BetterLAN

# Version 1.0.1 - The Security Update ## New Features & Improvements: ### Anti-MITM Security Fingerprints: Added a state-of-the-art End-to-End Encryption (E2EE) verification system. When a guest attempts to join a host's LAN world, both players will now see a 6-digit Security Fingerprint (derived from the SHA-256 hash of the ECDH-exchanged AES session key). Players can verbally verify this code to guarantee 100% immunity against Man-in-the-Middle (MITM) attacks. ### Seamless UI Integration: The fingerprint waiting screen seamlessly overlays the Vanilla "Connecting to server..." screen, preserving the native connection lifecycle and cancel button functionality without interrupting the underlying Netty network pipeline. ### Host Approval System Enhancement: The host now receives the security fingerprint directly in the chat prompt when deciding to [Accept] or [Reject] an incoming connection. ## Bug Fixes: ### Fixed Server List Ghosting: Resolved an issue where offline LAN rooms were not properly removed from the Multiplayer server list due to I18n and formatting code mismatches. ### Fixed Network Daemon Deadlock: Fixed a critical issue where the background presence heartbeat thread would permanently freeze if the initial DNS resolution failed or if the player hadn't opened the config screen (Lazy-loading trap fixed). ### Connection Timeout Stability: Improved the TCP connection timeout logic to accurately drop dead connections and auto-reconnect without locking up the client.

# BetterLAN Release Notes: Security Refactoring and Architecture Upgrade _Removed v0.0.1 due to security vulnerabilities._ ## Cryptography & Security **Implemented True End-to-End Encryption (E2EE):** Introduced Elliptic-Curve Diffie-Hellman (ECDH) dynamic key exchange. Session keys are negotiated independently by both endpoints, providing Perfect Forward Secrecy (PFS) and stripping the relay node of any traffic decryption capabilities. **Fixed Stream Cipher Vulnerability:** Refactored the underlying encryptor to deprecate fixed Initialization Vectors (IV). A cryptographically strong 16-byte random IV is now generated per connection during the initial handshake, thoroughly mitigating key-stream reuse attacks. **Strengthened Key Derivation Function:** Replaced single-pass hashing with the industry-standard PBKDF2 algorithm (65,536 iterations with a static salt) to derive local encryption keys, significantly raising the threshold against brute-force and dictionary attacks. **Decoupled Authentication and Encryption Credentials:** The authentication token sent to the server is now a secondary SHA-256 hash of the AES key, eliminating the possibility of the server reverse-engineering the encryption key from the auth credentials. ## Network & Connection Logic **Introduced Zero-Trust Host Approval:** Removed automated connection mechanics. All external join requests are halted at the network protocol layer. The host must manually click "Accept" or "Reject" via the in-game chat to establish a physical data channel, fundamentally preventing unauthorized access and offline identity spoofing. **Developed Protocol Sniffer:** Added a protocol sniffer to the client's network layer to accurately distinguish between Minecraft protocol "Status Requests (Ping)" and "Join Game (Login)". Unauthorized players can successfully ping the server list, but actual join attempts are intercepted pending host approval. **Implemented Bilateral Latency Tracking:** Displaying each player's ping to the relay node alongside the calculated peer-to-peer latency between the host and the joining player. ## User Experience & UI (UX & UI) **Fixed Server List Flickering:** Optimized the underlying heartbeat mechanism. Memory states are no longer forcefully cleared upon short TCP closures, resolving the issue where the online player list and latency data would frequently flicker or reset to zero. **Fixed Erroneous Disconnect Prompts:** Optimized the read-blocking logic of the host listening channel, fixing the bug where the chat box would frequently display "Connection to relay node lost" warnings after opening to LAN. ## Relay Server Optimization (Go Backend) **Memory Leak Prevention:** Introduced a background daemon goroutine to periodically clean up zombie sessions left unprocessed by the host for over 60 seconds, preventing Out-Of-Memory (OOM) crashes. **Anti-DoS Protection:** Implemented LimitReader to restrict the maximum byte length of single-line reads. Combined with handshake timeout disconnects and TCP KeepAlive mechanisms, this prevents malicious oversized packets or dead connections from exhausting server resources.