the hash password for authentification... if the password is in cleared, what is the diffence ? At least if it's hash he does not know the password and can't use it on other sites
@SimonAndréForsberg have you thought about the implications of the code being open for viewing as javascript after GWT compiles it? i'm not sure if the code in that answer would be vulnerable to that or not
@Marc-Andre i admit that i wanted to build a simple cipher mostly as a learning experience, but isn't it mostly as effective as anything else at preventing eavesdropping attacks?
@SimonAndréForsberg thats what i mean, so if you have your encryption code in the browser, if the hacker really wants that password he can reverse engineer that to get it
@bazola Overall, I don't think you need to worry too much about any attacks in this case. As long as you're not dealing with real money, or very sensitive user data, there is not much of a reason to attack you in first place.
yeah i agree its not really a concern here, as i will never have any payment information transferred with this system, but its still good to think about it
@bazola To get what? The method of encryption you use ? Who cares ? The password is not in the code, just as a content of a variable. He need to 1. do CSRF attack or 2. listen to the connection to intercept something somehow.
@SimonAndréForsberg Unless someone use the same password for another site...
@bazola still adds an additional layer of security compared to if the password is sent in clear text. Besides, hash-algorithms are one-way algorithms. Once you get the computed hash, it is computationally speaking impossible to get the real password back.
Anyway I can tell that any serious site is using bcrypt to hash the password... there you go
@SimonAndréForsberg All I'm saying is it's not because you don't any important data that you won't be targeted... weak site are targeted everyday because it's easy and doesn't hurt to have a password db to create hash
i guess i fully understand now, since what you save on the server side is the hashed version of the password and not a decrypted version
but, i would then need to ensure that the encryption is the same on multiple platforms, because different hashing algorithms would produce different results with the same password as input?
@Marc-Andre I'll see if JSDT can add functionality, haven't tested it much in STS to actually run and debug JS, assuming it can at least do the basic client-side stuff without even firing up Tomcat
I am having some issue to use PHP5 password_hash() function. My server is not supporting it, so I am using a function to hash. Is this one secure?
public function Pass_Hash ($password) {
$blowfish_salt = bin2hex(openssl_random_pseudo_bytes(22));
$hash = md5(crypt($password, "X1;G^C...
@bazola Sure but you need to inform you're user if the password mechanism is not secure, so that they can use a password that will not affect other accounts
some algorithms (blowfish in PHP for example) store the generated salt inside the hashed result, so it is aware of its own salt, then you use that salt to make sure that the hashed password matches the non-hashed one.
@SimonAndréForsberg Is the Cardshifter version in the js branch compileable, as far as you know? I couldn't figure out how to compile it in Eclipse last night, just wanting to make sure it's user error and that it is supposed to compile
@SimonAndréForsberg I'm about to make these changes (change apply: from array to object) so the values can be referred without using indexes. See any problem with doing this?
@sᴉɔuɐɹɥԀ for the health, use "health: 1" in the values section. creature type can also go to values section. no attack can also go to values (or elsewhere), name it whatever you'd like.
So... OK. Would anything need to go into an apply then? My thinking was that values would just be arbitrary data, while apply would be calls to functions
@sᴉɔuɐɹɥԀ between those two alternatives, I think using as array would be better. they don't need to be referred with indexes, the array could just be looped over. (the whole apply concept in JS would be a bit wicked though, as the methods would have to return something, which I don't yet know what...)
@sᴉɔuɐɹɥԀ hmm... actually, that might not be a bad idea after all. Then we'd just need to define what is value and what is function. However, calling functions on the entities can be done anyway, without putting them in apply: [ ... ]
@sᴉɔuɐɹɥԀ I think that makes sense, yes. Then some different functions can loop over the data and apply the values somehow...
the real 'problem' is about the effects though. Stuff like "Heal 1 HP at end of turn", "50% chance to draw an extra card at the start of your turn", "Take 1 damage at the start of your turn"....
That was kind of my idea of calling functions by name within JSON. Once we iron out the code logic for the simpler effects, like noAttack it would lay down kind of a template to use for more complex functions, I think
Like applyHealthEOT(1) (or -1 or whatever) or applyDrawCardEOTChance(0.50)
@sᴉɔuɐɹɥԀ I don't think "noAttack" and "heal 1 HP at end of turn" are that similar....
@sᴉɔuɐɹɥԀ okay, I understand your thinking there... but it's... complicated. And things like applyDrawCardEOTChance is waaaaaaaaaay too specific of a function for my taste. It really consists of these parts: 1. At end of turn, do something. 2. A chance to do something. 3. A player should draw a card. 4. The player is you. (3 and 4 can be merged into one)
Effects of card could work something similar as cards.onSomething(function). You would define what the function is and can have access and the onSomething registered an event somewhere that need to execute it at the rigth which could depends on the onSomething(). (I've not read everything so I may be off in the discussion)
@SimonAndréForsberg Good point on the "too specific". There's always the option of writing a small function in the JSON card that would call the 3-4 specific functions in combination. Think that would be more flexible?
@Marc-Andre okay, then I know what you are talking about.
@sᴉɔuɐɹɥԀ Better, I think. Not entirely syntatically correct and also a bit messy... (what if the action would have more parameters? you are only passing 3 parameters to the "EOTAction" call there). I can show an idea I got quite recently...
from a back-end perspective, I think it should be possible to accomplish. I have a few ideas for how it could be implemented on the back-end, and probably quite extensible as well... will probably bump into some problems along the way, but those should be solvable.
@Marc-Andre not necessarily. A modder could add some hooks that can define the "chance" stuff, and it could also be done to work with POJSF (Pure Old JavaScript Functions) as well.
Well then you more advance in the concept of modding that I think you were. Nice. Still need to read the code... I need to understand more things, so that my input would mean something.
@SimonAndréForsberg quick question... Would it be smarter for card values to use the same nomenclature as in the PhrancisGame.PhrancisResources enum? e.g., ATTACK_AVAILABLE: false vs. noAttack: true
@bazola Nashorn doesn't convert into Java. It is a JavaScript engine written in Java. It will essentially call JS code from Java. But yes, it is the Nashorn thing.
@sᴉɔuɐɹɥԀ In the current PhrancisGame, ATTACK_AVAILABLE is the number of times a creature can attack. It's an integer value, not a true/false thing. It could probably be implemented as attackAvailable: false, but at the moment I'm afraid it has to be noAttack: true (or a rename to attackAllowed, in which case it can be set to false of course. As long as it doesn't collide with attackAvailable)
@bazola Not really. Just like JS code is called from Java, Java code can also be called from JS. So the ECS core can continue to be Java.
@sᴉɔuɐɹɥԀ It would make sense, yes. But there are currently other things interfering which doesn't make it possible at the moment. At the beginning of each turn, ATTACK_AVAILABLE is set to 1 for all creatures that can attack.
@skiwi You can't capture everything, no. But you can provide helpers, and you can allow modders to make helpers themselves. And as a fallback, there is support for POJSF.
@skiwi Personally, I like the JSON way more. I think defining objects like in your code there and providing functions to them is a bigger hussle. (and as a side-note, game.withProbability(0.5).opponent() is a rather weird call chaining I think...)
@sᴉɔuɐɹɥԀ Fine by me. Just one two things: There's nothing indicating that the enchantment is an enchantment. If you want, you can remove the values wrapper and put all the values inside there, outside instead.
I guess the values wrapper doesn't really do much at all. How would you suggest to represent enchantments/effects? In a wrapper? Or just different naming?
@sᴉɔuɐɹɥԀ Anything can be implemented, I have no strong preference one way or the other. It might make things more organized, but it should be clear somehow which things to write inside the effects wrapper and what things to write outside.
I agree. Once we decide on a format, I plan on writing some documentation in the file (kind of like I did for the .cards file) explaining all that. I see an "effect" as something that modifies the cards' behavior rather than just simple arbitrary values
I think this is probably the closest we've ever got to something realistically flexible that would not be terribly high-maintenance once the main pieces are in place
[[Cardshifter/Cardshifter](null)] build #819 for commit [607dcbbb](null/commit/607dcbbb7d22d6fdd29fd0ffde0c9b9b3a7e10f0) on branch [js-json-test](null/tree/js-json-test) passed
I think it would be unrealistic that anyone could ever come up with a system that could cover every possible effect, so that's when a modder could use a POJSF
@skiwi the thought has occurred to me :) A simple version of it could be implemented with regex and/or some parsing techniques. But I think it would not be worth it (and definitely a pain to maintain and extend).
@skiwi but yet we haven't fully implemented something fully. Many things are semi-complete though.
\[[**Cardshifter/Cardshifter**](https://github.com/Cardshifter/Cardshifter)\] [**Phrancis**](https://github.com/Phrancis) pushed commit [**a74c88b8**](https://github.com/Cardshifter/Cardshifter/commit/a74c88b83457ac6729162109f38645bac99266df) to [**js-json-test**](https://github.com/Cardshifter/Cardshifter/tree/js-json-test): Update and rename card-data.js to CardData.js
Overall, I think the defining-cards-with-JS-and-JSON-like-structure-approach (anyone has a better name for it?) is among the best overall in terms of cleanliness, simplicity for modders to learn/use, extensibility, maintainability, and all other -ility's.
So, now that we got the JSON format somewhat settled on, do you think we should first focus on getting the rest of PhrancisGame.java into JS, or try to implement some effects?
@sᴉɔuɐɹɥԀ I think we could think a bit more about how some effects would be coded, to create more examples for the format. Maybe also think about how modders could from JS extend the available 'keywords' and the functionality. But getting the rest of PG.java to JS is also important, of course.
@SimonAndréForsberg that time estimate is to have functions in javascript working in the current java game? or to have a way to define a mod in javascript that is the same structure as PhrancisGame?
I'm going to start trying to define the cards using the JS you already wrote in test.js and then come up with logic for the existing effects and after that try a few new things
I'm guessing ECSResourceMap and ECSAttributeMap is what I would want to pass data to right?
> This will be step 1 of converting game logic to JavaScript, to be able to pass values and attributes using JSON data to ECSResourceMap / ECSAttributeMap
@RubberDuck Well, we already have keywords in the JSON file. The idea was to define what to do with those keywords using JavaScript... It's not so much that it has to be really complex, but more that it has to be modular (e.g., "chain" multiple keyword/value pairs together to create a distinct effect)
@RubberDuck Imagine the 'statement' "Deal 8 damage to a random opponent", could you give an example of how the DSL of that could look with ANTLR ? (not the grammar, but example code that uses the grammar)
@RubberDuck Aha, so a lexer is like taking the string "4 + 7 * abs(-5)" and converting it into the tokens [4, +, 7, *, abs(, -5, )] and the parser is like taking those tokens and doing the Shunting-Yard algorithm on it to convert into Reverse Polish Notation, or an Abstract Syntax Tree?
Exile this card. At the beginning of your turn, you may pay x mana (where x is the amount of damage this card deals). If you do, increase the damage of this card by one and then deal that much damage to opponent. If you don't, deal x damage to opponent (where x is the amount of damage this card deals)."
TTGTB, I think at some point I should look into ANTLR more. I would like to discover more about its advantages and disadvantages, I think ANTLR-approach is something more for "Distant Future" (love that milestone) than 1.0 though.
You can use gwt-crypto to generate SHA-1 hashes on the client side using:
String getSHA1for(String text) {
SHA1Digest sd = new SHA1Digest();
byte[] bs = text.getBytes();
sd.update(bs, 0, bs.length);
byte[] result = new byte[20];
sd.doFinal(result, 0);
return byteArrayToHexString(resu...
I am having some issue to use PHP5 password_hash() function. My server is not supporting it, so I am using a function to hash. Is this one secure?
public function Pass_Hash ($password) {
$blowfish_salt = bin2hex(openssl_random_pseudo_bytes(22));
$hash = md5(crypt($password, "X1;G^C...
