Against the Storm. I can pick it up whenever I have a free minute, and pause it or save and quit when I need to be doing something else. It’s just enough of a challenge to be immersive when I’m playing, but the stakes are low enough that it’s not stressful. And the music/ambient noise is lovely.
Torn between continuing my Zenith playthrough of Terraria and learning more Oxygen Not Included. I probably shouldn’t have started both of those at the same time
Edit: So it turned out that what my brain wanted was to come back to Darkest Dungeon and try to actually beat it
I played oxygen not included a few month ago and realy had fun. At some point I just stopped, don’t even know why. Realy want to replay though. So probably going to start again soon.
Man I’m real tired of the constant negativity around new games. I rarely see positive stuff online.
You don’t like a game? Just move on. Hell, downvotes and move on. But leaving comments on things like screenshots about how idiotic a game is, man find something else to do.
I agree OP, it is a gorgeous game. The landscapes are incredibly striking
It does help those on the fence make a more informed decision whether to purchase or not. Just whitewashing with only positive reviews and comments is misleading and stifles innovation. Trolling and opinions without examples suck and should be ‘downvoted.’
BG3 has plenty of bugs but has glowing reviews for a new game. People should be able to voice their opinions without attacking other users and receive the same in return.
I have put in over 50 hours and enjoy this game, but would definitely NOT recommend it to someone who isn’t familiar with Bethesda’s other titles.
There’s a thousand places to leave negative reviews. I’m just annoyed at the “Hey look X game has a cool thing” and the immediate “You enjoy X game? You’re an idiot for finding enjoyment out of this, you’re stupid, look how cool I look for shitting on it”. It’s transparent and annoying.
Voice your opinions sure, but if all you do though is shit on people for enjoying something, then that’s a dick move.
I don’t think anybody is shitting on anyone. It’s a public forum and we’re all allowed to say what we think. How shallow would the discourse be if we were limited to only talking about things positively? Everyone has their own tastes. I played through and enjoyed cyberpunk a couple of months after launch at a time when it was roundly shat upon but it didn’t spoil the game for me.
I don’t think anybody is shitting on anyone It’s a public forum and we’re all allowed to say what we think How shallow would the discourse be if we were limited to only talking about things positively?
It doesn’t matter what you think. Try posting something positive about starfield - even in the Starfield community. You will get shat on. A lot.
The problem isn’t that negativity doesn’t have a space, its that positivity doesn’t have a space. If someone posts something positive and gets shit on, they’re going to be less likely to post positive things in the future. Or react to negativity with their own positivity. That’s how psychology works. We do a thing and get a shock, we’ll be less likely to do it again.
But more importantly, a lot of negative nancies on the internet love to defend yukking on other’s yums with lofty goals around “discourse” and “free speech”. But they seem to forget that’s not how the real world or human psychology works. This post isn’t looking for “discourse”. OP is just saying " wow this game has cool vistas" maybe hoping for some stories or reinforcement or fun conversations with other fans and you all are responding with “game sucks”. What is this “discourse” supposed to accomplish other than, at best piss off OP, and at worst tear down his enjoyment of the game.
I mean think about it. What if someone were showing off a coat they brought and like with some randos, and you waltz in and are like “that coat’s fucking ugly and you should feel bad about buying it.” What kind of discourse would you expect other than “the hell? Who asked you? Fuck off”.
Sure, we’re all entitled to post and reply what we want, but it won’t stop us from calling you an asshole. You want to shit on a game? Go for it, there’s plenty of hate circlejerks you can join in on.
I was specifically meaning that I didn’t think anyone was shitting on anybody here in this thread. I didn’t say the game sucked or that it’s fucking ugly or any of those other hyperbolic statements. I read somebody else’s thoughts on the game and provided my own. I agree the game can look very good, I said I really enjoyed some of the quests. I’m not a part of the starfield community, I’m not trying to piss on anybodies parade. I just like playing games and talking about games I’ve played.
Right, because the people who are paid to review the full game over hundreds of hours and have spent, in many cases, years, analyzing their biases and determining the right way to construct objective criticsm and have peer review editors to check their work…
Nah. Randos on the internet who have tendancy to form circlejerks for fake internet points and for minor doses of dopamine and who may or may not have even completed even a tiny portion of the game - that’s what I need to make an informed decision.
EDIT Lol at the coward downvotes with no replies. You know I’m right, you just don’t want to admit it.
Just makes me wonder if the same thing happens in other communities. Say someone posts a photo of a National Park, are there replies how they’ve hiked most of the trails at that park and decided it’s not worth visiting?
I can see both sides too, “well we are informing people about the cons of that park, so they aren’t eaten by the vicious bears!”. I get that, I do! People have an opinion they want to share, nothing really wrong with that. Does that understanding make it enjoyable for me as the person just sharing the photo? Not so much…😂
While sending your password in plaintext over email is very much a bad idea and a very bad practice, it doesn’t mean they store your password in their database as plaintext.
Point is, a hash isn’t a password. giving the most you don’t need tech knowledge analogy, it’s like the passwords fingerprint.
The police station may keep your daughters fingerprint so that if they find a lost child they can recognize it is your daughter beyond any doubt. Your daughters fingerprints, is like a hash, your daughter is a password.
The police should not store your daughter… that’s bad practice. The fingerprints are all they should store, and needless to say the fingerprints aren’t your daughter, just as a hash isn’t a password.
It’s possible that this email is a result of forum user creation, so during that submission the plaintext password was available to send to the user. Then it would be hashed and stored.
I’m just explaining how user authentication works for most web applications. The server will process your plaintext password when your account is created. It should then store that as a hashed string, but it can ALSO send out an email with that plaintext password to the user describing their account creation. This post does not identify that passwords are stored in plaintext, it just identifies that they email plaintext passwords which is poor security practice.
You’re correct and after reading more of the thread I saw OP say this was sent immediately after registering. I don’t have reason to believe it is stirred in plaintext unless they’re storing s copy of every email they send.
Just played the Lamplighters League demo and liked it quite a bit. Only bummer is that it does not play well on steam deck, so I will hold off for a while.
Such a great game and community which I feel was enabled by the devs who has the forethought to make spamming a cheer button so enjoyable! End result: everyone cheers and the community gets just that little more happy.
Sending your password right after you created it might not be best practice, but it doesn’t mean it’s stored unhashed in the database. It looks like they’re using a third party forum software, so it should be pretty straightforward to figure out whether they do or not.
Yeah, I was looking it up, and when I saw they’ve been selling this forum software since 1997 I was less confident about passwords being hashed. They address it in their forums and they’re making it clear that the passwords are actually hashed, and they’re looking at migrating to other solutions regardless.
That doesn’t really mean that they store it in plain text. They sent it to you after you finished creating your account, and it’s likely that the password was just in plain text during the registration. The question still remains whether they store their outgoing emails (in which case yes, your password would still be stored in plain text on their end, not in the database though).
Honestly, why risk duplicate passwords even then? I have one strong password that I use for accessing my password manager, and let the password manager generate unique random passwords. Even if I had an easier password that I duplicated with some small changes, I’d still use a password manager to autofill it anyway. I use bitwarden personally, you can also self host it with vaultwarden but it seemed like more trouble than it was worth imo
This is a friendly reminder to everyone that password managers are not risk free either. LastPass was hacked last year, NortonLifeLock earlier this year.
Personally the risk of bitwarden is outweighed by its convenience (compared to self hosted/local only solutions) in my opinion, but I know that’ll change real quick if bitwarden ever has a breach. If it does I’m jumping ship to a self hosted or local only solution, but I’m hoping that doesn’t have to happen
Bitwarden is end to end encrypted. If the host gets hacked your passwords are still as safe as your master password is. Self hosting wouldn’t really be a huge help there. Possibly even detrimental depending on your level of competence at securing a public facing web host.
Yeah at this point it’s considered likely that LastPass vaults are being cracked, based on LP being the common link between various other accounts that are being breeched.
A small number of rounds of encryption being the default for users with old enough accounts is believed to be a significant part of the issue. It means even if their password was a good one, the vault can be brute forced comparatively quickly.
If their password was actually good (18+ random characters) it’s not feasible with current day technology to brute force, no matter how few PBKDF2 iterations were used.
Obviously it’s still a big issue because in many cases people don’t use strong enough passwords (and apparently LastPass stored some of the information in plaintext) but a strong password is still good protection provided the encryption algorithm doesn’t have any known exploitable weaknesses.
your passwords are still as safe as your master password is
They’re as safe as your master password is…and as the encryption is. LastPass famously got hacked recently, and in the aftermath of that many users noticed that their vault was encrypted using very small numbers of rounds of PBKDF2. The recommended number of rounds had increased, but LastPass left the number actually used too low for some users, rather than automatically increasing it. Users of Bitwarden and any other password vault should ensure that their vault is using the strongest encryption available.
Self hosting wouldn’t really be a huge help there
Well, self-hosting makes you a smaller target. The most determined attackers are likely going to go after the biggest target, which is going to be a centralised service with thousands of users’ vaults. If you host it yourself they probably won’t even know it exists, so unless there’s reason for someone to be specifically targeting you (e.g. you’re a public figure), or you get hacked by some broad untargeted attack, you might be better off self-hosted from a purely security standpoint.
(That said, I still use centrally-hosted Bitwarden. The convenience is worth it to me.)
You’re underestimating the attack surface of a self hosted set up. You don’t need to be specifically targeted if, for instance, someone hacks the Bitwarden docker image you’re using, or slips a malicious link into a tutorial you’re reading. It’s not a set it and forget it solution either, you’re responsible for updating it, and the host OS. Like I said, depending on your competency, it’s not inherently more secure.
This is why I don’t use a common centralized password manager, just like I don’t use any of the most popular remote desktop solutions like TeamViewer for unattended access.
I run a consumer copy of Pleasant Password Manager out of AWS and use NoMachine for unattended access to any machines where I need it.
Security through obscurity is tried and true. Put as little of your security attack surface in the hands of others as is reasonable.
I actually think this is the case. I could be completely wrong but I swear I saw the same question like 6 years ago in another forum software that looks exactly like this one lol. And people compalined about it storing plain text, but the response when asking the forum people was that it was only during that password creation, it’s not actually stored.
I don’t know if it’s crazy for me to think it’s the same forum from that many years ago, still doing the same thing and getting the same question.
There are plans to update the forum, including for better security (the main issue with changing the forum software is concern over reliably migrating all of the existing content). After emailing (admittedly not current best practice), the passwords are hashed and only the hash is stored.
…and later…
The forum has been updated to https, and passwords are no longer being sent by email.
Which raises the question of how old OP’s screen shot is.
Also, no, the password would not necessarily still be stored in plain text on their end. The cleartext password used in that email might be only in memory, and discarded after sending the message. Depends on how the UBB forum software implemented it and how Larian’s mail servers are set up.
EDIT: I just verified that this behavior has resurfaced since it was originally fixed. OP would do well to responsibly report it, rather than stirring up drama over a web forum account.
It is still a bad idea to send the password in plaintext via email. You never know when Bard will peek a look and then share your password along users as a demo account to try that forum.
You should always change your password from the system generated one to prevent that from happening. The app that you signed up for should enforce that by making you change your password when you log in.
There’s a lot of reasons why emailing passwords is not the best practice… But AI bots stealing your password to give people free demos is a wild paranoid fever dream.
It is meant to be as a joke, of course the AI is not that dumb enough to give it away as free demo. Why am I being downvoted? Why don’t people understand jokes these days? Do I always have to include /s when making a sarcastic joke even though it is so obvious?
You can also tell if a site does this when they have seemingly arbitrary restrictions on passwords that are actually database text field restrictions.
Especially if they have a maximum password length. The maximum password length should be just the maximum length the server will accept, because it should be hashed to a constant length before going into the database.
I recently created an Activision account during a free weekend event and discovered their password system is completely broken. 30 character limit but refused to accept any more than 12 characters. Kept erroring out with must be less than 30. Once I got it down to 12 it accepted that, but then it complained about certain special characters. Definitely not giving them financial information.
My bank has a character limit, but they don’t tell you about it; they just trim the password you’ve set before hashing + saving it, then when you go to login if you don’t trim your password the same way they did, login fails.
I only know this because the mobile app will actually grey out the login button as soon as you enter more than the character limit. The web app just leaves you to be confused.
I had a similar situation with my health insurance company, except I think they added the character limit a while after I had set my password T_T. So, it worked for months, then they changed the mobile app so I couldn’t enter a long password… And then eventually they changed the website too and then I couldn’t log in at all. Thaaaaanks.
Doesnt lemmy also do it? I think I ve heard from Ruben at Boostforlemmy that lemmy only treats first 60 characters of your password as a password and the rest gets discarded. [citation needed]
Can’t say I’ve ever tried to use a password quite that long, so I’m not sure.
Not ideal, but trimming it (especially when you’re keeping 60 chars) isn’t the end of the world. It was just super confusing that the web app doesn’t trim it during login as well. There’s no indication that your password was modified or what you’ve entered to login is too long. Just ‘incorrect user/pass’ despite entering what you’ve just set. That char limit for my bank is only 16 chars, so it’s easy to hit.
It’s a big deal IMO, particularly because at login it doesn’t do the same. From the user perspective, your password has effectively been modified without your knowledge and no reasonable way of finding out. Good luck getting access to your account.
When a bank does this it should be considered gross negligence.
The official web UI doesn’t let you enter more than 60 characters, but doesn’t indicate that at all. So you can keep typing past 60 characters but it won’t get added to the input field and you can’t really see that. If you paste a password into the field, it gets trimmed to 60 characters.
When creating a password, the server checks that it isn’t longer than 60 characters and returns an error if so. On login, however, it silently trims the password to 72 bytes, because that’s what the hashing algorithm they use supports.
My bank if you get your card number through the app has a dynamic ccv that changes every day so while not perfect is what I use whenever purchasing online
Especially if they have a maximum password length.
Not really, there are good reasons to limit password length. Like not wanting to waste compute time hashing huge passwords sent by a malicious actor. Or using bcrypt for your hashes, which has a 72 byte input limit and was considered the best option not that long ago. The limit just has to be reasonable; 72 lowercase letters is more entropy then the bcrypt hash you get out of it, for example.
Yes, reasonable limits are fine, I was talking more like 12 or 13 characters max. That’s probably indicative of a database field limit, and I’ve seen that a fair amount because my password manager defaults to 14 characters.
no, they probably dont.
they just send it to your email upon registration, which is kinda a bad idea, but they are probably storing passwords hashed afterwards.
I’ve never even heard of the game studio I’m not defending them, I was replying to the person who said the company should never have your unhashed password, and explaining that they have to at some point in the process
I wonder how much this varies depending on the amount of data it would require to store the emails of a company. I know nothing about this subject, but does it occur where companies with very large email lists would forgo storing those types of emails to save data costs?
In my experience it varies a lot. Even in our own system certain emails are stored differently. There are a few “we legally have to deliver this email and might need to prove it later” notifications. We store a PDF of those in s3. For others we might just save the data, a sent timestamp, and a key for which email visual template was used.
I also thought of a counter argument to my point overnight. We don’t store one super duper high volume email which is the email that only has an MFA code. We would also absolutely never ever dream about allowing a plaintext password in an email, so we’re probably following different patterns in the first place.
I find that very hard to believe. While it is less common nowadays, many, if not most, mailing list and forum software sent passwords in plaintext in emails.
A lot of cottage industry web apps also did the same.
passwords are usually hashed server-side tho and that’s done for a reason.
if handling passwords correctly, server side hashing is way more secure then client-side. (with client side hashing, hash becomes the password…)
Is it though? While it certainly isn’t something I’d recommend, and I’ve encountered it before, if E2E encryption exists we cannot assume a data exposure had occurred.
What they do on the backend has nothing to do with this notification system. Think of it as one of these credentialess authentication systems that send a ‘magic link’ to your inbox.
I’m playing Valkyria Chronicles. I think I’m about to finish the main story, though I have to tackle most of the extra content still (skirmishes and DLC maps).
It’s a bit strange, but once you stop looking at it as a strategy game, it becomes apparent that it’s actually a puzzle game in disguise, asking you to clear all scenarios in the most time efficient way, which usually translates to very precise troop placement and attacking enemies in a specific order.
I already played VC4 last year and it was a blast. VC1 has a bit less content and the QoL features from the sequel are sorely missing, but it’s still a lot of fun.
Nice. Personally only played VC1 and currently on VC2 (on a break though). All I can say so far is that the game series is a rough gem, fun but a bit unbalanced. VC2 is better in that aspect though, and I would assume the later games are as well.
I can’t speak about VC2 and 3, but 4 is pretty much the same as 1. The unbalanced nature of the game is part of the fun, for me. And if you’re willing to play the missions “as intended” instead of cheesing them with the attack-boosting orders, imo they provide quite the challenge (especially late-game VC4).
If I ever revisit 1, I’ll definitely play it with a rebalance mod, not sure on which since there’s like 3 of them.
While killing a tank with a scout is funny, it cheapens the gameplay. Personally I’m the kind that gravitates to metas, not to the point of obsessive min max, but it’s enough to sour the experience if it’s particularly busted like in the first game. Doesn’t help that the ranking system only cares about speed making it sort of necessary to exploit if you want a good result :/
Recently played Titanfall 2 and bought the Muse Dash DLC, and man this has been the most fun ride I’ve been in a while.
First off, Muse Dash. I’ve bought the base game a long while ago and pretty much cleared all of the hard content it had to offer. Due to the recent controversy, I jumped the gun and bought the DLC earlier than I would have liked, but I did plan on getting it at some point so its not a complete bummer. The main draw of the DLC for me was mainly more content since base game is reeeally small - specially if you are experienced at the game or genre as a whole, and the mods. The mods along with custom charts made the game way more compelling than before. Bless the good people who do game mods, they are actual gods.
Then we arrive at Titanfall 2. To be honest, I did not expect it to run on my i3 potato laptop, but it did… and I got addicted, clocking in 30 hours in like a week and a bit. The campaign is good, the multiplayer is amazing once it clicks, and now I’m replaying the campaign again for the collectibles. It is a genuine breath of fresh air as the majority of multiplayer/online games that I play involve live service stuff, gacha and tedious grind, and I’m not interested in mainstream competitive stuff either with ELO ranking and keeping up with metas. Here I can enjoy fragging to my heart’s content and casual competition without the baggage modern gaming entails (battlepass progression, ranked, FOMO, etc.). And even if I get beat by someone better, I view it as a challenge and not pure BS (I’m looking at you War Thunder).
lemmy.world
Aktywne