I'm creating a home made MMO server (as a hobby / way to learn something new). I've decided to use a token based authentication for game traffic.
Many people say that you shouldn't use any kind of packets encryption in case of the authorative-type game servers. Every packet should be validated and we should assume that the clients are transparent. I get it.
But what to do with the possibility of network sniffing and the man-in-the-middle attacks? If you use the token based authentication, you have to send the token together with the data. The token can be eavesdropped and the attacker can impersonate as you. Is there a way to prevent this without using the encryption?