I'm developing a game which has an accounting system very similar to the one used in Geometry Dash, where the user can also upload levels or vote on them, without the need to be registered with an username.

I was thinking: in theory, someone could easily create a fake program which emulates my game's mechanism to send data to my own server to create tons of fake users to self-like their own levels.

Even worse, he could send gigantic data masked as level files to cause newtork congestion.

Since, according to what I found, there is no safe way to identify the POST source, the solution could be, in theory, have some sort of password stored in the game data which of course only the real game would have and send it with all the POST data (with asymmetric encryption of course) as an authentication key. But of course any skilled hacker could find it by disassembling the game if it's hard-coded or stored somewhere as XML or similar.

So the question is: in iOS and Android at least, is there any kind of super-safe place to store a password from the very begin inside the game data? I was looking at keychains but it seems like they are made to store passwords and stuff after you install the game and I readed there are some exploits if the phone is rooted/jailbreaked, so it doesn't seem what I'm looking for.

  • No. There's no such magic place. You cannot implement security in the client – Neil Smithline Jun 12 '16 at 1:17
  • "I readed there are some exploits if the phone is rooted/jailbreaked" .... if a phone is rooted/jailbroken then the user is an idiot and all bets are off, a phone is vulnerable to all sorts of exploits when jailbroken and that really SHOULD NOT be a factor in anything you consider. When jailbroken, a phone is in an unknown state and therefore there is by definition nothing you can do to protect your program against possible exploits. – Little Code Jun 12 '16 at 6:49

If your application is able to request the key, an malicous application is able too. The only way i know to prevent this is blocking malicous users based on their ip.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.