Account security

[cynder]

Hey guys, I asked this over on the offical RS forums but know one knows anything about it so ill ask here.

 

 

 

I am logging into runescape from a unsecured connection once a week at my collage, and I was wondering if my username and password are being sent in clear text, or if it's cipher text. I would assume it's not since its not a SSL connection, but the Java Applet might encrypt it.

 

 

 

Any idea?

 

 

 

CHeers.

[jessy87]

i swear you made this thread before. am i wrong or having an extereme case of de ja vu?

[Chris]

I doubt it'd be encrypted as you've already connected to the client on the webpage.

 

 

 

It's a bit different than buying things online as you have to submit information, which sends it via a form.

 

 

 

Easiest way to explain it would be...

 

 

 

Buying things online is like sending your details on a letter and sending it through the post. If not encrypted just about anybody (postal workers) in between the send and receive can read the details.

 

 

 

You typing your details into the client directly is like giving your details over the phone. You already have connected point to point and no one else can see/hear your details although you're speaking in plain English.

[Makoto_the_Phoenix]

Sent over plain text? Why would it be? The Java applet(s) encrypt the data on their own, so there's no real need to fret about it.

[cynder]

Sent over plain text? Why would it be? The Java applet(s) encrypt the data on their own, so there's no real need to fret about it.

 

 

 

Okay thanks, wasn't sure if the applet(s) encrypted it.

[Collective]

Buying things online is like sending your details on a letter and sending it through the post. If not encrypted just about anybody (postal workers) in between the send and receive can read the details.

 

 

 

You typing your details into the client directly is like giving your details over the phone. You already have connected point to point and no one else can see/hear your details although you're speaking in plain English.

 

That would imply that buying things online is less secure than logging in to RuneScape, which simply isn't true.

 

 

 

If something is sent over the Internet then one of the "postal workers" (routers) can read it (infact they have to), just like the FBI/MI5/whoever can listen in to phone calls provided they have access somewhere the call is being routed through. Logging in via the java client doesn't create a magical link to the Jagex servers ignoring space and time, everything still goes through atleast a dozen routers between you and the server you're playing on.

 

 

 

The RuneScape client doesn't appear to send passwords in plain text, so they're most likely encrypted/hashed/encoded.

[Chris]

Buying things online is like sending your details on a letter and sending it through the post. If not encrypted just about anybody (postal workers) in between the send and receive can read the details.

 

 

 

You typing your details into the client directly is like giving your details over the phone. You already have connected point to point and no one else can see/hear your details although you're speaking in plain English.

 

That would imply that buying things online is less secure than logging in to RuneScape, which simply isn't true.

 

 

 

If something is sent over the Internet then one of the "postal workers" (routers) can read it (infact they have to), just like the FBI/MI5/whoever can listen in to phone calls provided they have access somewhere the call is being routed through. Logging in via the java client doesn't create a magical link to the Jagex servers ignoring space and time, everything still goes through atleast a dozen routers between you and the server you're playing on.

 

 

 

The RuneScape client doesn't appear to send passwords in plain text, so they're most likely encrypted/hashed/encoded.

 

 

 

That's not quite what I meant... I knew I shoulda just left this topic alone. Knowing that at least someone would get anal at me trying to explain things simply.

[Collective]

That's not quite what I meant... I knew I shoulda just left this topic alone. Knowing that at least someone would get anal at me trying to explain things simply.

 

There's a difference between correcting someone and being "anal." That was actually one of the few posts I've made that aren't anal at all.

[Cruiser]

Like Collective said, it's most likely hashed/encrypted before being sent from the machine to the login server. Last time I was playing with ethereal I logged into RS while capturing and didn't find my username or pass in the results (though I may have missed it somehow, was just goofing around with it).

 

 

 

You should be fine either way. I seriously doubt someone that's gone so far as compromising a public university machine is after RS login details anyway. :P