Re:Ask HN: Can we design secure games using HTML5?
by ricardobeat on Sunday November 13, 2011 @12:59AM
(#3230120)
There are plenty of tools allowing manipulation of Flash too, pausing execution, changing variable values, intercepting network requests...
Re:Ask HN: Can we design secure games using HTML5?
by chetane07 on Sunday November 13, 2011 @09:18AM
(#3230774)
In my experience Flash is not much more secure. Looking at your app for example, it seems the hash you are using is not a function of raceId or timestamp so there is potential for replay (e.g. reuse precomputed hashes). Also, is it possible that the salt starts with "209adk"? :)
As far as a better solution, maybe using of dynamic script loading, maybe unique salt/session along with strong server side synchronization. Desktop games are faced with similar challenges, even if the path is much harder given the amount of reverse engineering required.
At the moment we do all development in flash, not only because it allows for old IE support, but because I am able to salt+hash the scores sent to the server to verify the data but this is all done in flash.
In JS I'm stymied. Every scheme I can come up with I could easily defeat. No level of obfuscation is really that difficult to reverse. Hopefully somebody else has better input!