From acfce00b99b4a0796098e67f997a8a4dd47751be Mon Sep 17 00:00:00 2001
From: VidTu <imvidtu@proton.me>
Date: Fri, 9 Feb 2024 02:18:49 +0300
Subject: [PATCH] feat: More security things

---
 .ias/disabled_v1                              |  3 +
 .../main/java/ru/vidtu/ias/IASMinecraft.java  | 11 +--
 .../java/ru/vidtu/ias/screen/AccountList.java |  6 +-
 ...AccountsScreen.java => AccountScreen.java} | 40 ++++++++-
 .../ru/vidtu/ias/screen/ConfigScreen.java     |  8 ++
 .../ias/screen/MicrosoftPopupScreen.java      | 29 +++---
 docs/TERMS.md                                 |  6 ++
 src/main/java/ru/vidtu/ias/IAS.java           | 89 ++++++++++++++++---
 src/main/java/ru/vidtu/ias/auth/MSAuth.java   |  5 +-
 .../java/ru/vidtu/ias/auth/MSAuthServer.java  |  2 +-
 .../java/ru/vidtu/ias/config/IASStorage.java  | 42 +++++++--
 src/main/java/ru/vidtu/ias/crypt/Crypt.java   |  4 +-
 .../ru/vidtu/ias/crypt/HardwareCrypt.java     |  6 +-
 .../ru/vidtu/ias/crypt/PasswordCrypt.java     |  6 +-
 src/main/resources/assets/ias/lang/en_us.json |  6 +-
 src/main/resources/assets/ias/lang/ru_ru.json |  6 +-
 16 files changed, 209 insertions(+), 60 deletions(-)
 create mode 100644 .ias/disabled_v1
 rename 1.20.4/src/main/java/ru/vidtu/ias/screen/{AccountsScreen.java => AccountScreen.java} (86%)

diff --git a/.ias/disabled_v1 b/.ias/disabled_v1
new file mode 100644
index 00000000..6f21eb1c
--- /dev/null
+++ b/.ias/disabled_v1
@@ -0,0 +1,3 @@
+# This file will contain any versions with issues critical enough
+# to prohibit this mod from working, one version per line.
+# Special case: If any of lines is equal to "ALL", then all versions will be disabled.
diff --git a/1.20.4/src/main/java/ru/vidtu/ias/IASMinecraft.java b/1.20.4/src/main/java/ru/vidtu/ias/IASMinecraft.java
index 501eb70a..4e98e369 100644
--- a/1.20.4/src/main/java/ru/vidtu/ias/IASMinecraft.java
+++ b/1.20.4/src/main/java/ru/vidtu/ias/IASMinecraft.java
@@ -50,7 +50,7 @@
 import ru.vidtu.ias.account.Account;
 import ru.vidtu.ias.config.IASConfig;
 import ru.vidtu.ias.mixins.MinecraftAccessor;
-import ru.vidtu.ias.screen.AccountsScreen;
+import ru.vidtu.ias.screen.AccountScreen;
 import ru.vidtu.ias.utils.Expression;
 import ru.vidtu.ias.utils.IUtils;
 
@@ -123,10 +123,7 @@ public static void init(Path gameDir, Path configDir, String loader, String modV
         LOGGER.info("IAS: Booting up... (version: {}, loader: {}, loader version: {}, game version: {})", modVersion, loader, loaderVersion, gameVersion);
 
         // Initialize the IAS.
-        IAS.init(gameDir, configDir);
-
-        // Set the UA.
-        IAS.userAgent(modVersion, loader, loaderVersion, gameVersion);
+        IAS.init(gameDir, configDir, modVersion, loader, loaderVersion, gameVersion);
     }
 
     /**
@@ -175,7 +172,7 @@ public static void onInit(Minecraft minecraft, Screen screen, Consumer<Button> b
             }
 
             // Add the button.
-            ImageButton button = new ImageButton(x, y, 20, 20, BUTTON, btn -> minecraft.setScreen(new AccountsScreen(screen)), Component.literal("In-Game Account Switcher"));
+            ImageButton button = new ImageButton(x, y, 20, 20, BUTTON, btn -> minecraft.setScreen(new AccountScreen(screen)), Component.literal("In-Game Account Switcher"));
             button.setTooltip(Tooltip.create(button.getMessage()));
             button.setTooltipDelay(250);
             buttonAdder.accept(button);
@@ -219,7 +216,7 @@ public static void onInit(Minecraft minecraft, Screen screen, Consumer<Button> b
             }
 
             // Add the button.
-            ImageButton button = new ImageButton(x, y, 20, 20, BUTTON, btn -> minecraft.setScreen(new AccountsScreen(screen)), Component.literal("In-Game Account Switcher"));
+            ImageButton button = new ImageButton(x, y, 20, 20, BUTTON, btn -> minecraft.setScreen(new AccountScreen(screen)), Component.literal("In-Game Account Switcher"));
             button.setTooltip(Tooltip.create(button.getMessage()));
             button.setTooltipDelay(250);
             buttonAdder.accept(button);
diff --git a/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountList.java b/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountList.java
index da3d1a6b..8d1469af 100644
--- a/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountList.java
+++ b/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountList.java
@@ -57,7 +57,7 @@ final class AccountList extends ObjectSelectionList<AccountEntry> {
     /**
      * Parent screen.
      */
-    private final AccountsScreen screen;
+    private final AccountScreen screen;
 
     /**
      * Creates a new accounts list widget.
@@ -68,7 +68,7 @@ final class AccountList extends ObjectSelectionList<AccountEntry> {
      * @param offset    List Y offset
      * @param item      Entry height
      */
-    AccountList(AccountsScreen screen, Minecraft minecraft, int width, int height, int offset, int item) {
+    AccountList(AccountScreen screen, Minecraft minecraft, int width, int height, int offset, int item) {
         super(minecraft, width, height, offset, item);
         this.screen = screen;
         this.update(this.screen.search().getValue());
@@ -387,7 +387,7 @@ void swapDown(AccountEntry entry) {
      *
      * @return Parent accounts screen
      */
-    AccountsScreen screen() {
+    AccountScreen screen() {
         return this.screen;
     }
 
diff --git a/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountsScreen.java b/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountScreen.java
similarity index 86%
rename from 1.20.4/src/main/java/ru/vidtu/ias/screen/AccountsScreen.java
rename to 1.20.4/src/main/java/ru/vidtu/ias/screen/AccountScreen.java
index 1effbd7a..e5b0e07a 100644
--- a/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountsScreen.java
+++ b/1.20.4/src/main/java/ru/vidtu/ias/screen/AccountScreen.java
@@ -27,14 +27,24 @@
 import net.minecraft.client.gui.components.PlayerSkinWidget;
 import net.minecraft.client.gui.components.Tooltip;
 import net.minecraft.client.gui.navigation.CommonInputs;
+import net.minecraft.client.gui.screens.AlertScreen;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.resources.DefaultPlayerSkin;
 import net.minecraft.network.chat.CommonComponents;
 import net.minecraft.network.chat.Component;
 import org.lwjgl.glfw.GLFW;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import ru.vidtu.ias.IAS;
 import ru.vidtu.ias.account.Account;
+import ru.vidtu.ias.config.IASStorage;
+
+public final class AccountScreen extends Screen {
+    /**
+     * Logger for this class.
+     */
+    private static final Logger LOGGER = LoggerFactory.getLogger("IAS/AccountScreen");
 
-public final class AccountsScreen extends Screen {
     /**
      * Parent screen, {@code null} if none.
      */
@@ -80,7 +90,7 @@ public final class AccountsScreen extends Screen {
      *
      * @param parent Parent screen, {@code null} if none
      */
-    public AccountsScreen(Screen parent) {
+    public AccountScreen(Screen parent) {
         super(Component.translatable("ias.accounts"));
         this.parent = parent;
     }
@@ -90,6 +100,30 @@ protected void init() {
         // Bruh.
         assert this.minecraft != null;
 
+        // Disabled check.
+        if (IAS.disabled()) {
+            this.minecraft.setScreen(new AlertScreen(this::onClose, Component.translatable("ias.disabled.title").withStyle(ChatFormatting.RED),
+                    Component.translatable("ias.disabled.text"), CommonComponents.GUI_BACK, true));
+            return;
+        }
+
+        // Disclaimer.
+        if (!IASStorage.gameDisclaimerShown) {
+            this.minecraft.setScreen(new AlertScreen(() -> {
+                // Save disclaimer.
+                try {
+                    IAS.gameDisclaimerShownStorage();
+                } catch (Throwable t) {
+                    LOGGER.error("Unable to set or write game disclaimer state.", t);
+                }
+
+                // Set screen.
+                this.minecraft.setScreen(this);
+            }, Component.translatable("ias.disclaimer.title").withStyle(ChatFormatting.YELLOW),
+                    Component.translatable("ias.disclaimer.text"), CommonComponents.GUI_CONTINUE, false));
+            return;
+        }
+
         // Add search widget.
         this.search = new EditBox(this.font, this.width / 2 - 75, 11, 150, 20, this.search, Component.translatable("ias.accounts.search"));
         this.search.setHint(this.search.getMessage().copy().withStyle(ChatFormatting.DARK_GRAY));
@@ -287,7 +321,7 @@ public boolean keyPressed(int key, int scan, int mods) {
 
     @Override
     public String toString() {
-        return "AccountsScreen{" +
+        return "AccountScreen{" +
                 "list=" + this.list +
                 '}';
     }
diff --git a/1.20.4/src/main/java/ru/vidtu/ias/screen/ConfigScreen.java b/1.20.4/src/main/java/ru/vidtu/ias/screen/ConfigScreen.java
index 5afd0ce2..5916a544 100644
--- a/1.20.4/src/main/java/ru/vidtu/ias/screen/ConfigScreen.java
+++ b/1.20.4/src/main/java/ru/vidtu/ias/screen/ConfigScreen.java
@@ -26,6 +26,7 @@
 import net.minecraft.client.gui.components.Checkbox;
 import net.minecraft.client.gui.components.EditBox;
 import net.minecraft.client.gui.components.Tooltip;
+import net.minecraft.client.gui.screens.AlertScreen;
 import net.minecraft.client.gui.screens.Screen;
 import net.minecraft.client.resources.sounds.SimpleSoundInstance;
 import net.minecraft.network.chat.CommonComponents;
@@ -121,6 +122,13 @@ protected void init() {
         // Bruh.
         assert this.minecraft != null;
 
+        // Disabled check.
+        if (IAS.disabled()) {
+            this.minecraft.setScreen(new AlertScreen(this::onClose, Component.translatable("ias.disabled.title").withStyle(ChatFormatting.RED),
+                    Component.translatable("ias.disabled.text"), CommonComponents.GUI_BACK, true));
+            return;
+        }
+
         // Title Text.
         Checkbox box = Checkbox.builder(Component.translatable("ias.config.titleText"), this.font)
                 .pos(5, 20)
diff --git a/1.20.4/src/main/java/ru/vidtu/ias/screen/MicrosoftPopupScreen.java b/1.20.4/src/main/java/ru/vidtu/ias/screen/MicrosoftPopupScreen.java
index dc3c233e..87f904a2 100644
--- a/1.20.4/src/main/java/ru/vidtu/ias/screen/MicrosoftPopupScreen.java
+++ b/1.20.4/src/main/java/ru/vidtu/ias/screen/MicrosoftPopupScreen.java
@@ -22,6 +22,7 @@
 import com.mojang.blaze3d.vertex.PoseStack;
 import net.minecraft.ChatFormatting;
 import net.minecraft.Util;
+import net.minecraft.client.KeyboardHandler;
 import net.minecraft.client.gui.GuiGraphics;
 import net.minecraft.client.gui.components.Button;
 import net.minecraft.client.gui.components.MultiLineLabel;
@@ -42,6 +43,7 @@
 import ru.vidtu.ias.crypt.PasswordCrypt;
 import ru.vidtu.ias.utils.ProbableException;
 
+import java.util.Locale;
 import java.util.Objects;
 import java.util.concurrent.CompletableFuture;
 import java.util.function.Consumer;
@@ -221,6 +223,18 @@ public void onClose() {
 
     @Override
     public void removed() {
+        // Bruh.
+        assert this.minecraft != null;
+
+        // Check if IAS ID is in clipboard.
+        KeyboardHandler keyboard = this.minecraft.keyboardHandler;
+        String clipboard = keyboard.getClipboard();
+
+        // Null if it is.
+        if (clipboard.toLowerCase(Locale.ROOT).contains(IAS.CLIENT_ID.toLowerCase(Locale.ROOT))) {
+            keyboard.setClipboard(" ");
+        }
+
         // Close the server, if any.
         IAS.executor().execute(() -> {
             if (this.server != null) {
@@ -335,21 +349,6 @@ public void success(MicrosoftAccount account) {
         // Skip if not current screen.
         if (this != this.minecraft.screen) return;
 
-        // User cancelled.
-        if (account == null) {
-            // Schedule on main.
-            this.minecraft.execute(() -> {
-                // Skip if not current screen.
-                if (this != this.minecraft.screen) return;
-
-                // Back to parent screen.
-                this.minecraft.setScreen(this.parent);
-            });
-
-            // Don't log in.
-            return;
-        }
-
         // Write disclaimers.
         this.stage(MicrosoftAccount.FINALIZING);
 
diff --git a/docs/TERMS.md b/docs/TERMS.md
index a6dee786..4b10e49f 100644
--- a/docs/TERMS.md
+++ b/docs/TERMS.md
@@ -2,6 +2,8 @@
 
 These are the terms provided of the In-Game Account Switcher mod.
 
+Last update: **February 8, 2024** (UTC)
+
 ## Mod
 
 This mod is redistributed under [GNU LGPLv3](../LICENSE) and its terms apply to the mod usage and distribution.
@@ -22,3 +24,7 @@ and Microsoft's [Terms of Use](https://www.microsoft.com/en-us/legal/terms-of-us
 and [Services Agreement](https://www.microsoft.com/en-us/servicesagreement) apply.
 By using this mod, you agree to the Microsoft Terms of Use, Microsoft Privacy Statement,
 and Microsoft Usage Guidelines.
+
+## GitHub
+
+This mod connects to the GitHub approximately every two hours.
diff --git a/src/main/java/ru/vidtu/ias/IAS.java b/src/main/java/ru/vidtu/ias/IAS.java
index 8e501ec1..4304c620 100644
--- a/src/main/java/ru/vidtu/ias/IAS.java
+++ b/src/main/java/ru/vidtu/ias/IAS.java
@@ -25,12 +25,18 @@
 import ru.vidtu.ias.config.IASConfig;
 import ru.vidtu.ias.config.IASStorage;
 
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
 import java.nio.file.Path;
+import java.time.Duration;
 import java.util.Objects;
 import java.util.UUID;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
+import java.util.stream.Stream;
 
 /**
  * Main IAS class.
@@ -78,6 +84,12 @@ public final class IAS {
      */
     private static Path configDirectory;
 
+    /**
+     * Whether the mod is disabled remotely.
+     */
+    @SuppressWarnings("NegativelyNamedBooleanVariable") // <- The negative naming is intended.
+    private static boolean disabled = false;
+
     /**
      * An instance of this class cannot be created.
      *
@@ -90,14 +102,22 @@ private IAS() {
     /**
      * Initializes the IAS.
      *
-     * @param gamePath   Game directory
-     * @param configPath Config directory
+     * @param gamePath      Game directory
+     * @param configPath    Config directory
+     * @param version       Mod version
+     * @param loader        Mod loader
+     * @param loaderVersion Mod loader version
+     * @param gameVersion   Game version
      */
-    public static void init(Path gamePath, Path configPath) {
+    public static void init(Path gamePath, Path configPath, String version, String loader, String loaderVersion, String gameVersion) {
         // Initialize the dirs.
         gameDirectory = gamePath;
         configDirectory = configPath;
 
+        // Set up IAS.
+        userAgent = USER_AGENT_TEMPLATE.formatted(version, SESSION, loader, loaderVersion, gameVersion, Runtime.version().toString());
+        LOGGER.info("IAS user agent: {}", userAgent);
+
         // Write the disclaimers.
         try {
             disclaimersStorage();
@@ -121,6 +141,42 @@ public static void init(Path gamePath, Path configPath) {
 
         // Create the executor.
         executor = Executors.newSingleThreadScheduledExecutor(r -> new Thread(r, "IAS Executor Thread"));
+
+        // Perform initial loading.
+        if (!Boolean.getBoolean("ias.skipDisableScanning")) return;
+        executor.execute(() -> {
+            // Perform scanning, if allowed.
+            try {
+                // Create the client.
+                HttpClient client = HttpClient.newBuilder()
+                        .connectTimeout(Duration.ofSeconds(10L))
+                        .version(HttpClient.Version.HTTP_2)
+                        .followRedirects(HttpClient.Redirect.NORMAL)
+                        .executor(Runnable::run)
+                        .priority(1)
+                        .build();
+
+                // Send the request.
+                HttpResponse<Stream<String>> response = client.send(HttpRequest.newBuilder(new URI("https://raw.githubusercontent.com/The-Fireplace-Minecraft-Mods/In-Game-Account-Switcher/main/.ias/disabled_v1"))
+                        .header("User-Agent", userAgent)
+                        .timeout(Duration.ofSeconds(10L))
+                        .GET()
+                        .build(), HttpResponse.BodyHandlers.ofLines());
+
+                // Validate the code.
+                int code = response.statusCode();
+                if (code < 200 || code > 299) return;
+
+                // Check the lines.
+                disabled = response.body().anyMatch(line -> {
+                    line = line.strip();
+                    if ("ALL".equalsIgnoreCase(line)) return true;
+                    return version.equalsIgnoreCase(line);
+                });
+            } catch (Throwable ignored) {
+                // NO-OP
+            }
+        });
     }
 
     /**
@@ -149,7 +205,11 @@ public static void close() {
 
         // Write the disclaimers, if we can.
         if (gameDirectory != null) {
-            disclaimersStorage();
+            try {
+                disclaimersStorage();
+            } catch (Throwable ignored) {
+                // NO-OP
+            }
         }
     }
 
@@ -176,16 +236,12 @@ public static String userAgent() {
     }
 
     /**
-     * Sets the user agent for usage in {@link MSAuth}.
+     * Gets the disabled state.
      *
-     * @param version       Mod version
-     * @param loader        Mod loader
-     * @param loaderVersion Mod loader version
-     * @param gameVersion   Game version
+     * @return Whether the mod is disabled remotely
      */
-    public static void userAgent(String version, String loader, String loaderVersion, String gameVersion) {
-        userAgent = USER_AGENT_TEMPLATE.formatted(version, SESSION, loader, loaderVersion, gameVersion, Runtime.version().toString());
-        LOGGER.info("IAS user agent: {}", userAgent);
+    public static boolean disabled() {
+        return disabled;
     }
 
     /**
@@ -232,4 +288,13 @@ public static void saveStorage() {
     public static void disclaimersStorage() {
         IASStorage.disclaimers(gameDirectory);
     }
+
+    /**
+     * Delegates to {@link IASStorage#gameDisclaimerShown(Path)} with {@link #gameDirectory}.
+     *
+     * @throws RuntimeException If unable to set or write game disclaimer shown persistent state
+     */
+    public static void gameDisclaimerShownStorage() {
+        IASStorage.gameDisclaimerShown(gameDirectory);
+    }
 }
diff --git a/src/main/java/ru/vidtu/ias/auth/MSAuth.java b/src/main/java/ru/vidtu/ias/auth/MSAuth.java
index e53dcca7..01f0fe37 100644
--- a/src/main/java/ru/vidtu/ias/auth/MSAuth.java
+++ b/src/main/java/ru/vidtu/ias/auth/MSAuth.java
@@ -135,8 +135,11 @@ public MSAuth(String userAgent, String clientId, String redirectUri, Duration ti
 
             // Create the client.
             this.client = HttpClient.newBuilder()
-                    .executor(executor)
                     .connectTimeout(timeout)
+                    .version(HttpClient.Version.HTTP_2)
+                    .followRedirects(HttpClient.Redirect.NEVER)
+                    .executor(executor)
+                    .priority(256)
                     .build();
 
             // Create the endpoints.
diff --git a/src/main/java/ru/vidtu/ias/auth/MSAuthServer.java b/src/main/java/ru/vidtu/ias/auth/MSAuthServer.java
index 07dc17d6..525be750 100644
--- a/src/main/java/ru/vidtu/ias/auth/MSAuthServer.java
+++ b/src/main/java/ru/vidtu/ias/auth/MSAuthServer.java
@@ -156,7 +156,7 @@ public MSAuthServer(String doneMessage, Crypt crypt, CreateHandler handler) {
 
             // Generate the state.
             SecureRandom random = SecureRandom.getInstanceStrong();
-            int length = random.nextInt(64, 96);
+            int length = random.nextInt(96, 128);
             StringBuilder builder = new StringBuilder(length);
             for (int i = 0; i < length; i++) {
                 builder.appendCodePoint(STATE_CHARACTERS.codePointAt(random.nextInt(STATE_CHARACTERS.length())));
diff --git a/src/main/java/ru/vidtu/ias/config/IASStorage.java b/src/main/java/ru/vidtu/ias/config/IASStorage.java
index 7236341b..8a687fa4 100644
--- a/src/main/java/ru/vidtu/ias/config/IASStorage.java
+++ b/src/main/java/ru/vidtu/ias/config/IASStorage.java
@@ -28,6 +28,7 @@
 import java.io.DataInputStream;
 import java.io.DataOutputStream;
 import java.nio.file.Files;
+import java.nio.file.LinkOption;
 import java.nio.file.Path;
 import java.nio.file.StandardOpenOption;
 import java.util.ArrayList;
@@ -95,6 +96,11 @@ AND REVOKE THE PERMISSIONS (ACCESS) TO THE "In-Game Account Switcher" APPLICATIO
      */
     public static List<Account> accounts = new ArrayList<>(0);
 
+    /**
+     * Whether the game disclaimer was shown.
+     */
+    public static boolean gameDisclaimerShown = false;
+
     /**
      * An instance of this class cannot be created.
      *
@@ -126,7 +132,7 @@ public static void disclaimers(Path path) {
                 // Write the disclaimer.
                 Files.writeString(file, DISCLAIMER, StandardOpenOption.CREATE,
                         StandardOpenOption.TRUNCATE_EXISTING, StandardOpenOption.WRITE,
-                        StandardOpenOption.SYNC, StandardOpenOption.DSYNC);
+                        StandardOpenOption.SYNC, StandardOpenOption.DSYNC, LinkOption.NOFOLLOW_LINKS);
             }
         } catch (Throwable t) {
             // Rethrow.
@@ -143,13 +149,16 @@ public static void disclaimers(Path path) {
     public static void load(Path path) {
         try {
             // Get the file.
-            Path file = path.resolve("_IAS_ACCOUNTS_DO_NOT_SEND_TO_ANYONE/.hidden/accounts_v1.do_not_send_to_anyone");
+            Path folder = path.resolve("_IAS_ACCOUNTS_DO_NOT_SEND_TO_ANYONE/.hidden");
+            Path file = folder.resolve("accounts_v1.do_not_send_to_anyone");
+            gameDisclaimerShown = Files.isRegularFile(folder.resolve("game_disclaimer_shown"), LinkOption.NOFOLLOW_LINKS);
 
             // Skip if it doesn't exist.
-            if (!Files.isRegularFile(file)) {
+            if (!Files.isRegularFile(file, LinkOption.NOFOLLOW_LINKS)) {
                 save(path);
                 return;
             }
+            file = file.toRealPath(LinkOption.NOFOLLOW_LINKS);
 
             // Read the data.
             byte[] data = Files.readAllBytes(file);
@@ -216,14 +225,14 @@ public static void save(Path path) {
 
             // Try to make folder hidden on Windows. (already hidden by name on UNIX-like)
             try {
-                Files.setAttribute(file.getParent(), "dos:hidden", true);
+                Files.setAttribute(file.getParent(), "dos:hidden", true, LinkOption.NOFOLLOW_LINKS);
             } catch (Throwable ignored) {
                 // Ignored
             }
 
             // Try to make folder EXTRA hidden on Windows. (already hidden by name on UNIX-like)
             try {
-                Files.setAttribute(file.getParent(), "dos:system", true);
+                Files.setAttribute(file.getParent(), "dos:system", true, LinkOption.NOFOLLOW_LINKS);
             } catch (Throwable ignored) {
                 // Ignored
             }
@@ -231,10 +240,31 @@ public static void save(Path path) {
             // Write the data.
             Files.write(file, data, StandardOpenOption.CREATE,
                     StandardOpenOption.TRUNCATE_EXISTING, StandardOpenOption.WRITE,
-                    StandardOpenOption.SYNC, StandardOpenOption.DSYNC);
+                    StandardOpenOption.SYNC, StandardOpenOption.DSYNC, LinkOption.NOFOLLOW_LINKS);
         } catch (Throwable t) {
             // Rethrow.
             throw new RuntimeException("Unable to save IAS storage.", t);
         }
     }
+
+    /**
+     * Sets the {@link #gameDisclaimerShown} to {@code true} and writes the persistent state file.
+     *
+     * @param path Game directory
+     * @throws RuntimeException If unable to set or write game disclaimer shown persistent state
+     */
+    public static void gameDisclaimerShown(Path path) {
+        try {
+            // Set the parameter.
+            gameDisclaimerShown = true;
+
+            // Create the file.
+            Path file = path.resolve("_IAS_ACCOUNTS_DO_NOT_SEND_TO_ANYONE/.hidden/game_disclaimer_shown");
+            Files.createDirectories(file.getParent());
+            Files.createFile(file);
+        } catch (Throwable t) {
+            // Rethrow.
+            throw new RuntimeException("Unable to mark game disclaimer as shown.", t);
+        }
+    }
 }
diff --git a/src/main/java/ru/vidtu/ias/crypt/Crypt.java b/src/main/java/ru/vidtu/ias/crypt/Crypt.java
index ab9f7e44..549a3e90 100644
--- a/src/main/java/ru/vidtu/ias/crypt/Crypt.java
+++ b/src/main/java/ru/vidtu/ias/crypt/Crypt.java
@@ -122,7 +122,7 @@ static byte[] pbkdfAesEncrypt(byte[] decrypted, String password, byte[] salt, by
         try {
             // Create the key.
             SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512");
-            KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 500_000, 256);
+            KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 300_000, 256);
             byte[] secret = factory.generateSecret(spec).getEncoded();
             SecretKey key = new SecretKeySpec(secret, "AES");
             Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
@@ -150,7 +150,7 @@ static byte[] pbkdfAesDecrypt(byte[] encrypted, String password, byte[] salt, by
         try {
             // Create the key.
             SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA512");
-            KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 500_000, 256);
+            KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 300_000, 256);
             byte[] secret = factory.generateSecret(spec).getEncoded();
             SecretKey key = new SecretKeySpec(secret, "AES");
             Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
diff --git a/src/main/java/ru/vidtu/ias/crypt/HardwareCrypt.java b/src/main/java/ru/vidtu/ias/crypt/HardwareCrypt.java
index eef94134..56745ce7 100644
--- a/src/main/java/ru/vidtu/ias/crypt/HardwareCrypt.java
+++ b/src/main/java/ru/vidtu/ias/crypt/HardwareCrypt.java
@@ -91,7 +91,7 @@ public byte[] encrypt(byte[] decrypted) {
         try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
             // Generate and write salt.
             SecureRandom random = SecureRandom.getInstanceStrong();
-            byte[] salt = new byte[256];
+            byte[] salt = new byte[128];
             random.nextBytes(salt);
             out.write(salt);
 
@@ -119,9 +119,9 @@ public byte[] encrypt(byte[] decrypted) {
     public byte[] decrypt(byte[] encrypted) {
         try (ByteArrayInputStream in = new ByteArrayInputStream(encrypted)) {
             // Read the salt.
-            byte[] salt = new byte[256];
+            byte[] salt = new byte[128];
             int read = in.read(salt);
-            if (read != 256) {
+            if (read != 128) {
                 throw new EOFException("Not enough salt bytes: " + read);
             }
 
diff --git a/src/main/java/ru/vidtu/ias/crypt/PasswordCrypt.java b/src/main/java/ru/vidtu/ias/crypt/PasswordCrypt.java
index 144c7b34..ea2a4198 100644
--- a/src/main/java/ru/vidtu/ias/crypt/PasswordCrypt.java
+++ b/src/main/java/ru/vidtu/ias/crypt/PasswordCrypt.java
@@ -49,7 +49,7 @@ public byte[] encrypt(byte[] decrypted) {
         try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
             // Generate and write salt.
             SecureRandom random = SecureRandom.getInstanceStrong();
-            byte[] salt = new byte[256];
+            byte[] salt = new byte[128];
             random.nextBytes(salt);
             out.write(salt);
 
@@ -74,9 +74,9 @@ public byte[] encrypt(byte[] decrypted) {
     public byte[] decrypt(byte[] encrypted) {
         try (ByteArrayInputStream in = new ByteArrayInputStream(encrypted)) {
             // Read the salt.
-            byte[] salt = new byte[256];
+            byte[] salt = new byte[128];
             int read = in.read(salt);
-            if (read != 256) {
+            if (read != 128) {
                 throw new EOFException("Not enough salt bytes: " + read);
             }
 
diff --git a/src/main/resources/assets/ias/lang/en_us.json b/src/main/resources/assets/ias/lang/en_us.json
index 87a9178f..a272802a 100644
--- a/src/main/resources/assets/ias/lang/en_us.json
+++ b/src/main/resources/assets/ias/lang/en_us.json
@@ -1,7 +1,9 @@
 {
   "ias.title": "Current Account: %s",
-  "ias.disclaimer.title": "Security Disclaimer",
-  "ias.disclaimer.text": "Within your game folder '%s' a sub-folder named '%s' has been created. DO NOT SEND THIS SUB-FOLDER TO ANYONE. If you did send this folder to anyone, follow the steps described in the 'READ_ME_IMPORTANT.txt' file in that sub-folder.",
+  "ias.disclaimer.title": "In-Game Account Switcher: Security Disclaimer",
+  "ias.disclaimer.text": "Within your game folder a sub-folder named '_IAS_ACCOUNTS_DO_NOT_SEND_TO_ANYONE' has been created. DO NOT SEND THIS SUB-FOLDER TO ANYONE, EVEN IF THEY'RE SAYING THEY ARE THE DEVELOPERS OF THIS MOD. If you did send this folder to anyone, follow the steps described in the 'READ_ME_IMPORTANT.txt' file in that sub-folder or the guidelines on the mod's page. You can also look at the mod's page to understand what is Crypt, why it's needed and how to ensure your account/token is safe.",
+  "ias.disabled.title": "In-Game Account Switcher: Disabled",
+  "ias.disabled.text": "This version is the mod has been disabled due to vulnerabilities or other critical problems. See the mod's page for more info. You won't be able to use current version of the mod.",
   "ias.accounts": "In-Game Account Switcher Accounts",
   "ias.accounts.search": "Search...",
   "ias.accounts.login": "Login",
diff --git a/src/main/resources/assets/ias/lang/ru_ru.json b/src/main/resources/assets/ias/lang/ru_ru.json
index c0861246..f62bf36a 100644
--- a/src/main/resources/assets/ias/lang/ru_ru.json
+++ b/src/main/resources/assets/ias/lang/ru_ru.json
@@ -1,7 +1,9 @@
 {
   "ias.title": "Текущий аккаунт: %s",
-  "ias.disclaimer.title": "Уведомление о безопасности",
-  "ias.disclaimer.text": "В вашей игровой папке '%s' была создана подпапка '%s'. НЕ ОТПРАВЛЯЙТЕ ЭТУ ПОДПАПКУ НИКОМУ. Если вы отправили эту папку кому-либо, следуйте инструкциям из файла 'ПРОЧТИ_МЕНЯ_ВАЖНО.txt' из этой подпапки.",
+  "ias.disclaimer.title": "In-Game Account Switcher: Дисклеймер безопасности",
+  "ias.disclaimer.text": "В вашей игровой папке была создана подпапка '_IAS_ACCOUNTS_DO_NOT_SEND_TO_ANYONE'. НЕ ОТПРАВЛЯЙТЕ ЭТУ ПОДПАПКУ НИКОМУ, ДАЖЕ ЕСЛИ ОНИ ГОВОРЯТ, ЧТО ОНИ РАЗРАБОТЧИКИ ЭТОГО МОДА. Если вы отправили эту папку кому-либо, следуйте инструкциям из файла 'ПРОЧТИ_МЕНЯ_ВАЖНО.txt' из этой подпапки или гайды со страницы мода. А ещё вы можете заглянуть на страницу мода, чтобы понять, что такое шифр, зачем он нужен и как удостовериться в том, что ваш аккаунт/токен в безопасности.",
+  "ias.disabled.title": "In-Game Account Switcher: Отключён",
+  "ias.disabled.text": "Эта версия мода была отключена из-за уязвимостей или из-за других критических проблем. Загляните на страницу мода для подробностей. Вы не сможете использовать текущую версию мода.",
   "ias.accounts": "Аккаунты In-Game Account Switcher",
   "ias.accounts.search": "Поиск...",
   "ias.accounts.login": "Войти",