This situation really does suck. Much of the community is assuming that spacestation14.com auth can no longer be trusted or relied on. But then a bunch of the community moves over to another stack that, frankly, I don't trust and don't want to rely on either, given how they've handled this split.

If I were making a decision in a similar situation, I would likely NOT have gone ahead with spinning up an alternate auth stack from a database backup. I would fear potential legal issues from doing so, and it requires asking thousands of users to do things that nobody running SSO should ever ask their users to do.

I would either wait and see how things shake out, or at least I would force everyone to reset passwords, 2fa, and backup codes if it was absolutely required.

But now I'm treating both spacestation14.com and playss14.com as untrustworthy, and I shouldn't have to do that.

#spacestation14

It rubs me so incredibly the wrong way that, to join Starlight (and likely a bunch of other servers), I have to either do these two steps:

1. set an env var (via steam launch options) to override the auth server for the #spacestation14 launcher (SS14_LAUNCHER_OVERRIDE_AUTH=https://auth.playss14.com/)
2. acknowledge a (rightfully) big scary popup saying that the auth server has changed

or alternatively use a separate launcher provided by playss14.com (or, use Starlight's standalone launcher, but it's motherfucking Windows fucking only so that's not an option on Linux and I'm not fucking running it through wine or proton)

as someone whose last job was on a platform infrastructure security team, I'm absolutely appalled at the current situation for SSO with #spacestation14

Background:

For years, spacestation14.com was the SSO provider for basically all Space Station 14 servers.

There's been some infighting over the past few months about the lead dev holding all the keys to the kingdom, and it's escalated to a split in leadership and ownership.

Currently:

Folks who had been admins for spacestation14.com COPIED THE WHOLE DATABASE and set up an alternate SSO provider and server hub at playss14.com. And at least one major server has switched over to that.

Problem:

I was able to log into an account that I never set up with playss14.com using the same password, TOTP token, and/or backup code as spacestation14.com.

This feels SO EXTREMELY FUCKING SKETCHY. Even if it's truly the same admins and even if they are truly trustworthy, this feels like such a bad fucking idea to just wholesale copy folks auth stuff over to an additional and separate stack.

How I handled this with my personal account(s):

1. went to playss14.com to login. I did NOT enter my password from spacestation14.com. Instead I sent a password reset email, and set a new password.

2. logged into spacestation14.com, disabled and reset 2FA, setup new 2FA, and reset backup codes (storing them safely alongside my old backup codes)

3. logged into playss14.com with one of the old backup codes from spacestation14.com (which I just reset above, so they could no longer be used on spacestation14.com at this point).

4. on playss14.com, disabled 2FA, reset authenticator, setup 2FA again with a new token, and reset backup codes (storing them safely alongside my spacestation14.com backup codes)

now they're completely separate with regard to backup codes and 2fa TOTP tokens.