I have recently started creating an online Tetris type of game, and I was wondering what amount of security I should implement for an online match. I am in a conflict where I want to make my game as secure as possible, but if someone were to try very hard, they could probably cheat in the game. For example when someone clears a line with a T-Spin (a move that scores bonus points). The client will send the lines cleared to the server and if it is or is not a T-Spin. The server will verify the lines cleared to make sure it is a valid number, but in order to verify if a T-Spin is actually a T-Spin it would require the client to send a lot of data and then the server would need to run a lot of calculations to make sure it is a proper move. Due to the fact that these calculations would be run every time any player places a piece during the game, it could cause a lot of lag and leads me to believe it would be better to accept someone very determined may be able to cheat at the game, and get an unfair advantage over other players (for example editing the client-side JavaScript and forcing it to say every line cleared is a T-Spin).

Although a cheater could win the game over other players, no important data would be at risk, like the database containing user ids, emails, or password hashes. This makes me want to cut corners for the sake of efficiency so that the servers can run faster.

Is there some computer science unwritten rule or pseudo-equation people follow when determining how much security to put in their projects?

  • 4
    Yes, it is called a "risk assessment". You determine what bad thing can happen, the impact of that bad thing, what controls would mitigate that bad thing, and the impact of the mitigation. You compare the impact of the threat to the impact of the mitigation. But that's not what you need to address here. You just have bad design. You should design it so this bad thing isn't an issue to begin with.
    – schroeder
    Mar 29, 2022 at 18:04
  • 2
    Simulating Tetris really shouldn't be that hard. I bet your server can run ten thousand Tetris games at the same time. Maybe more. Maybe a hundred thousand. Maybe even a million if it's pretty beefy. Your client could send every input to the server and the server could simulate them and make sure it gets the same answer.
    – user253751
    Mar 29, 2022 at 18:54
  • 1
    What I seem to not get is why you're trying to put all this logic in the frontend and not the backend? You can encrypt the information send it to the backend for verification. Mar 29, 2022 at 20:47


Browse other questions tagged .