What does this mean? Do users not connect directly to private servers? Does every minecraft client have to authenticate with a central server before joining a private one?
Or is it just an on-by-default "use official banlist" option?
So central authentication has been a part of the game since the beginning of multiplayer more or less, but Microsoft has taken it quite a bit further with the recent changes. Quite a shame to potentially be banned from a private server I host myself, whitelisted only for IRL friends. How strict the criteria to actually get banned is irrelevant in my opinion, I bought the game over ten years ago, and now suddenly risk losing access to multiplayer, which was the only reason I bought the game. But we'll have to see how it actually gets implemented, I really hope it's opt-in, or at the very least possible to opt out for privately hosted servers, but I have no issue with it being implemented on Realms.
yes - login is required by the user iirc. You need a microsoft account to play minecraft (and i believe they recently migrated all old mojang accounts to microsoft now?)
So much for that.
Minecraft servers in the default "online mode" authenticate users against Mojang's "session server". The clients get a token when they log in to their launcher and the servers then validate that token when the user logs in. This verifies both that the user is who they're claiming to be and has a legitimate copy of Minecraft.
Server admins can turn off online mode, but this means that anyone can claim to be anyone else unless some independent authentication scheme is implemented. As a result it's usually only done for actual offline servers and those that want to allow pirate copies to play.
I'm not super familiar with the current controversy but the understanding I have is that chat reports could potentially result in being unable to log in to online mode servers which seems likely to have overreaching effects.
The clients always authenticated before launching the game and required a valid session to join even private servers. I’ve assumed the change just disables the option to join any games similar to if they weren’t properly authenticated.
Yes. The way it works is that when a client attempts to join a (private) server, it sends the user id to the private server, and then sends Mojang a message informing them they it's trying to connect to a server at this address.
The private server then asks Mojang if the supplied user id is valid, and attempting to sign in to the server at this address. Mojang then replies to the server confirming the authentication of the client, and then the server lets them in.
There's also an exchange of cryptographic keys mixed in there, but that's the basics.