Decouple Emby user registration from the forum user registration

[Robert Smith 2]

Good morning,

The dark web is riddled with databases from hacked forums. All it takes is a zero-day exploit to download a forum database. I am surprised that the mechanism being used to manage Emby Connect users is forum registration. Even with salted passwords, it is simply bad practice. I recommend separating user credential that pertains to accessing a server from the Emby community forum. At the bare minimum, I would look into offering MFA, which would offer protection from unauthorized users gaining access to an account and servers.

Edited November 23, 2022 by Robert Smith

[ebr 16184]

1 hour ago, Robert Smith said:

I recommend separating user credential that pertains to accessing a server from the Emby community forum

Hi.  You already have this ability.  Using Connect is completely optional.  You can just use your own user authentication that exists only on your server.

[Robert Smith 2]

What about if I want to purchase premier, don't I need to have an account here to do so? I would imagine the email provided to purchase the premier license has to be in your database. I appreciate the ability to creating local accounts, but that does not negates the concerns I shared.  Using a forum to manage registration to features that could give someone access to my server is bad, bad practice. I am not saying that to be rude, I just started using Emby and purchased a lifetime license.  Love the product!  

Edited November 24, 2022 by Robert Smith

[Luke 42078]

12 minutes ago, Robert Smith said:

What about if I want to purchase premier, don't I need to have an account here to do so? I would imagine the email provided to purchase the premier license has to be in your database. I appreciate the ability to creating local accounts, but that does not negates the concerns I shared.  Using a forum to manage registration to features that could give someone access to my server is bad, bad practice. I am not saying that to be rude, I just started using Emby and purchased a lifetime license.  Love the product!  

Hi, no, you do not need to have a forum account for Emby Premiere.

[Robert Smith 2]

Thanks for the clarification.

[Luke 42078]

8 minutes ago, Robert Smith said:

Thanks for the clarification.

The forum and Emby Connect use the same login system, so they are tied together, but they are not a requirement to purchase Emby Premiere or use Premiere features.