- Joined
- Aug 28, 2018
If this is for DRM, they would also need to store the salt so they could recompute the hash. That way when some user connects, they send over the UUID, the server does SHA256(uuid+salt), and then verifies if they are allowed to use the mod. So if the database with the hashes gets leaked, there's a 99% chance the table with the salts is also getting leaked. Then it's trivial to figure out the UUIDs through the method I described above.Ok so that's what salting is for, you salt the uuid with random crap generated at runtime to avoid giving mojang (anyone) an instant way to look up if some user UID is in the hash set. If they manage to get their hands on the set of hashes etc that is.