Re:Ask HN: Can we design secure games using HTML5?
by ricardobeat on Sunday November 13, 2011 @01:20AM
(#3230156)
I've been through this questioning a few years ago. The conclusions:
1. generate a one-off .js file with a salted hashing function. keep the salt variable in a "private" scope, remove the script from the DOM as soon as it loads or use XHR
2. keep track of game progress and player history, validate scores
3. obfuscate scoring beyond the hashing (false messages, symbols, etc)
4. don't calculate scores on the client, send player positions or something else instead (not possible for most games)
You can go around all of this though. It seems impossible to prevent manipulation completely, you can only raise the effort necessary to accomplish it. In consoles this is solved by closed platforms - PC games are still victim to cheating.
For that project, we ended up doing nothing and manually deleting suspicious scores from the database. Worked fine :)
1. generate a one-off .js file with a salted hashing function. keep the salt variable in a "private" scope, remove the script from the DOM as soon as it loads or use XHR
2. keep track of game progress and player history, validate scores
3. obfuscate scoring beyond the hashing (false messages, symbols, etc)
4. don't calculate scores on the client, send player positions or something else instead (not possible for most games)
You can go around all of this though. It seems impossible to prevent manipulation completely, you can only raise the effort necessary to accomplish it. In consoles this is solved by closed platforms - PC games are still victim to cheating.
For that project, we ended up doing nothing and manually deleting suspicious scores from the database. Worked fine :)