1
I've been told that people keep reporting this thread, SO here's some links:
Post from CyborgDragon (moderator)
Post from Muserae (moderator)
There's an exploit in Minecraft that lets you login under someone's name without ever needing to know the person's password. All the attacker needs to do is get you to join his/her server once, and s/he can use your account for hours, days, possibly weeks afterwards. This client-side fix patches your game so that it won't let your server tell you to authenticate against a "blank" server ID. You can download a ZIP to install it like any other mod (put the files into minecraft.jar), or Windows users can use the setup program to automatically install the fix.
Name spoof fix for 1.8.1 (ZIP):
minecraft-spoof-fix-1.8.1.zipName spoof fix installer for 1.8.1 (Windows installer):
minecraft-spoof-fix-1.8.1.exe (affects wt.class)Lymia and I reported it to Mojang a while ago, and 1.8 now has a fix but there's still another way to exploit it. You can find more details about the exploit here:
http://www.sk89q.com...oofing-exploit/
The patch does some basic detection of attempts at exploit:
