Leela-chess: Change password

[Ilis]

I've made account with one of my secret passwords and realized it store as open text in config file. I want to change it, how can I do that?

[mooskagh]

There's more convenience of having it in plaintext than security risk. You can obfuscate it, but it doesn't change much in terms of security but adds lots of hassle to maintain.
Just use unique password and that's enough.

[Ilis]

I want to have a basic account management — change password, restore password and delete my account as well.

[Uriopass]

Can't wait for your PR then :D

[jkiliani]

What's the point really? If you forgot your password, just make a new account, named with a variation of the previous one. It's not like you get any prices for your contributed games...

[Ilis]

Good joke, @Uriopass !

I have 2 suggestion, simple and complex:

• complex is to store hashed passwords both on client and server sides.
• simple is to warn “the password will be stored as open text” before entering password.

Also I suggest parameter --newpass for client.exe to change password (on server side).

@jkiliani
Everytime I see my password as a plain text, I'm confused, for I trusted to system to store my password secure. If safeness is not a point of app, maybe it is better to make it with no password at all?

[mooskagh]

How would hashed password help? One just can steal the hash to send the
same way they would steal a password.

It's pretty easy to store hashes locally and on server without any changes,
you just use hash are your password. :) Example:
$ echo password | sha1sum
c8fed00eb2e87f1cee8e90ebbe870c190ac3848c

Just use c8fed00eb2e87f1cee8e90ebbe870c190ac3848c, it's your password
"password" stored as a hash, locally and on server.

On Tue, Apr 10, 2018 at 1:15 PM Илья Кругликов [e-mail]
wrote:

Good joke, @Uriopass https://github.com/Uriopass !

I have 2 suggestion, simple and complex:

• complex is to store hashed passwords both on client and server sides.
• simple is to warn “the password will be stored as open text” before
  entering password.

Also I suggest parameter --newpass for client.exe to change password (on
server side).

@jkiliani https://github.com/jkiliani
Everytime I see my password as a plain text, I'm confused, for I trusted
to system to store my password secure. If safeness is not a point of app,
maybe it is better to make it with no password at all?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/glinscott/leela-chess/issues/278#issuecomment-380062764,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AKvplzaQanB5HNWsEnCRFbe1DCTwpcfMks5tnJQ1gaJpZM4TNs2c
.

[Ilis]

How would hashed password help?

Sorry, it was simple suggestion too, my fault.
Complex way is to implement nowadays password management system with salted passwords, that newer stored and newer transmitted as an open text.

Also, sorry for my English, I believe all you understand what I mean :)

[mooskagh]

There's really no solution which would be immune to a file stealing and
which doesn't require user to type password.

On Tue, Apr 10, 2018 at 1:28 PM Илья Кругликов [e-mail]
wrote:

How would hashed password help?
Sorry, it was simple suggestion too, my fault.
Complex way is to implement nowadays password management system with
salted passwords, that newer stored and newer transmitted as an open text.

Also, sorry for my English, I believe all you understand what I mean :)

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/glinscott/leela-chess/issues/278#issuecomment-380065859,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AKvpl6bujYdSpFA_WKX_EOliPZa1mwY6ks5tnJdkgaJpZM4TNs2c
.

[jkiliani]

My solution to this problem is to use a simple (and unsafe) password for an application where I simply don't care if it's hacked. I agree that not requiring a password at all would be a valid solution as well, and is in fact used by Leela Zero. Benefits of the current approach (imho) are

• It gives people some statistics on how many games they produce, which may be an incentive to produce more for some, and
• In case of bugged or malicious data uploads, it makes it easier for developers to filter the bad data.

Edit: The warning is a valid point, and a good reason to actually NOT use a good password that you're also using for something important. (Yes I know, everyone says never reuse passwords anyway, but really, who follows that rule consistently?)

[Ilis]

to use a simple (and unsafe) password

and warn before typing it about it will be stored as a plain text.

[Ilis]

And warn it can't be never changed.

[jkiliani]

I created a simple PR to include these warnings.

[glinscott]

It's a good idea to add some basic user management stuff. But no time right now :).

[Prcuvu]

There's really no solution which would be immune to a file stealing and
which doesn't require user to type password.

@Ilis said he accidentally used one of his secret passwords and wants to change his password to a casual one. He is not really talking about security design, instead he is finding a solution to prevent plaintext of his secret password from being stolen and used on other web services. Either storing hashed password or providing password change can do the job.