payload: {"action":"opened","issue":{"url":"https://api.github.com/repos/triplea-game/triplea/issues/4962","repository_url":"https://api.github.com/repos/triplea-game/triplea","labels_url":"https://api.github.com/repos/triplea-game/triplea/issues/4962/labels{/name}","comments_url":"https://api.github.com/repos/triplea-game/triplea/issues/4962/comments","events_url":"https://api.github.com/repos/triplea-game/triplea/issues/4962/events","html_url":"https://github.com/triplea-game/triplea/issues/4962","id":479930472,"node_id":"MDU6SXNzdWU0Nzk5MzA0NzI=","number":4962,"title":"Designing a Simpler Password Auth","user":{"login":"DanVanAtta","id":12397753,"node_id":"MDQ6VXNlcjEyMzk3NzUz","avatar_url":"https://avatars2.githubusercontent.com/u/12397753?v=4","gravatar_id":"","url":"https://api.github.com/users/DanVanAtta","html_url":"https://github.com/DanVanAtta","followers_url":"https://api.github.com/users/DanVanAtta/followers","following_url":"https://api.github.com/users/DanVanAtta/following{/other_user}","gists_url":"https://api.github.com/users/DanVanAtta/gists{/gist_id}","starred_url":"https://api.github.com/users/DanVanAtta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanVanAtta/subscriptions","organizations_url":"https://api.github.com/users/DanVanAtta/orgs","repos_url":"https://api.github.com/users/DanVanAtta/repos","events_url":"https://api.github.com/users/DanVanAtta/events{/privacy}","received_events_url":"https://api.github.com/users/DanVanAtta/received_events","type":"User","site_admin":false},"labels":[{"id":1204439580,"node_id":"MDU6TGFiZWwxMjA0NDM5NTgw","url":"https://api.github.com/repos/triplea-game/triplea/labels/Design","name":"Design","color":"FFDD00","default":false},{"id":317148881,"node_id":"MDU6TGFiZWwzMTcxNDg4ODE=","url":"https://api.github.com/repos/triplea-game/triplea/labels/code","name":"code","color":"2066Fb","default":false},{"id":280035309,"node_id":"MDU6TGFiZWwyODAwMzUzMDk=","url":"https://api.github.com/repos/triplea-game/triplea/labels/discussion","name":"discussion","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-08-13T02:31:30Z","updated_at":"2019-08-13T02:31:30Z","closed_at":null,"author_association":"MEMBER","body":"Our current system for authenticating password is quite complex. AFAIK the general best practice is client establishes a secure connection to server, hashes the password entered by user, sends that to server, server then checks to see if that hashed value exists in database. The decrypt step that our server side currently does is particularly worrisome and I think perhaps defeats a lot of the security that we are trying to add (unnecessary).\r\n\r\nTo get to a simpler setup, it seems the key is to have an encrypted communication channel. I can propose two options:\r\n(1) use RMI over SSL and authenticate with RMI\r\n(2) move lobby authentication to https server, on success the https server passes back a single-use token that is stored in DB. The single use token is then sent to the RMI server which then validates it and allows login.\r\n\r\nI'm curious if there are other good options to consider and any preferences between the two routes above. (1) has the advantage that overall there are fewer moving parts, but setting up RMI over SSL looks very painful. (2) is perhaps more straight forward but slightly more complex in terms of interactions between different systems. "}}
other: {"actor":{"display_login":"DanVanAtta"}}