Security breach: Unencrypted passwords in games.pref

from Demigod Forums

If you go to My Documents --> My Games --> Demigod, there's a file called games.pref.

In that file, it stores your Impulse password unencrypted.  If your system is hacked or if you share your computer with inquisitive people, this is a serious security breach.  Demigod should hash that password before storing it, at the very least.

1,423 views 5 replies
Reply #1 from Demigod Forums Top

It's supposed to be getting fixed, hopefully in this upcoming patch.

Reply #2 from Demigod Forums Top

You can encrypt it all you want. If your system is tainted, any malware can simply install a keylogger.

It does not matter whether the program reads the password from that file, from memory or simply waits for you to type it in. You need to prevent the infection in the first place.

Sins of a Solar Empire II
Reply #3 from Demigod Forums Top

Storing your passwords locally without a master-password to protect them is never secure. For example in Firefox or IE, when you let them store your login data, those infos can easily be retrieved again by potential malware. So "encrypting" that stuff really only gives you a false sense of security.

Reply #4 from Demigod Forums Top

Storing your passwords locally without a master-password to protect them is never secure. For example in Firefox or IE, when you let them store your login data, those infos can easily be retrieved again by potential malware. So "encrypting" that stuff really only gives you a false sense of security.
End of quote

It's always a false sense of security, isn't it?  I mean, the Department of Defense invests millions in securing its systems and they still get hacked.  Any computer system hooked up to the internet is insecure, plagued by a false sense of security.

That being said, there are still degrees of security.  Would the DoD ice always protect me 100%?  No.  But I'd still love to have it.

Will encrypting my Demigod passwords protect me from a moderately experienced and dedicated intruder?  No.  But I'd still love to have it.  For example, it would keep an amateur like my nephew from visiting and pulling up my password.  He wouldn't know how to reverse a hash but he can open a file in notepad.

Hashing a password is a low-effort activity that would protect me from casual intruders.  It's a basic, standard practice that Demigod should follow.

Reply #5 from Demigod Forums Top

Quoting Annatar11, reply 1
It's supposed to be getting fixed, hopefully in this upcoming patch.
End of Annatar11's quote
Still not fixed.

Quoting Anarchy, reply 3
Storing your passwords locally without a master-password to protect them is never secure. For example in Firefox or IE, when you let them store your login data, those infos can easily be retrieved again by potential malware. So "encrypting" that stuff really only gives you a false sense of security.
End of Anarchy's quote
A master password gives you a false sense of security? In your example, the "master password" is the unencrypted impulse password in the Game.prefs ;)