Anthony Pace wrote:
I also want to add that when I say "encrypted request", I mean to say that you would have the swf encrypt the data before sending it as a request; thus, even if the packet is intercepted, a modification would break it and make it unusable. (generated swfs and keys generated/embedded on the fly would be ideal, so looking into mtasc might be a good idea)Even with the above, if the user can step into your code at runtime or monitor changes in memory, you are screwed.Am I missing something, other than the fact that his application probably doesn't need this level of security?Anthony Pace wrote:Hello Paul, IMHOIf you were programming a real time internet chess application, you would need to send moves (hopefully through an encrypted request) and track/validate/authenticate origin, for everything at the server, or cheating would be very easy; however, if you have a game that relies on the client to monitor progress and report it, encrypted intermittent requests, even though they still leave wide open wholes on the client layer, will have to be enough.Good luck, Anthony Pace Ron Wheeler wrote:Paul Steven wrote:Thanks Ron - that is another great idea. So I guess I could send a message after each level with the time elapsed and score at this point - then checkat the end if all level messages have been received.And that sufficient time has elapsed.I think my clients main concern with regards hacking was related to hackers being able to inject malicious code via my PHP/MYSQL code which could affectA good audit by a security consultant or independent PHP expert might help. They could also use and http proxy (Apache mod_proxy) and put your application on its own server or virtual server with its own MySQL for added security.other elements on their server apart from the game.RonCheers Paul -----Original Message----- From: [email protected][mailto:[email protected]] On Behalf Of Ron WheelerSent: 23 April 2009 21:02 To: Flash Coders List Subject: Re: [Flashcoders] Feasibility of xml file for high score data storageOne of the possible tricks that you can use, is to send messages to your "high-score" server during the game so that you can verify that the person passed certain checkpoints. You can throw these away after the final score is recorded and validated. At the checkpoints, you can record current score, a game state(if that is relevant) and a timestamp and then do a quick reasonableness check when the final score is recorded.You need to assume that the cheater has read your client-side code.A determined cheater can always build a simulator for your game and replace your game with their simulator.The crossdomain file gives you some protection. Ron Paul Steven wrote:Thanks jonathan - that is very useful to know. I am now going toincorporatesome security anyway as the client wants it to be "hacker-proof" :) -----Original Message----- From: [email protected][mailto:[email protected]] On Behalf Of jonathanhowe Sent: 23 April 2009 15:10 To: Flash Coders ListSubject: Re: [Flashcoders] Feasibility of xml file for high score datastorageI've done several games with relatively open high score systems. There wasno prize for winning, and people cheated within the first 2 hours oflaunch.Don't assume they wont! Especially if the score chart posts usernames.On Thu, Apr 23, 2009 at 4:38 AM, Paul Steven <[email protected]>wrote:Ah I see - thanks Glen. For this particular project, there would be very little benefit incheatingas there is no prize. However it certainly sounds like something I willuseon my other game projects. Thanks for your time writing out the explanation. Cheers Paul -----Original Message----- From: [email protected][mailto:[email protected]] On Behalf Of Glen PikeSent: 22 April 2009 15:27 To: Flash Coders ListSubject: Re: [Flashcoders] Feasibility of xml file for high score datastorage Hi, The public / private key thing is just about "encrypting" some ofthe score data that you pass to the server to stop people cheating yourhigh score tables. for example, if your high score system in PHP uses a GET / POST something like this: scores.php?name=Glen&score=500 It's easy for me to cheat... But if you do (pseudo code): var key:String = "mysecretkey";var encrypted:String = MyEncryptClass.encrypt("name=Glen&score=500",key); var result:Boolean = MyServer.sendScore(encrypted); And it does something like this: scores.php?command=submit&encrypted=asdiou23q890czoued9auc0 You can then use the server key to decrypt your message. (Public & Private keys are about "asymmetrical" encryption)Anyway, the idea is to make it harder for people to cheat - as the "data" is not very sensitive, you can go for a simple encryption option where you store the key in the SWF, which means that people can stilldecompile your Flash file and find out the key, but only the most dedicated of cheaters would do that...If you really want to go to town, you are probably going to have to create some kind of "login" for people to play the game / submit high scores, but to be honest, you can just go for simple score encryption -look at Jobe's stuff again - if your game does not have any kind of prize...You can get some AS3 / AS2 code that handles encryption which can be decrypted with functions in PHP. I have some links at home I can postlater if you like.. Glen Paul Steven wrote:Thanks for the reply Anthony. Can you elaborate on the public private key system and what thisentails?Ihave not heard that term before. Thanks Paul -----Original Message----- From: [email protected][mailto:[email protected]] On Behalf Of AnthonyPaceSent: 22 April 2009 14:25 To: Flash Coders ListSubject: Re: [Flashcoders] Feasibility of xml file for high score datastorage Hello Paul, Making good use of a que would be required for writing to the filewithout errors, so a database is the best and easiest way; as well, forhigh scores, you might want to use a public private key system forpreventing xss exploits, as anyone that knows how to intercept and editthe get or post data will be able to screw with the request to theserver, and you could end up with a hundred people having the best scorethat the column in the DB will allow. Take care, Anthony Glen Pike wrote:Not working for Cornwall County Council by any chance??? :) Paul Steven wrote:Thanks Glen and IanYes I am currently using a mysql database while the high scores arehostedon my site. The game is for a rather large organisation so it is nottheeasiest task in the world getting a database set up at their end. Themention of flash alone was enough to cause major panic so you can imagine the fear when I mentioned the need to upload php files to theirserver:)Cheers Paul -----Original Message----- From: [email protected][mailto:[email protected]] On Behalf Of GlenPike Sent: 22 April 2009 12:15 To: Flash Coders ListSubject: Re: [Flashcoders] Feasibility of xml file for high score datastorageI am guessing that any server side code to update the XML file willrely on the server to "lock" files, etc. Databases are often optimised to allow for multiple "clients" toupdate, but most file based commands will lock the file preventing access by other "clients" so if your code throws a wobbly rather thanwaiting, that could be a problem...Saying that, you could look at using SQLLite for example - this uses a file based database, but your SQLLite "engine" will handle all of the access - a lot of PHP installations come with this nowadays and ASP code also uses ADOBC to connect to Access database files so youwill have a similar system.The upshot is that using a server side database engine will make lifeeasier because they will deal with problems like concurrent connections for you :) Glen Paul Steven wrote:I was considering using an xml file to store high score data for agame.Itis quite possible that this game will have a significant amount oftraffic (certainly in the first few days after launch) and I am now wondering ifanxml file would be suitable. I am not sure what happens in thescenariowheremultiple players want to update the highscore at the same time - they willall need to write to the file. I assume this is the same scenariowith adatabase but think perhaps updating a database is more efficient.Anyone care to offer any insight into whether an xml file would besuitableor not? Thanks Paul _______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders _______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders _______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders _______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders _______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders
_______________________________________________ Flashcoders mailing list [email protected] http://chattyfig.figleaf.com/mailman/listinfo/flashcoders
