Bukkit

@Foxtrot_CZ

They'll both be the same plugin. I've not yet had the time to edit the OP accordingly to point to the new plugin(s).

Also, I'll likely release a "NoCheat 3.5.1" which will just be "NoCheat 3.5.0" but give a warning on startup, telling the server owner that "NoCheat" is no longer supported and that they should use the other plugin in future.

@DarkFusioN007

Minecrafts authentication protocol is completely broken. I'll try to give a simple explaination:

When a server is in online-mode=true, it will force players that try to connect to solve a little challenge to prove that they own the username that they want to use on the server. That challenge is:

Server: "Dear user, take this random number and upload it under your username to the minecraft.net servers. If you can do that, then you clearly are the owner of that username and I'll let you log in."

What the attacker does:

At the same time that you start to connect to the attackers minecraft server (A), he will start to connect with your username to another server (B). Now (B) will give the attacker the above challenge, which the attacker can't solve (he can't upload stuff to minecraft.net in your name). But the attacker is clever and just forwards the challenge to you, behaving as if it is the challenge of his own server (A). You will be able to solve it and happily upload the random number to minecraft.net, thinking it grants you access to (A), while in fact it grants the attacker access to (B).

This scheme is not identifyable by the user! All you will see is a normal minecraft server in online-mode=true that gives you a normal challenge that you normally solve).

This scheme is not identifyable by the attacked server! All that server sees is a user (the attacker) normally trying to login with a specific username. The server challenge that user as usual, and the user is able to normally solve the challenge. Therefore it is normally accepted onto the server.

Minecraft's authentication scheme is therefore completely broken and can't be trusted. I heavily recommend runnning xAuth or a similar plugin to protect your users from this form of takeover. and especially your ADMIN AND MODERATOR ACCOUNTS.

Because I can reach a lot of people here:

Do not login to any MC servers that you don't fully trust, as it is currently possible for the owner of that server to steal your session and use it to log into another server.

E.g. if you are admin on one server, and somone you don't know invites you onto their server (and you actually log into that server), they are able to log into your server (or any other server) with your username without you noticing. This is possible without them knowing your password (and they don't need it anyway for that) and they can connect to "online-mode=true" servers.

To be save, add an additional line of defense like AuthX and make sure it's active for all "important" players (admins, mods).