Hacker News Reader

Comment by squeaky-clean | Hacker News Reader

You can technically add a whitelist of usernames for your server, but (and maybe they've fixed this since) about 6 years ago my friends and I had our server ruined by a hacker who joined and converted our whole base to lava. When we asked how he joined despite the whitelist he said it was incredibly easy to circumvent.

After chatting a bit more he eventually felt bad and placed about a hundred chests filled with diamond armor and weapons before leaving, but that doesn't really remove the sting of having your personalized base destroyed and killed the challenge for the game.

We haven't played again since this year. At least now I know how to set up a cronjob to back up our world daily :P

View on HN

Make sure you are running in online mode. If you aren't, yeah, it's very easy to spoof the username, by using any of the hacked clients in existence.

During that first server we were using a 3rd party minecraft hosting provider, so no way of knowing if that was the case. I'll double check my current server though, thanks.

Edit dug it out of my old emails, it was actually actually much longer than 6 years ago! The host was Phoenixerve, seems they don't exist anymore.

As someone who stumbled into the world of Minecraft as something to do with a child and their friends, I was surprised at how it all works. I might be doing it wrong but I found it pretty hard to get a server up, set up VPNs (including for remote players), modding, moderating etc.

I’m sure a lot of parents would appreciate it being easier, with an in-app purchase of VPN, or similar access to safe, self hosted game play.

However do I get a bit of a buzz seeing my child open console and get the process ID then go to terminal and kill the flakey Minecraft app when it crashes. Requested for server reboots and grumbles at server RAM allocation etc. Maybe it being hard is actually a win.

Self-hosted is supported but for this use case it seems clear Realms are what they encourage parents to go for (and in fairness, a better option for most than managing self-hosting )

Realms lack mod support, and mods are a big, big part of Minecraft.

If you guys aren't modding and don't need the world to be running when no one is online then you might consider going with Minecraft Realms. It's like 10 bucks a month.

I'm hosting it on a VPS I use for other things, so it's sort of "free" in this case. And we haven't had more than 10 concurrent players yet, but there's about 15 of us so it will probably happen one weekend eventually. I don't really mind administering it, but Realms is definitely a good choice for a lot of people.

realms performance is woeful. lat time i tried it (around 6 months ago) it lagged with a whopping 6 players active.

Did you have your server configured to allow pirated clients? Because that's the only case I can think of that would allow for such an easy bypass.

We were using a 3rd party MC server host (this was before Realms). So honestly no idea, but I hope they didn't!

Edit dug it out of my old emails. The host was Phoenixerve, seems they don't exist anymore.

I'm relatively confident that a whitelist bypass like that has been impossible since Minecraft 1.3. (2013 ish). The login handshake for an online-mode (authentication enabled) server involves a three way communication between the client, the server, and Mojang's auth server, which basically involves the client telling the server "hey, I'd like to join", then the server acknowledging, the client telling Mojang "hey, I'm attempting to connect to this particular server" here are my login credentials", then telling the server "hey, I go ask Mojang, I'm trying to connect", and then the server checking with Mojang that this given user is trying to connect to this particular server, then establishing an encrypted connection to the client.

Reply on news.ycombinator.com