Street Veteran wrote:
Quote:
2)
BTW when this is about to happen? Many peoples were asking this yesterday.
Some comments from other players when I mentioned that profile reset is probably coming soon:
"noooooooo"
"kidings me?"
"are you serious?"
"how sure you are this will happen?"
"does it reset also stash?"
Not in 0.99.1 at least, which should happen this weekend. Target for the realm profile feature is then 0.99.2, so maybe next weekend, maybe the one after it. Given recent developments, it'll be very easy to do "the migration" during 0.99.2 if wanted and continue with old profiles, and consider profile reset only at 1.0 if even then, for example.
I need to completely rework the client side profiles feature. I already had it working across servers, it even featured local backups in case you'd go to an ill-behaving server which would harm your profile in some way, was doing the final tests with it, everything looked fine, when I realized that the backups, or just copying the profile files manually, generates a ridiculously easy way to exploit.
You could first collect 10k RP in your profile, take a copy of the profile, then use it all on calls and whatnot, leave the server, make the earlier copy as your actual profile, and then connect as if you never used that RP. With a friend, you'd be able to drop e.g. cash items worth all that RP, have your friend take them, and you'd just go back to the copy as if you never dropped those items.
So yeah, it only occurred to me at this point that that's possible, and it's very easy to achieve, and I can't figure out a reasonable way to counter it. And anyway, while there was some degree of direct profile editing prevention, a hacker able to use a disassembler would be able to make manual changes in his profile. Back to drawing board then, and we'll try the master profile server approach next. Bye-bye 1-2 weeks of work.
As an approach, the master profile server is much more secure against player profile hackers as profile managing happens on server side, and it'll prevent the impersonation issue we were talking about earlier as usernames must be unique in a realm. Minor downside is that the password field must be back in again, but at least we'll be able to make password change facilities on the profile server at a later phase without having individual servers take part in that. In general, it all will put some more stress on the profile server itself, denial of service attacks and that shit, but given how things are, it sounds like our best shot.