{"action":"created","issue":{"url":"https://api.github.com/repos/OpenRA/OpenRA/issues/9990","labels_url":"https://api.github.com/repos/OpenRA/OpenRA/issues/9990/labels{/name}","comments_url":"https://api.github.com/repos/OpenRA/OpenRA/issues/9990/comments","events_url":"https://api.github.com/repos/OpenRA/OpenRA/issues/9990/events","html_url":"https://github.com/OpenRA/OpenRA/issues/9990","id":116933732,"number":9990,"title":"Implement player authentication via hidden global chat messages.","user":{"login":"pchote","id":167819,"avatar_url":"https://avatars.githubusercontent.com/u/167819?v=3","gravatar_id":"","url":"https://api.github.com/users/pchote","html_url":"https://github.com/pchote","followers_url":"https://api.github.com/users/pchote/followers","following_url":"https://api.github.com/users/pchote/following{/other_user}","gists_url":"https://api.github.com/users/pchote/gists{/gist_id}","starred_url":"https://api.github.com/users/pchote/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pchote/subscriptions","organizations_url":"https://api.github.com/users/pchote/orgs","repos_url":"https://api.github.com/users/pchote/repos","events_url":"https://api.github.com/users/pchote/events{/privacy}","received_events_url":"https://api.github.com/users/pchote/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-14T15:45:23Z","updated_at":"2015-11-14T17:34:49Z","closed_at":null,"body":"This is a specific proposal for how to implement #2265 / #4410 using identified IRC nicknames and a call/response via PRIVMSG.\r\n\r\n1.  Enable identification / name enforcement on the IRC server backend (ping @baxxxster).\r\n2.  The server sends a random blob to the client as part of the `HandshakeRequest` and stores it as part of the server-side client data (which is stripped out before sending to other clients).\r\n3.  The client generates a random blowfish (or substitute a different algorithm if we want more security) key, stores it for future use in the `GlobalChat` class, and then encrypts the blob using this key and our existing `Blowfish` code.\r\n4.  The client returns the encrypted blob and their authenticated IRC nickname as part of the `HandshakeResponse` (or empty data if they do not want to authenticate).  New keys are generated for each handshake, so there is no problem with this data being saved in replays.\r\n5.  The client joins the server as normal and the server assigns a status of AUTHENTICATING if they returned an auth response, or UNAUTHENTICATED if they did not (stored as another field on Client, which is shared with all clients).\r\n6.  The server, which has its own connection to the global IRC network (but doesn't join any channels) sends a PRIVMSG containing the encrypted data to the nickname returned in the handshake.\r\n7.  The client, which is of course already logged into IRC, receives the PRIVMSG, decrypts it using the stored key, and then responds via PRIVMSG.  The IRC nick enforcement means that a malicious player that puts somebody elses IRC name in the handshake response cannot receive this message.\r\n8.  The server checks that that the response matches the original blob sent in the handshake request.  If it matches then the server is confident that the client is who they say they are and sets their status to AUTHENTICATED.  If it does not agree, or if it does not recieve a response within an appropriate timeout, then it sets their status to UNAUTHENTICATED.\r\n\r\nThe lobby UI then uses the authentication status shared by the server to show an appropriate icon in the ping/admin block.  Player names are _not_ required to match the IRC nickname, but the IRC nickname _will_ be shown in the ping/admin block tooltip.\r\n\r\nClients who connect via a regular IRC client would be able to see these background messages and send data to the servers.  This is not a problem because those messages don't contain any sensitive information, and the server would ignore any responses that it doesn't expect or understand.  The server IRC connection can also be used for server management (cc @cjshmyr, who is implementing this for #6538).\r\n\r\nA similar process can be used for authenticating servers against a central player stats database, but that is significantly out of scope of this initial implementation.\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/28248137-implement-player-authentication-via-hidden-global-chat-messages?utm_campaign=plugin&utm_content=tracker%2F36085&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F36085&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"},"comment":{"url":"https://api.github.com/repos/OpenRA/OpenRA/issues/comments/156722136","html_url":"https://github.com/OpenRA/OpenRA/issues/9990#issuecomment-156722136","issue_url":"https://api.github.com/repos/OpenRA/OpenRA/issues/9990","id":156722136,"user":{"login":"pchote","id":167819,"avatar_url":"https://avatars.githubusercontent.com/u/167819?v=3","gravatar_id":"","url":"https://api.github.com/users/pchote","html_url":"https://github.com/pchote","followers_url":"https://api.github.com/users/pchote/followers","following_url":"https://api.github.com/users/pchote/following{/other_user}","gists_url":"https://api.github.com/users/pchote/gists{/gist_id}","starred_url":"https://api.github.com/users/pchote/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pchote/subscriptions","organizations_url":"https://api.github.com/users/pchote/orgs","repos_url":"https://api.github.com/users/pchote/repos","events_url":"https://api.github.com/users/pchote/events{/privacy}","received_events_url":"https://api.github.com/users/pchote/received_events","type":"User","site_admin":false},"created_at":"2015-11-14T17:34:49Z","updated_at":"2015-11-14T17:34:49Z","body":"Authentication with the IRC channel is done with a username/password that you type into the server browser.  Connecting from multiple machines *at the same time* isn't allowed, but there is no issue with connecting from one machine at a time."}}