Absolutely not happy with the weird login request function

[JRSofty]

So it's been a while since I last used FTB to play a modpack, so I while I was expecting to need to provide a Microsoft login to allow me to access the launcher, I was surprised to see a button that supposedly send me to where I can login to my Microsoft account.

I'm sorry it seems way too fishy and untrustworthy. I guess I'll be using a different mod-pack provider as I'm not comfortable with this sort of interface.

[MichaelHillcox]

This... This is how most / all the launchers work? I'm not quite sure if I follow on which part you do not feel comfortable with? From our app, we redirect you Directly to Microsoft. You log in with Microsoft, and once done, our app will find it (via polling the Microsoft API), then log you into your account and store your credentials on your system. All of this auditable via our source code.

[JRSofty]

Hi, thanks for your reply. So basically I expect an experience like in this attached video where the login request is basically directly from the Microsoft login. Please give the first seconds a pass as I only have one monitor so I have to wait until I've minimized OBS.

Curse-Login-Requirement.mp4

This dialog seems like a fishing expedition and it looks untrustworthy.

Back in the day when it was simply the Mojang login and password the risk would be minimum but when I am required to use my Microsoft user and password, I am going to be more careful. I would really like to see that you either use the Minecraft launcher to launch the mod packs, or at least have the person authenticate against the actual Microsoft login facility. This "click a link" is not responsible security handling. So until such time I will personally stop using FTB to play modded Minecraft.

[Jake-E]

This is Oauth 2.0 Device Authorization Flow. You do authenticate against Microsoft.

[MichaelHillcox]

Going to close and lock this as it is clear that the person in question does not understand OAuth2 Device flow, nor basic security practises that we, ATLauncher, Modrinth, CurseForge themselves (When opted in), PrismLauncher, MultiMC, and likely more, follow.

We will not support the Minecraft Launcher directly as we did this originally and it caused numerous issues, as well as hurting the user experience. We, like all the other launchers noted above, follow Microsofts own guidence on how to implement Microsoft logins within our app, we then mimic the exact same requests as the vanilla launcher would have to complete the login to your Minecraft Account.

If you feel more comfortable using the CurseForge launcher then please feel free to do so. If you have any legitimate security concerns regarding our technical implementation, please contact us privately via our website's contact us page.