Security and computer games.

[Krougal]

1 minute ago, Adnyeus said:

It would be better for people who own a game to have full control over it. For example, why should we need to log in if we want to play offline? If I wanted to play online, I would log in without a problem. 

 

Therein lies the problem; we don't own any games. We only lease them.

[Voldemort]

Just now, Krougal said:

Therein lies the problem; we don't own any games. We only lease them.

Well, that's true in the majority of cases, but on some special occasions, you can. There's a website called GOG where you can buy games, keep them forever, and truly own them.

[wildforester]

5 hours ago, radfast said:

In situations (3) and (4), there is a solution.  One working clientsettings.json file can be copied to other data folders or to VintagestoryData folder on another PC, so that then the password does not need to be re-entered.  Note it must be a "working" file: I mean copy specifically the clientsettings.json file immediately after a successful login and exit the game to save it.  As a side-bonus, this will also copy any custom key bindings or macros etc to both places.  It will also copy the graphics settings and other settings of course, those might need to be adjusted if there are different graphics requirements for the 2 different game installations.

Wouldn’t changing graphics and keybinds break being able to do this?

[zand]

7 hours ago, radfast said:

Don't disable the authentication check unless there's a specific reason to like the auth servers went offline (which hasn't been the case for a good long time now), or Anego Studios stopped supporting the auth server completely (which is unlikely ever, unless there is Armageddon in which case we'll all have bigger concerns than the VS auth server...). 

@WinnieTaylor Can you please be more specific about the "security issues" ruining things for you?  I start the game tens or hundreds of times a day while testing things, and have not encountered any security issues. 

@LadyWYT Normally the game stores the player's password (more precisely, a token generated after the player enters a valid username+password) inside the clientsettings.json file in the VintagestoryData folder.  There are 4 situations where the password might need to be re-entered frequently:

1.  deleting that settings file (or the OS deleting it, for example because it's kept in a temp folder or a RAM drive or other place where it can't stay permanently)

2.  manual Log Out, e.g. so that another person can play on the same machine using a different game account

3.  (most likely) one person using 2 different PCs to play on the same game account (e.g. home + college) - that's totally allowed by the way!

4.  a person has multiple installations of the game which have also been manually configured to use different data folders

In situations (3) and (4), there is a solution.  One working clientsettings.json file can be copied to other data folders or to VintagestoryData folder on another PC, so that then the password does not need to be re-entered.  Note it must be a "working" file: I mean copy specifically the clientsettings.json file immediately after a successful login and exit the game to save it.  As a side-bonus, this will also copy any custom key bindings or macros etc to both places.  It will also copy the graphics settings and other settings of course, those might need to be adjusted if there are different graphics requirements for the 2 different game installations.

I also assume that you will need to re-login if you change your password and that the "token" probably expires at some point in time, but I have not tested this.

The one thing that I do know is that the clientsettings.json will also be effectively deleted when it becomes corrupt due to a bug (see https://github.com/anegostudios/VintageStory-Issues/issues/6264). This has happened in the past for some players when the game crashes.

[Mrozak]

9 hours ago, Thorfinn said:

Oh, that's what you meant. I thought you were talking about when you bounce between versions and/or computers with the same ID. Yes, I'm pretty sure you need that first token. Though I don't see that as unreasonable. Otherwise there wouldn't be much to stop one from handing out a bajillion copies of the game, and development funds drops precipitously. At least this way, there is at least some hope that pirates are at some risk of there being something malignant in the cracked versions they find.

I suppose you could change the model to some microtransaction scheme, though that would chase me and I'm sure a lot of other people away. I don't mind logging in again. I'm getting pretty fast at it. But I would not link a credit card to a game, ever.

Not quite what i meant.
My "problem" was that every time i want to run version A, after running version B, i need to login again.
But then this thing appeared above my head...and i realized, i can just copy paste the session key from whichever version i used (and logged in) last time.
After that, i can keep switching as much as i want without needing to login after each switch.

The reason is this...
First, i installed version A, run it, it had no session key, so it asked me to login, i logged in and version A got session key - all good.
Then i installed version B, run it, it had no session key, so it asked me to login, i logged in which invalidated the previous session, and version B now got session key, but the previous one stored in version A config was now useless.
So... like a MORON, i kept renewing and invalidating the session keys as i switched versions, until i realized what the hell am i doing and copy pasted the currently valid session key into the other version's config.

 

Edited August 13, 2025 by Mrozak

[Thorfinn]

So you only have to do that once for each instance?

[Mrozak]

50 minutes ago, Thorfinn said:

So you only have to do that once for each instance?

Yes. You do it once on every instance, and then you take the "sessionkey" and "sessionsignature" (not sure if you need both, i didn't check, but it won't hurt) from the last instance where you logged in, and copy&paste it into the "clientsettings.json" of any other instances.
After that, you can keep switching between the instances all you like, and none of them will bother you with the need to login again (until you do a new login anywhere which will invalidate the session tokens you were using before).

I wish i would realize that sooner, it would save me some typing