SoftwareSlicer
Professional Memer
- Aug 9, 2020
- 1,395
- 19,423
Basically, there are a few major issues I see with the BrokenLens account system within the Brokenlens Minecraft server.
It is insecure in the sense that there is no two step verification for accounts and that the in-game service limits how long you can set a password while showing said passwords as text that is visible on your screen. This is a major problem given how accounts can easily be brute forced into with enough attempts and through automated programs and how users who are able to log into your account are able to do so without any notifications on your end. Some high-level accounts recently have been getting hacked as a result of this limitation like Mistake_YT in this player report here: https://brokenlens.xyz/forums/threa...ese-high-leveled-hackers.127971/#post-1041647
MOD Edit: this claim is false, brute forcing passwords is not possible on brokenlens
The way in which passwords are visible as plain text while logging in through the Bedrock or Java builds of the game also reduces the amount of security that players have when they are signing into their accounts. This can be resolved by removing or increasing the password length cap while requiring users who have not logged into a specific device or a specific Minecraft account to verify themselves legitimately with a third-party service or web based captcha (I figure if many of us are playing on the mobile edition of the game that we would also to be able to use that platform to access content through a web browser.) that links with your game.
This also leads onto another problem I have with how accounts are managed which is regarding how accounts within the BrokenLens server are not connected to the person playing the game. Users can have multiple BrokenLens accounts that are not linked to their Microsoft or Mojang accounts and players who connect to the server only need a BrokenLens account to play. This is inherently problematic especially in terms of cheating because of how cheaters on the server can switch to a different BrokenLens account and continue what they are doing before they get banned without any repercussions.
Within the hundreds of videos that I have recorded of cheaters playing on this server, Only a small fraction of those (Maybe 2 or 3% with a rough estimate) play on registered Mojang or Microsoft accounts. This is likely due to how the server does not require a legitimate copy of Minecraft to play on the server. I am sure that many users on here prefer playing through unregistered accounts for legitimate reasons (Like maybe you don’t want to sign up for a Microsoft account or have difficulties getting the game set up properly?) although given just how much of a difference having a BrokenLens account linked to a Microsoft or Mojang account would make with preventing people from cheating and simply making the server a better place to be on, That seems to be a type of change that would benefit more than harm especially in the long run.
These changes that I have suggested including the requirement of a web captcha and the possible requirement of a Microsoft account for Brokenlens would really benefit a majority of players on the server. It would be beneficial in terms of moderation as less cheaters would be active, and bypassing would be much more difficult. It would be beneficial when considering players who have multiple devices as it would make it easier for players to sign into BrokenLens with it linked to your Mojang or Microsoft account. It would be beneficial for everyone on the server when considering how players would not need to worry about having someone easily sign into their accounts without their consent.
Hopefully, these ideas that I have brought up are worth considering as I figured that it would be important to discuss and implement ideas that would help resolve the issues that I have addressed and that it allows the server to expand to a wider audience.
It is insecure in the sense that there is no two step verification for accounts and that the in-game service limits how long you can set a password while showing said passwords as text that is visible on your screen. This is a major problem given how accounts can easily be brute forced into with enough attempts and through automated programs and how users who are able to log into your account are able to do so without any notifications on your end. Some high-level accounts recently have been getting hacked as a result of this limitation like Mistake_YT in this player report here: https://brokenlens.xyz/forums/threa...ese-high-leveled-hackers.127971/#post-1041647
MOD Edit: this claim is false, brute forcing passwords is not possible on brokenlens
The way in which passwords are visible as plain text while logging in through the Bedrock or Java builds of the game also reduces the amount of security that players have when they are signing into their accounts. This can be resolved by removing or increasing the password length cap while requiring users who have not logged into a specific device or a specific Minecraft account to verify themselves legitimately with a third-party service or web based captcha (I figure if many of us are playing on the mobile edition of the game that we would also to be able to use that platform to access content through a web browser.) that links with your game.
This also leads onto another problem I have with how accounts are managed which is regarding how accounts within the BrokenLens server are not connected to the person playing the game. Users can have multiple BrokenLens accounts that are not linked to their Microsoft or Mojang accounts and players who connect to the server only need a BrokenLens account to play. This is inherently problematic especially in terms of cheating because of how cheaters on the server can switch to a different BrokenLens account and continue what they are doing before they get banned without any repercussions.
Within the hundreds of videos that I have recorded of cheaters playing on this server, Only a small fraction of those (Maybe 2 or 3% with a rough estimate) play on registered Mojang or Microsoft accounts. This is likely due to how the server does not require a legitimate copy of Minecraft to play on the server. I am sure that many users on here prefer playing through unregistered accounts for legitimate reasons (Like maybe you don’t want to sign up for a Microsoft account or have difficulties getting the game set up properly?) although given just how much of a difference having a BrokenLens account linked to a Microsoft or Mojang account would make with preventing people from cheating and simply making the server a better place to be on, That seems to be a type of change that would benefit more than harm especially in the long run.
These changes that I have suggested including the requirement of a web captcha and the possible requirement of a Microsoft account for Brokenlens would really benefit a majority of players on the server. It would be beneficial in terms of moderation as less cheaters would be active, and bypassing would be much more difficult. It would be beneficial when considering players who have multiple devices as it would make it easier for players to sign into BrokenLens with it linked to your Mojang or Microsoft account. It would be beneficial for everyone on the server when considering how players would not need to worry about having someone easily sign into their accounts without their consent.
Hopefully, these ideas that I have brought up are worth considering as I figured that it would be important to discuss and implement ideas that would help resolve the issues that I have addressed and that it allows the server to expand to a wider audience.
Last edited by a moderator:
but then I try to make one xbox ACC and I didn't expect it was simple- so to others BRLNS players
