Hey guys, sorry to post what's really an off-topic on the main forum, but this is actually potentially kind of serious.
Bottom line up front: if you have ever used a "real" password in VASSAL (i.e., one that you use for anything else), that password has been exposed publicly and you need to go change the credentials on any other account that uses that password. Do not ever use a real password on VASSAL.
If you're interested in the details:
I'm a security analyst IRL, and like to dabble in coding for funsies. I'm working on a project that involves interacting directly with .vlogs, so I dug into the structure of those files. After reading the code that obfuscates those files, it was extremely trivial to deobfuscate them. I probably could have guessed it faster than it took me to read the code to figure it out.
When I started poking around to figure out the structure of the log file, I found that the VASSAL log file saves the username and password of every player who was in the room at any time while that log was running, in (trivially obfuscated) plain text . This means that any opponent you've had that ran a log of your game has your password; anywhere you've posted a logfile for tournament results, they were exposed there; anyone who dropped in to watch your game could have run a .vlog to get your credentials--and not only that, but they were almost definitely passed in cleartext over the open internet in the creation of the game room (I haven't bothered to run an actual packet capture to verify this, as it's not very important).
Free advice: if you're putting a password into an application that feels a little bit hinky, use a throwaway. In fact, since I'm on my soap box anyway, you should use a password manager so this isn't an issue for you anymore.
And just to be clear, this does not mean that it is dangerous to use VASSAL and you need to stop using it. I have no reason to think, nor am I particularly qualified to identify, that VASSAL has any kind of other vulnerabilities. So, keep playing... just know the risks so that you can protect yourself.
For anyone concerned about ethical disclosure:
I've been in touch with the lead dev on VASSAL, who assured me that remediating this is on their roadmap for a future release. "Don't use a real password" is their workaround in the mean time.
