Hacker News Reader

Comment by josephcsible | Hacker News Reader

Vanilla Minecraft already has built-in authentication, and the advantages listed here seem to assume that you'd leave it wide open otherwise. What advantages are there to using this instead of it?

View on HN

Minecraft authentication requires a Microsoft account. People may not want to have one for ideological reasons, or not want to attach a game to the account they use for other purposes.

Also, not encouraging it, but disabling authentication allows players with pirated copies of MC to play on the server

No consumer-oriented software should require a VPN for authentication --

Wait, it's actually a good idea. Please put everything from Meta/Facebook behind a mandatory VPN so that I have zero chance of accidentally stumbling upon it.

But you need a Microsoft account to launch the game even if you're not connecting to a server that uses it for authentication. (Unless, as you mentioned, you're playing a pirate copy of the game.)

Maybe soon that'll be the case, but it is not currently for the Java edition.

Oh, they still let you use just a Mojang account? In any case, though, there's never an extra account required to use built-in server authentication that isn't also required to launch the game, unless you pirated it.

With Vanilla Minecraft, you have have a port open to the entire planet and have to trust that the built-in security will work. The more ports you want to open to friends, the more services you are relying on to have working security.

With Tailscale, you just need to trust that Tailscale works, which seems like a much better bet given WireGuard's simple-and-auditable code plus the quality of Tailscale's dev team working on top of that.

You can technically add a whitelist of usernames for your server, but (and maybe they've fixed this since) about 6 years ago my friends and I had our server ruined by a hacker who joined and converted our whole base to lava. When we asked how he joined despite the whitelist he said it was incredibly easy to circumvent.

After chatting a bit more he eventually felt bad and placed about a hundred chests filled with diamond armor and weapons before leaving, but that doesn't really remove the sting of having your personalized base destroyed and killed the challenge for the game.

We haven't played again since this year. At least now I know how to set up a cronjob to back up our world daily :P

If you guys aren't modding and don't need the world to be running when no one is online then you might consider going with Minecraft Realms. It's like 10 bucks a month.

realms performance is woeful. lat time i tried it (around 6 months ago) it lagged with a whopping 6 players active.

I'm hosting it on a VPS I use for other things, so it's sort of "free" in this case. And we haven't had more than 10 concurrent players yet, but there's about 15 of us so it will probably happen one weekend eventually. I don't really mind administering it, but Realms is definitely a good choice for a lot of people.

As someone who stumbled into the world of Minecraft as something to do with a child and their friends, I was surprised at how it all works. I might be doing it wrong but I found it pretty hard to get a server up, set up VPNs (including for remote players), modding, moderating etc.

I’m sure a lot of parents would appreciate it being easier, with an in-app purchase of VPN, or similar access to safe, self hosted game play.

However do I get a bit of a buzz seeing my child open console and get the process ID then go to terminal and kill the flakey Minecraft app when it crashes. Requested for server reboots and grumbles at server RAM allocation etc. Maybe it being hard is actually a win.

Self-hosted is supported but for this use case it seems clear Realms are what they encourage parents to go for (and in fairness, a better option for most than managing self-hosting )

Realms lack mod support, and mods are a big, big part of Minecraft.

Make sure you are running in online mode. If you aren't, yeah, it's very easy to spoof the username, by using any of the hacked clients in existence.

During that first server we were using a 3rd party minecraft hosting provider, so no way of knowing if that was the case. I'll double check my current server though, thanks.

Edit dug it out of my old emails, it was actually actually much longer than 6 years ago! The host was Phoenixerve, seems they don't exist anymore.

Did you have your server configured to allow pirated clients? Because that's the only case I can think of that would allow for such an easy bypass.

We were using a 3rd party MC server host (this was before Realms). So honestly no idea, but I hope they didn't!

Edit dug it out of my old emails. The host was Phoenixerve, seems they don't exist anymore.

I'm relatively confident that a whitelist bypass like that has been impossible since Minecraft 1.3. (2013 ish). The login handshake for an online-mode (authentication enabled) server involves a three way communication between the client, the server, and Mojang's auth server, which basically involves the client telling the server "hey, I'd like to join", then the server acknowledging, the client telling Mojang "hey, I'm attempting to connect to this particular server" here are my login credentials", then telling the server "hey, I go ask Mojang, I'm trying to connect", and then the server checking with Mojang that this given user is trying to connect to this particular server, then establishing an encrypted connection to the client.

Some of us don't want to give Microsoft our phone number just to play a game we bought from another company.

You have to log in to your Minecraft client to play at all, even if the server you pick doesn't use that account to authenticate you.

Reply on news.ycombinator.com