[PassPod]Newcibn

[Nazox 473]

Hi everyone how are you, I created this post, because I was curious to know a little bit what the PassPod function was about, to put the context, this started a few days ago when I reread everything for 213921392139 time remembering the old metin2 stuff. So out of boredom I started to implement the Chinese language in my client, the truth was quite easy (I don't know why, I remembered it more complicated), and I realized, that only the newcibn runs the PassPod confirming or denying access when you log in and runs the line “WAIT_FOR_PASSPOD Verifying password....” which we don't have in our locale_game for the other regions. I noticed, that this one accompanied it with a small countdown before accessing the character selection, i.e. even though the “WAIT_FOR_PASSWORD” did not have something like “Verifying password...%d” or something like that for the countdown this one showed it. I started to check the source and I discovered that we have the PassPod function everywhere in a normal way for all regions (or so I think) but in the client source part, it is directly created for NEWCIBN as for example this: 

AccountConnector.cpp:

bool CAccountConnector::SendNEWCIBNPasspodAnswerPacket(const char * answer)
{
	TPacketCGNEWCIBNPasspodAnswer answerPacket;
	answerPacket.bHeader = HEADER_CG_NEWCIBN_PASSPOD_ANSWER;
	strncpy(answerPacket.szAnswer, answer, NEWCIBN_PASSPOD_ANSWER_MAX_LEN);
	answerPacket.szAnswer[NEWCIBN_PASSPOD_ANSWER_MAX_LEN] = '\0';	
	if (!Send(sizeof(answerPacket), &answerPacket))
	{
		TraceError("SendNEWCIBNPasspodAnswerPacket");
		return false;
	}
	return SendSequence();
}

So now I am trying to use it in my normal version “locale_es”, but so far I have not succeeded although I have tried other methods, I found something curious and I wondered why this would be, why should I verify the password, was it maybe because of the icafe or something like that, why was it removed, it seems to me that it is a simple detail but fun as a “mini wait” Someone can give me more information that I know of these differences between one region and another? Thank you for your time

Btw if I have not explained myself well, I meant this:

ignore errors <.< I broke the coding chain xD.

 

Edited September 22, 2024 by Metin2 Dev International
Core X - External 2 Internal

[Gurgarath 3699]

Hello,

Metin2 has many different log-in systems. If I remember correctly, there is Login1, basically a dev-server kinda passwordless method; Login2, an outdated and bugprone version (that, if I remember correctly, attackers can hook to circumvent bans) of Login3 (that we all use) then Login4 (Passpod) and Login5 (OpenID). All versions are pretty much flawed, but Login3 is the best despite sending clear credentials.

Passpod, aka login4 is not salvageable as it uses web authentification that is probably lost software. This is why there is a countdown, because your credentials basically go through a web layer to be treated / validated and whatever, it was China only. Having a countdown on our Login3 is not necessary because it shouldn't take more than 5 seconds and usually just get it done in 1 to 2 depending on whether you use encryption or not.

OpenID, aka Login5, is kinda salvageable, you can redo the OpenID server, but there is still the "Why?" question remaining. It was used for Japan if I properly remember.

On the official, there are more log-in methods now, notably Gameforge, Ongame and Steam and probably more.

Using today's technology, you can make your auth pass through cloudflare, through workers, create a new web server authentication method or simply just strenghten Login3. Using OpenID or Passpod is pretty much deprecated and can safely be removed, unless you have a clear strategy behind.

[Nazox 473]

11 hours ago, Gurgarath said:

Hola,

Metin2 tiene muchos sistemas de inicio de sesión diferentes. Si no recuerdo mal, está Login1, que básicamente es un método sin contraseñas para servidores de desarrollo; Login2, una versión obsoleta y propensa a errores (que, si no recuerdo mal, los atacantes pueden usar para evitar prohibiciones) de Login3 (que todos usamos); luego, Login4 (Passpod) y Login5 (OpenID). Todas las versiones tienen bastantes fallas, pero Login3 es la mejor a pesar de enviar credenciales claras.

Passpod, también conocido como login4, no se puede recuperar, ya que utiliza autenticación web que probablemente sea un software perdido. Por eso hay una cuenta regresiva, porque tus credenciales básicamente pasan por una capa web para ser procesadas/validadas y demás, solo era China. Tener una cuenta regresiva en nuestro Login3 no es necesario porque no debería tomar más de 5 segundos y, por lo general, se realiza en 1 o 2 segundos, dependiendo de si usas cifrado o no.

OpenID, también conocido como Login5, es algo que se puede recuperar; se puede rehacer el servidor OpenID, pero aún queda la pregunta "¿Por qué?". Se utilizó para Japón, si mal no recuerdo.

Oficialmente, ahora hay más métodos de inicio de sesión, especialmente Gameforge, Ongame y Steam y probablemente más.

Con la tecnología actual, puedes hacer que tu autenticación pase por Cloudflare, por medio de trabajadores, crear un nuevo método de autenticación de servidor web o simplemente fortalecer Login3. El uso de OpenID o Passpod está prácticamente en desuso y se puede eliminar de forma segura, a menos que tengas una estrategia clara detrás.

I love to learn more curiosities about this game, there is always something new to learn despite the years that pass, I wonder where I can see all this kind of things apart from here in the forum XD. Thanks for your answer, I didn't know that we had more different logins, I had always seen this PassPod thing, and I think I saw it years ago in some private (I don't know if it would be a Chinese one or the first Longjus), but I had no idea that it went through the website. I find it very curious that it was only used in China as Login5 in Japan, but not in Singapore? (If I'm not mistaken Singapore also belongs to Asia although its server has always been English? ), I had the idea because “I thought it was funny” to put a couple of seconds of waiting because I like old things and I'm tinkering with the client, but I never thought I had that web method, but now that I think, it would make sense as the icafe and others, thanks again for expanding my knowledge, I do not know much about webs so I'll leave it that way for now, and I will dedicate myself to eliminate everything related to PassPod to clean code, Greetings!

[Gurgarath 3699]

13 hours ago, nazox said:

I love to learn more curiosities about this game, there is always something new to learn despite the years that pass, I wonder where I can see all this kind of things apart from here in the forum XD. Thanks for your answer, I didn't know that we had more different logins, I had always seen this PassPod thing, and I think I saw it years ago in some private (I don't know if it would be a Chinese one or the first Longjus), but I had no idea that it went through the website. I find it very curious that it was only used in China as Login5 in Japan, but not in Singapore? (If I'm not mistaken Singapore also belongs to Asia although its server has always been English? ), I had the idea because “I thought it was funny” to put a couple of seconds of waiting because I like old things and I'm tinkering with the client, but I never thought I had that web method, but now that I think, it would make sense as the icafe and others, thanks again for expanding my knowledge, I do not know much about webs so I'll leave it that way for now, and I will dedicate myself to eliminate everything related to PassPod to clean code, Greetings!

It is probably due to local laws and contracts. For example, Vietnam had a time-limit system, China had an anti-addiction system that would halve your exp per two, then just negate all the experience you would gain if you were online for too long. I think this is the reason, also considering that some countries requires social security number to play, I would understand the passpod system if it checked that (which I don't know wether or not it does), which would ultimately divert the account database from the publishers to the government or a third party authentication method that is "allowed" to deal with such things.

This is also probably why the Brazilian server is strictly restricted to Brazil, to avoid having players from other part of the world where the game is licensed by another company. But those are my two cents.

About Singapore, they were official for just a few years, not much more. Publishers often decide what to use and what to implement based on local laws and their own idea of the gameplay and I don't think Passpod or OpenID at that time made more sense for them.

Ultimately you can just grab a countdown for log-in, but usually it will connect you before you reach the 55 seconds mark. But it can be a cool "goodie" addition, I myself like that kind of old stuff more than reason should allow.

Edited September 30, 2024 by Gurgarath

[Nazox 473]

On 30/9/2024 at 10:06, Gurgarath said:

Probablemente se deba a las leyes y contratos locales. Por ejemplo, Vietnam tenía un sistema de límite de tiempo, China tenía un sistema anti-adicción que reducía tu experiencia a la mitad cada dos y luego anulaba toda la experiencia que obtendrías si estabas en línea durante demasiado tiempo. Creo que esta es la razón, considerando también que algunos países requieren el número de seguridad social para jugar, entendería el sistema Passpod si lo verificara (lo cual no sé si lo hace o no), lo que en última instancia desviaría la base de datos de cuentas de los editores al gobierno o a un método de autenticación de terceros que esté "permitido" para lidiar con tales cosas.

Probablemente, por eso el servidor brasileño está estrictamente restringido a Brasil, para evitar que haya jugadores de otras partes del mundo donde el juego tiene licencia de otra empresa. Pero esa es mi opinión.

En cuanto a Singapur, fueron oficiales solo por unos pocos años, no mucho más. Los editores suelen decidir qué usar y qué implementar en función de las leyes locales y su propia idea de la jugabilidad, y no creo que Passpod u OpenID en ese momento tuvieran más sentido para ellos.

En última instancia, puedes simplemente tomar una cuenta regresiva para iniciar sesión, pero por lo general te conectará antes de que alcances la marca de 55 segundos. Pero puede ser una adición "buena" interesante, a mí personalmente me gustan ese tipo de cosas antiguas más de lo que la razón debería permitir.

Unbelievable, as far as I can see this only happened in Asia to control the hours of play, I think I once read something like that in an internet news and that sometimes they tried to avoid that kind of control (they could do it in this case with login2 or other methods?), and it seems to me a curious system the Drop reduction when it detects you too much time, all this really could be done with web method and several modifications in the base? I find incredible what they were able to do (for me practically all this is new, I have started to take seriously now the languages, coding, etc), I think now I understand why there is the matrix code, that was like in captcha, this could be as you say related to the passpod?, Or just an extra verification, although really (I speak from ignorance), metin2 in those times would have the ability to send some kind of information to governments, with just a few codes or a section of the database, without giving them access to the database, like Brazil, reminds me a little bit of some myths I read years ago, that to play a Chinese server you had to have access to certain things, which would make sense for what you explain, an extra verification to know that you are a resident, etc.... About Singapore, it's true But recently I saw that he kept insisting that they were official and that he was working with TEC interactive ( I don't know if he has a license), but well back to the topic after the <publishers usually decide what to use and what to implement e> This means that they could even do a pvp server instead of pvm, or more rates, or different drop? I thought they had to be the same as the original even if it was from another company ( sorry if I look stupid), back to the topic and final part, even if we didn't make it to 55 seconds I think it would give it a different and old touch by adding back this method even if it's different even if it only makes a 10 second count for example , I think it's a good addition especially for old type servers, in fact I've been seeing several of your posts and I think we both enjoy gutting and admiring the old things of this game, I would appreciate if you know more things you could share them with us, thanks again for expanding our knowledge. I'm currently trying to somehow fix the Chinese font for the game, it's a font I like but it presents some problems like the arial font, but that's another topic, best regards.

[Gurgarath 3699]

11 minutes ago, nazox said:

(they could do it in this case with login2 or other methods?), and it seems to me a curious system the Drop reduction when it detects you too much time, all this really could be done with web method and several modifications in the base?

No, I just said that this was implemented in some localized versions of the game, unrelated to log-in. It was not possible to circumvent it.

13 minutes ago, nazox said:

But recently I saw that he kept insisting that they were official and that he was working with TEC interactive ( I don't know if he has a license)

They don't, it is basically a private server at that stage, since 2015 something. They haven't received updates past this period and it shows.

14 minutes ago, nazox said:

<publishers usually decide what to use and what to implement e> This means that they could even do a pvp server instead of pvm, or more rates, or different drop? I thought they had to be the same as the original even if it was from another company ( sorry if I look stupid)

They have rooms, they can create their own events, modify some drops and chose what systems to enable or not. This is usually details, but Metin2.us was different than Metin2 Europe. Closest actually to Brazilian server, which has different drops. For example they do not have 75 level weapons in the Grotto, or have the 60 level helmets into the catacombs instead of having them at the frogs (except for the Wolfman helmet, which is probably because they updated without taking into account this difference). Usually, those differences are always in the terms of drops, rates, exp tables, events, stones, fishing... I don't know whether they can make specific servers or not, but they can do speed-servers and event servers, that's for sure.

18 minutes ago, nazox said:

back to the topic and final part, even if we didn't make it to 55 seconds I think it would give it a different and old touch by adding back this method even if it's different even if it only makes a 10 second count for example , I think it's a good addition especially for old type servers

Can be done if you want to, it is not impossible, but I would just suggest you to add a simple countdown, I think it can simply be done in Python rather than trying to salvage Login4.

19 minutes ago, nazox said:

, in fact I've been seeing several of your posts and I think we both enjoy gutting and admiring the old things of this game, I would appreciate if you know more things you could share them with us, thanks again for expanding our knowledge. I'm currently trying to somehow fix the Chinese font for the game, it's a font I like but it presents some problems like the arial font, but that's another topic, best regards.

I really love the old things and I should make a proper collections of old things, regional differences and so on, but it is a lot of work that I also unfortunately forgot. But I started to write it down more often.

Last but not least, you can use Chinese font or Gulim but it will suffer from the same problems and having the Chinese charset on your client is not recommended (it will even probably put out the candidate window). Basically focus on fixing Arial unless you need Chinese support, in that case full blown UTF8 and a better IME would be the solution, but not really easy.

[Nazox 473]

Spoiler

No, I just said that this was implemented in some localized versions of the game, unrelated to log-in. It was not possible to circumvent it.

-I see!, now I understand better, thanks for clearing up my doubts.

Spoiler

They don't, it is basically a private server at that stage, since 2015 something. They haven't received updates past this period and it shows.

-You're right, I think 2-3 days ago I downloaded it to see how it was since they said that to be an <official> and it really shows that they do not receive updates and go to their ball, although TEC interactive is a game company, can not get into trouble for maintaining the metin2 server being “Asia” would understand if it were Europe no?

Spoiler

They have rooms, they can create their own events, modify some drops and chose what systems to enable or not. This is usually details, but Metin2.us was different than Metin2 Europe. Closest actually to Brazilian server, which has different drops. For example they do not have 75 level weapons in the Grotto, or have the 60 level helmets into the catacombs instead of having them at the frogs (except for the Wolfman helmet, which is probably because they updated without taking into account this difference). Usually, those differences are always in the terms of drops, rates, exp tables, events, stones, fishing... I don't know whether they can make specific servers or not, but they can do speed-servers and event servers, that's for sure.

-I think I've seen that once, they're like test servers or something that officials do to try things out? That sometimes they give you gear and P skills and stuff or am I wrong?. I still didn't expect them to <have the freedom> to make their server more of a speed server or event server or the drop thing, truth be told it's crazy.

Spoiler

Can be done if you want to, it is not impossible, but I would just suggest you to add a simple countdown, I think it can simply be done in Python rather than trying to salvage Login4.

-Thanks, I will keep that in mind I don't plan to retrieve another login after the explanation you gave me, in any case, I will try to have a better login and eventually I will see if I can try to replicate with python this we discussed.

Spoiler

I really love the old things and I should make a proper collections of old things, regional differences and so on, but it is a lot of work that I also unfortunately forgot. But I started to write it down more often.

Last but not least, you can use Chinese font or Gulim but it will suffer from the same problems and having the Chinese charset on your client is not recommended (it will even probably put out the candidate window). Basically focus on fixing Arial unless you need Chinese support, in that case full blown UTF8 and a better IME would be the solution, but not really easy.

-Yes, you're right I wanted to use it more than anything in case in the end I was encouraged to implement the newcibn, but for now I will use the default font and eventually if I dare I will fix the arial which is a font that I also like, or at least that's how my young me remembers it, when I played in WoM2.

-I'm glad to hear this, I love old too, especially metin2 and the experiences it brought in my life, and I'm glad to hear that you are writing it more often. Obviously you know more than me, but if there is anything I can help you with or contribute I will be glad to do it, I hope that, even if it takes your time, you are determined to share such compilation and give us wisdom and knowledge, thank you very much for your time again and give me such knowledge, best regards.

[Gurgarath 3699]

3 hours ago, nazox said:

although TEC interactive is a game company, can not get into trouble for maintaining the metin2 server being “Asia” would understand if it were Europe no?

I am no lawyer, but probably too long, too costly, too boring or too anything to be done. I have no proper idea and everything are just hearsay anyway, from some posts here and there on the matter.

3 hours ago, nazox said:

I think I've seen that once, they're like test servers or something that officials do to try things out?

Those are beta servers, indeed to try out features and get feedback from community. Other than that, speed-servers are just server that will be merged after some time. They can also do servers with a lot of events and easier : premium or content-creator servers like Tigerghost or Emerald. They also did a server that is more old-school in terms of gameplay.

3 hours ago, nazox said:

 I will fix the arial which is a font that I also like, or at least that's how my young me remembers it, when I played in WoM2.

WoM2 actually uses a lot of stuff from Metin2.us, including Arial, item, skills, mob names and so on. I think Metin2.sg does as well. This is also the font I really love to play with for that exact nostalgia-fueled reason.

3 hours ago, nazox said:

I'm glad to hear this, I love old too, especially metin2 and the experiences it brought in my life, and I'm glad to hear that you are writing it more often. Obviously you know more than me, but if there is anything I can help you with or contribute I will be glad to do it, I hope that, even if it takes your time, you are determined to share such compilation and give us wisdom and knowledge, thank you very much for your time again and give me such knowledge, best regards.

Thank you and with pleasure! I will try to compile what I know, but usually I just tend to answer posts who are about the game or specific things from it, as I basically spent hours trying to grasp the game, what it was and what it could be, as much as I can

[Nazox 473]

On 10/1/2024 at 6:45 PM, Gurgarath said:

I am no lawyer, but probably too long, too costly, too boring or too anything to be done. I have no proper idea and everything are just hearsay anyway, from some posts here and there on the matter.

Those are beta servers, indeed to try out features and get feedback from community. Other than that, speed-servers are just server that will be merged after some time. They can also do servers with a lot of events and easier : premium or content-creator servers like Tigerghost or Emerald. They also did a server that is more old-school in terms of gameplay.

WoM2 actually uses a lot of stuff from Metin2.us, including Arial, item, skills, mob names and so on. I think Metin2.sg does as well. This is also the font I really love to play with for that exact nostalgia-fueled reason.

Thank you and with pleasure! I will try to compile what I know, but usually I just tend to answer posts who are about the game or specific things from it, as I basically spent hours trying to grasp the game, what it was and what it could be, as much as I can

@ Gurgarath Thanks for all the information, I'm currently working on what we talked about here, I still have some problems, but it's taking shape, also in parallel I'm working on the arial font, I find it curious that just by putting a little bigger letters is fixed xD, About SG you're right, after all are rumors that one reads, I also read that in its golden age when they were official, were the first to try to knock down the private or something, but well, I hope that someday the truth of all anecdote mode! Thanks again for your time.

 

Edited October 4, 2024 by Metin2 Dev International
Core X - External 2 Internal