Before I start, I'd like to point out that this is a bug with the current Launcher and not any particular version of Minecraft. This issue has been raised before but got dismissed on 'unsupported version' grounds.
The workaround for it dissuades players from using the official launcher.
The Issue
When using the Minecraft Launcher to start a Minecraft client of version 1.6.4 or earlier the user's Session ID is not passed to the client.
If the client then attempts to connect to a server it will be rejected with the on-screen error:
Failed to Login: bad Login
Attached is an image of the startup log when launching Minecraft 1.6.4. You can see where the client (game) is reporting a Session ID of '-'. Starting Minecraft 1.7.2 from the same Launcher session will pass the Session ID to the client.
The issue affects versions of Minecraft 1.6.4 and earlier. I can only assume that from version 1.7.x onward a different argument name is being used for the Session ID.
Workaround
The current workaround is to use a 3rd party launcher that you can run Minecraft from. The following launchers can all be used:
Legacy Launcher
ATLauncher
Technic Launcher
MultiMC 5
Linked issues
Attachments
Comments 3
The cause has been discovered and a workaround is detailed in issue MCL-7178
Marking it as related to MCL-7178, even though it looks like they both describe the same bug, since both were resolved as fixed.
For each version of Minecraft there's a version json file. Inside there's a minecraftArguments key that tells the launcher what arguments to pass to the client jar:
Here's the one from 1.8.json, a version that works:
Here's the one from 1.6.4.json:
1.6.4 uses the argument session and is passed the variable auth_session.
1.8 uses arguments uuid and accessToken and is passed the variables auth_uuid and auth_access_token respectively.
I suspect that the auth_session variable is not available in the new launcher. I tried editing the 1.6.4.json so that it passes the argument:
but the launcher is pretty strict about the files not being messed with (for good reason) and re-downloads it if its hash is wrong.
The fix for this issue may be as simple as making sure that the auth_session variable is available for building the java arguments string.