Most MU Online sites still store account passwords in MEMB_INFO as plaintext or legacy WebZen MD5, and ask players to type that same password into every site, forum and launcher. One leak and every account is gone. TuServerMU replaces all of that with one secure account - and players never hand their password to your site again.
| Security dimension |
Recommended
TuServerMU SSO
OAuth2 + OpenID Connect
|
Classic MU CMS login
WebEngine / DT-Web / MuWeb defaults
|
Per-site / per-CMS logins
Forum + site + launcher, each its own
|
|---|---|---|---|
| Password storageHow the actual password is kept at rest. | Salted modern hashing (bcrypt / Argon2). Never reversible, never plaintext. |
Plaintext or WebZen MD5 in MEMB_INFO - readable on any DB leak. |
Varies per CMS - often weak or unsalted. |
| Game password shared with the websiteDoes the player type their game password into your site? | Never. The password stays at TuServerMU; sites only receive a token. |
Yes - typed straight into the web form, same as the game. |
Yes - and re-typed into every separate system. |
| Two-factor authentication (TOTP)Authenticator-app second step. | Built in, with recovery codes. |
Not available. |
Rare; a per-system add-on at best. |
| Verified emailProven the account owner controls the inbox. | Required and verified - enables safe recovery. |
Usually optional or unchecked. |
Depends on each platform's config. |
| Single sign-on across site + forum + launcherOne login everywhere. | One account, one login for the whole ecosystem. |
Tied to a single site. |
A separate account per system. |
| Central revocation of accessCut off a compromised app/session in one place. | Players revoke any connected app from one dashboard. |
No concept of it. |
Must be chased down system by system. |
| Breach containmentDoes one hacked website expose game accounts? | A hacked site holds no game passwords - nothing to steal. |
The site reads the live game DB - a leak hands over every account. |
Reused passwords cascade across every system. |
| Open standardsOAuth2, OIDC, PKCE, signed tokens. | Authorization Code + PKCE, signed id_token (RS256), JWKS, discovery. |
Hand-rolled form posts. |
Proprietary, per-CMS. |
| Audit log & bot protectionLogin history, rate limits, captcha. | Login audit log, rate limiting and Cloudflare Turnstile. |
Typically none. |
Inconsistent across systems. |
| Maintenance for the adminWhat you have to secure and patch. | One integration. We carry the security work. |
You own every line of the login yourself. |
N separate auth systems to keep patched. |
“Classic MU CMS login” reflects the out-of-the-box defaults of the popular MU Online CMS platforms. TuServerMU still works with them - our plugins add the secure button without ripping anything out.
