How secure is QSmack?
Some people have reservations about adding remote admin capability to their server code. After all, if someone guesses the admin password, they can do all the things an admin can do (kick people, change levels, whatever). That’s a valid concern. So let’s see how hard it would be to guess the five-password admin code that we provide for use with QSmack. To be pessimistic, we’ll assume that the server is using the ClanRing code, since that makes fewer impulses available for use as passwords. The first password impulse is basically useless from a security standpoint. It only exists to keep people from seeing a lot of “Unknown command” messages if they are not trying to become an admin. To guess the first password impulse, all you have to do is try impulses until the server does an “init01” stuffcmd back to you. So that leaves four useful password impulses. A user won’t be able to tell whether or not any of the impulses are correct until the end of the sequence, at which point he only know
