{"action":"opened","number":2343,"pull_request":{"url":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/2343","id":204650415,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA0NjUwNDE1","html_url":"https://github.com/pmmp/PocketMine-MP/pull/2343","diff_url":"https://github.com/pmmp/PocketMine-MP/pull/2343.diff","patch_url":"https://github.com/pmmp/PocketMine-MP/pull/2343.patch","issue_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/2343","number":2343,"state":"open","locked":false,"title":"Implemented network encryption","user":{"login":"dktapps","id":14214667,"node_id":"MDQ6VXNlcjE0MjE0NjY3","avatar_url":"https://avatars2.githubusercontent.com/u/14214667?v=4","gravatar_id":"","url":"https://api.github.com/users/dktapps","html_url":"https://github.com/dktapps","followers_url":"https://api.github.com/users/dktapps/followers","following_url":"https://api.github.com/users/dktapps/following{/other_user}","gists_url":"https://api.github.com/users/dktapps/gists{/gist_id}","starred_url":"https://api.github.com/users/dktapps/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dktapps/subscriptions","organizations_url":"https://api.github.com/users/dktapps/orgs","repos_url":"https://api.github.com/users/dktapps/repos","events_url":"https://api.github.com/users/dktapps/events{/privacy}","received_events_url":"https://api.github.com/users/dktapps/received_events","type":"User","site_admin":false},"body":"## Introduction\r\nThis has long been a missing part of PocketMine-MP's network security.\r\n\r\nNetwork encryption was introduced in the pre-0.15.0 Realms alpha. It is used to prevent leakage of sensitive data and also to enforce validity of XBL login.\r\n\r\nThis is something I put off implementing for a long time because I didn't see it as necessary, it was difficult to do previously (due to the necessity to change various API to make it possible), and also incurs a performance hit.\r\n\r\nHowever, some community members (generally proxy hackers) have discovered that it is possible to capture a pre-signed login from other sessions and replay it in a later session, passing authentication. This is known as a **session stealing** attack, like those which occurred on PC.\r\n\r\nSession stealing attacks are possible because the client is not required to provide proof of ownership of the ECC keys used to sign the login.\r\n\r\nEncryption fills in the missing piece of this jigsaw, making XBL authentication now completely secure unless one's account is hacked.\r\n\r\nFor those who don't know, historically login plugins like SimpleAuth were used prior to the implementation of XBL authentication. These kinds of plugins are still used by some server owners who were aware of the above session stealing attacks, but these are also insecure. SimpleAuth, for example, requires a player to type a password into chat, which can be stolen by MITM attack because it is sent across an unencrypted connection **in cleartext**!\r\n\r\n## Changes\r\n### Behavioural changes\r\n- Network encryption is now implemented and enabled by default. This has a performance cost, but this is the cost of security.\r\n- The `pocketmine.yml` option `network.enable-encryption` has been added, and is enabled by default. This can be disabled if you care more about performance than these kinds of attacks.\r\n\r\nThe impact of these changes on performance has not been fully measured yet - this is a TODO.\r\n\r\n### Dependency changes\r\nDependencies have been added for the following:\r\n- [`mdanter/ecc`](https://github.com/phpecc/phpecc) versions `^0.5.0`\r\n- [`php-crypto`](https://github.com/bukka/php-crypto) versions `^0.3.1`\r\n## Backwards compatibility\r\nThis does not pose any backwards compatibility issues for plugins by itself, although it requires prior changes that do break API.\r\n\r\nFurthermore, I anticipate that this will break the tools of most proxy hackers, which I don't think many server owners will be terribly bothered about. Server owners might even be thankful 🙃 \r\n\r\n## Follow-up\r\nConsider moving more of this code into extensions, since it is rather performance sensitive.\r\n\r\n## Tests\r\nHas been tested with a range of clients.","created_at":"2018-07-29T16:36:57Z","updated_at":"2018-07-29T16:36:57Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":454785701,"node_id":"MDU6TGFiZWw0NTQ3ODU3MDE=","url":"https://api.github.com/repos/pmmp/PocketMine-MP/labels/Category:%20Core","name":"Category: Core","color":"00aa55","default":false},{"id":569460451,"node_id":"MDU6TGFiZWw1Njk0NjA0NTE=","url":"https://api.github.com/repos/pmmp/PocketMine-MP/labels/Category:%20Network","name":"Category: Network","color":"00aa55","default":false},{"id":454787972,"node_id":"MDU6TGFiZWw0NTQ3ODc5NzI=","url":"https://api.github.com/repos/pmmp/PocketMine-MP/labels/PR:%20Contribution","name":"PR: Contribution","color":"bfdadc","default":false},{"id":454786550,"node_id":"MDU6TGFiZWw0NTQ3ODY1NTA=","url":"https://api.github.com/repos/pmmp/PocketMine-MP/labels/Priority:%20High","name":"Priority: High","color":"d93f0b","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/2343/commits","review_comments_url":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/2343/comments","review_comment_url":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/comments{/number}","comments_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/2343/comments","statuses_url":"https://api.github.com/repos/pmmp/PocketMine-MP/statuses/666de544d5276a874447105dfc5cbb5374317425","head":{"label":"pmmp:network-encryption","ref":"network-encryption","sha":"666de544d5276a874447105dfc5cbb5374317425","user":{"login":"pmmp","id":22548559,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNTQ4NTU5","avatar_url":"https://avatars2.githubusercontent.com/u/22548559?v=4","gravatar_id":"","url":"https://api.github.com/users/pmmp","html_url":"https://github.com/pmmp","followers_url":"https://api.github.com/users/pmmp/followers","following_url":"https://api.github.com/users/pmmp/following{/other_user}","gists_url":"https://api.github.com/users/pmmp/gists{/gist_id}","starred_url":"https://api.github.com/users/pmmp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmmp/subscriptions","organizations_url":"https://api.github.com/users/pmmp/orgs","repos_url":"https://api.github.com/users/pmmp/repos","events_url":"https://api.github.com/users/pmmp/events{/privacy}","received_events_url":"https://api.github.com/users/pmmp/received_events","type":"Organization","site_admin":false},"repo":{"id":69691727,"node_id":"MDEwOlJlcG9zaXRvcnk2OTY5MTcyNw==","name":"PocketMine-MP","full_name":"pmmp/PocketMine-MP","owner":{"login":"pmmp","id":22548559,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNTQ4NTU5","avatar_url":"https://avatars2.githubusercontent.com/u/22548559?v=4","gravatar_id":"","url":"https://api.github.com/users/pmmp","html_url":"https://github.com/pmmp","followers_url":"https://api.github.com/users/pmmp/followers","following_url":"https://api.github.com/users/pmmp/following{/other_user}","gists_url":"https://api.github.com/users/pmmp/gists{/gist_id}","starred_url":"https://api.github.com/users/pmmp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmmp/subscriptions","organizations_url":"https://api.github.com/users/pmmp/orgs","repos_url":"https://api.github.com/users/pmmp/repos","events_url":"https://api.github.com/users/pmmp/events{/privacy}","received_events_url":"https://api.github.com/users/pmmp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/pmmp/PocketMine-MP","description":"A server software for Minecraft: Bedrock Edition in PHP","fork":false,"url":"https://api.github.com/repos/pmmp/PocketMine-MP","forks_url":"https://api.github.com/repos/pmmp/PocketMine-MP/forks","keys_url":"https://api.github.com/repos/pmmp/PocketMine-MP/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pmmp/PocketMine-MP/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pmmp/PocketMine-MP/teams","hooks_url":"https://api.github.com/repos/pmmp/PocketMine-MP/hooks","issue_events_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/events{/number}","events_url":"https://api.github.com/repos/pmmp/PocketMine-MP/events","assignees_url":"https://api.github.com/repos/pmmp/PocketMine-MP/assignees{/user}","branches_url":"https://api.github.com/repos/pmmp/PocketMine-MP/branches{/branch}","tags_url":"https://api.github.com/repos/pmmp/PocketMine-MP/tags","blobs_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/refs{/sha}","trees_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pmmp/PocketMine-MP/statuses/{sha}","languages_url":"https://api.github.com/repos/pmmp/PocketMine-MP/languages","stargazers_url":"https://api.github.com/repos/pmmp/PocketMine-MP/stargazers","contributors_url":"https://api.github.com/repos/pmmp/PocketMine-MP/contributors","subscribers_url":"https://api.github.com/repos/pmmp/PocketMine-MP/subscribers","subscription_url":"https://api.github.com/repos/pmmp/PocketMine-MP/subscription","commits_url":"https://api.github.com/repos/pmmp/PocketMine-MP/commits{/sha}","git_commits_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/commits{/sha}","comments_url":"https://api.github.com/repos/pmmp/PocketMine-MP/comments{/number}","issue_comment_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/comments{/number}","contents_url":"https://api.github.com/repos/pmmp/PocketMine-MP/contents/{+path}","compare_url":"https://api.github.com/repos/pmmp/PocketMine-MP/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pmmp/PocketMine-MP/merges","archive_url":"https://api.github.com/repos/pmmp/PocketMine-MP/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pmmp/PocketMine-MP/downloads","issues_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues{/number}","pulls_url":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls{/number}","milestones_url":"https://api.github.com/repos/pmmp/PocketMine-MP/milestones{/number}","notifications_url":"https://api.github.com/repos/pmmp/PocketMine-MP/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pmmp/PocketMine-MP/labels{/name}","releases_url":"https://api.github.com/repos/pmmp/PocketMine-MP/releases{/id}","deployments_url":"https://api.github.com/repos/pmmp/PocketMine-MP/deployments","created_at":"2016-09-30T18:29:35Z","updated_at":"2018-07-28T08:44:59Z","pushed_at":"2018-07-29T15:26:32Z","git_url":"git://github.com/pmmp/PocketMine-MP.git","ssh_url":"git@github.com:pmmp/PocketMine-MP.git","clone_url":"https://github.com/pmmp/PocketMine-MP.git","svn_url":"https://github.com/pmmp/PocketMine-MP","homepage":"https://pmmp.io","size":21178,"stargazers_count":1039,"watchers_count":1039,"language":"PHP","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":715,"mirror_url":null,"archived":false,"open_issues_count":88,"license":{"key":"lgpl-3.0","name":"GNU Lesser General Public License v3.0","spdx_id":"LGPL-3.0","url":"https://api.github.com/licenses/lgpl-3.0","node_id":"MDc6TGljZW5zZTEy"},"forks":715,"open_issues":88,"watchers":1039,"default_branch":"master"}},"base":{"label":"pmmp:master","ref":"master","sha":"bdd42d6a783a3c38ffb4ab31cc13225b7dfb94e9","user":{"login":"pmmp","id":22548559,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNTQ4NTU5","avatar_url":"https://avatars2.githubusercontent.com/u/22548559?v=4","gravatar_id":"","url":"https://api.github.com/users/pmmp","html_url":"https://github.com/pmmp","followers_url":"https://api.github.com/users/pmmp/followers","following_url":"https://api.github.com/users/pmmp/following{/other_user}","gists_url":"https://api.github.com/users/pmmp/gists{/gist_id}","starred_url":"https://api.github.com/users/pmmp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmmp/subscriptions","organizations_url":"https://api.github.com/users/pmmp/orgs","repos_url":"https://api.github.com/users/pmmp/repos","events_url":"https://api.github.com/users/pmmp/events{/privacy}","received_events_url":"https://api.github.com/users/pmmp/received_events","type":"Organization","site_admin":false},"repo":{"id":69691727,"node_id":"MDEwOlJlcG9zaXRvcnk2OTY5MTcyNw==","name":"PocketMine-MP","full_name":"pmmp/PocketMine-MP","owner":{"login":"pmmp","id":22548559,"node_id":"MDEyOk9yZ2FuaXphdGlvbjIyNTQ4NTU5","avatar_url":"https://avatars2.githubusercontent.com/u/22548559?v=4","gravatar_id":"","url":"https://api.github.com/users/pmmp","html_url":"https://github.com/pmmp","followers_url":"https://api.github.com/users/pmmp/followers","following_url":"https://api.github.com/users/pmmp/following{/other_user}","gists_url":"https://api.github.com/users/pmmp/gists{/gist_id}","starred_url":"https://api.github.com/users/pmmp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pmmp/subscriptions","organizations_url":"https://api.github.com/users/pmmp/orgs","repos_url":"https://api.github.com/users/pmmp/repos","events_url":"https://api.github.com/users/pmmp/events{/privacy}","received_events_url":"https://api.github.com/users/pmmp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/pmmp/PocketMine-MP","description":"A server software for Minecraft: Bedrock Edition in PHP","fork":false,"url":"https://api.github.com/repos/pmmp/PocketMine-MP","forks_url":"https://api.github.com/repos/pmmp/PocketMine-MP/forks","keys_url":"https://api.github.com/repos/pmmp/PocketMine-MP/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pmmp/PocketMine-MP/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pmmp/PocketMine-MP/teams","hooks_url":"https://api.github.com/repos/pmmp/PocketMine-MP/hooks","issue_events_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/events{/number}","events_url":"https://api.github.com/repos/pmmp/PocketMine-MP/events","assignees_url":"https://api.github.com/repos/pmmp/PocketMine-MP/assignees{/user}","branches_url":"https://api.github.com/repos/pmmp/PocketMine-MP/branches{/branch}","tags_url":"https://api.github.com/repos/pmmp/PocketMine-MP/tags","blobs_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/refs{/sha}","trees_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pmmp/PocketMine-MP/statuses/{sha}","languages_url":"https://api.github.com/repos/pmmp/PocketMine-MP/languages","stargazers_url":"https://api.github.com/repos/pmmp/PocketMine-MP/stargazers","contributors_url":"https://api.github.com/repos/pmmp/PocketMine-MP/contributors","subscribers_url":"https://api.github.com/repos/pmmp/PocketMine-MP/subscribers","subscription_url":"https://api.github.com/repos/pmmp/PocketMine-MP/subscription","commits_url":"https://api.github.com/repos/pmmp/PocketMine-MP/commits{/sha}","git_commits_url":"https://api.github.com/repos/pmmp/PocketMine-MP/git/commits{/sha}","comments_url":"https://api.github.com/repos/pmmp/PocketMine-MP/comments{/number}","issue_comment_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/comments{/number}","contents_url":"https://api.github.com/repos/pmmp/PocketMine-MP/contents/{+path}","compare_url":"https://api.github.com/repos/pmmp/PocketMine-MP/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pmmp/PocketMine-MP/merges","archive_url":"https://api.github.com/repos/pmmp/PocketMine-MP/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pmmp/PocketMine-MP/downloads","issues_url":"https://api.github.com/repos/pmmp/PocketMine-MP/issues{/number}","pulls_url":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls{/number}","milestones_url":"https://api.github.com/repos/pmmp/PocketMine-MP/milestones{/number}","notifications_url":"https://api.github.com/repos/pmmp/PocketMine-MP/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pmmp/PocketMine-MP/labels{/name}","releases_url":"https://api.github.com/repos/pmmp/PocketMine-MP/releases{/id}","deployments_url":"https://api.github.com/repos/pmmp/PocketMine-MP/deployments","created_at":"2016-09-30T18:29:35Z","updated_at":"2018-07-28T08:44:59Z","pushed_at":"2018-07-29T15:26:32Z","git_url":"git://github.com/pmmp/PocketMine-MP.git","ssh_url":"git@github.com:pmmp/PocketMine-MP.git","clone_url":"https://github.com/pmmp/PocketMine-MP.git","svn_url":"https://github.com/pmmp/PocketMine-MP","homepage":"https://pmmp.io","size":21178,"stargazers_count":1039,"watchers_count":1039,"language":"PHP","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":715,"mirror_url":null,"archived":false,"open_issues_count":88,"license":{"key":"lgpl-3.0","name":"GNU Lesser General Public License v3.0","spdx_id":"LGPL-3.0","url":"https://api.github.com/licenses/lgpl-3.0","node_id":"MDc6TGljZW5zZTEy"},"forks":715,"open_issues":88,"watchers":1039,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/2343"},"html":{"href":"https://github.com/pmmp/PocketMine-MP/pull/2343"},"issue":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/2343"},"comments":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/issues/2343/comments"},"review_comments":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/2343/comments"},"review_comment":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/pulls/2343/commits"},"statuses":{"href":"https://api.github.com/repos/pmmp/PocketMine-MP/statuses/666de544d5276a874447105dfc5cbb5374317425"}},"author_association":"MEMBER","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":4,"additions":553,"deletions":176,"changed_files":13}}
{"actor":{"display_login":"dktapps"}}