Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these resources, developers use various protection methods such as passwords, encryption, compression, file archives, anti-debuggers, and so on. Of course, most (if not all) of these can be reverse engineered if someone was to spend enough time and effort on it.
I've been looking at different online games and have found that browser-based games tend to be much more secure when it comes to unauthorized data access. This is because (when feasible) a resource is only sent to the client when it is requested, and an ideal URI typically uses a random string that is both unfeasible to guess and impossible to reverse engineer.
For example, suppose I have an image called "duck.png". I then rename it to a random 64-character string, perhaps randomly pounding away at the keyboard. Unless you are incredibly lucky, you won't be able to guess that. You could add additional security measures, such as making it so that if an IP attempts to request an invalid resource more than, say, 100 times, the server automatically suspends them for some period of time.
Assuming security is properly set up on a server (proper access control, secured API's that properly checks requests before processing them, consistent use of the random strings), can I be confident that the only way an outsider would be able to access this resource is through legitimate means, such as playing the game?
Or are there techniques that adversaries can use to gain access (easily) to the resources that I'm trying to protect? I'm assuming that gaining unauthorized access to a server is not an easy task because the server is secured.
duck.png- I grab it from a site which logs all resources encountered (Essentially, just a regular pirate site). Ubisoft tried something similar to "only send when needed" with some of it's games - it just delayed things a little until hackers figured out how to create a dummy server. If you distribute a resource, it will be passed on to unanticipated 3rd parties. Therefore, the only ~permanent way to avoid this is to not distribute it... hence server-based games (MMOs, social gaming, cloud game servers...)