siepel
24-07-2004, 04:40
Last week I changed my server from SQLite to MySQL.
After the migration, I logged into mysql with phpmyadmin and could see everyones password as plain tekst in the database.
Even the super admins password.
I think this is a mayor mistake, it should be hashed (md5 or so) because many ppl using teamspeak migrate to mysql and use it in the same dbase as there website is. (allowing one sign up for ts and www thus having same user and pass on both apz)
mysql, php ts they are all good safe apz, but when people code pages and start messing with mysql there can be many issues. like sql injectons to get super admin rights, or statements to get full list of all passwords.
And i think u want to make it as hard as it can get to the hackers.
Besides of all u cant trust a server admin this way, because he can see your password at any time. He can now not only kick/ban you from the server, but also log into all your accounts (if you use one pass for everything , as most people do)
After the migration, I logged into mysql with phpmyadmin and could see everyones password as plain tekst in the database.
Even the super admins password.
I think this is a mayor mistake, it should be hashed (md5 or so) because many ppl using teamspeak migrate to mysql and use it in the same dbase as there website is. (allowing one sign up for ts and www thus having same user and pass on both apz)
mysql, php ts they are all good safe apz, but when people code pages and start messing with mysql there can be many issues. like sql injectons to get super admin rights, or statements to get full list of all passwords.
And i think u want to make it as hard as it can get to the hackers.
Besides of all u cant trust a server admin this way, because he can see your password at any time. He can now not only kick/ban you from the server, but also log into all your accounts (if you use one pass for everything , as most people do)