I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those who know, i try to achieve a similar authentication scheme as famous Supercell games (Clash of Clans, Boom Beach, etc..) What i have in mind:
The very first time the user launch the game, a request to the server for a new account is done, the server send back a UUID.
This UUID is stored in the device (should i crypt or hash it ?).
When the user start the game i authenticate him with a token (
UUID+timestamp+hmac(sha256, username+timestamp, K)). Is it better to generate a temporary session token (stored in the database) or could i use the previous token for all the requests after authentication?
- For each request i send
token+params+timestamp+hmac(sha256, token+params+timestamp, K)
And every communication will be over SSL.
is it totally insecure ?
NB: In the game you will be able to do in-app purchases and in this case the first time you try to buy something you will have to bind your game with your GameCenter or Google Play or Facebook accounts. This information will be store in the database. Should i use these accounts to authenticate if it's possible?
As you can see, nothing is clear in my head and i'm definitely not a expert in security. So every little advices will be appreciated.