7

This is for an Android (via Cordova/Phonegap) game project. My goal is to be able to provide a "promo code" that will allow anyone to unlock the game for free, but I want to limit each code to only work for a day and I don't want to rely on a server side component to validate the codes. The solution I came up with was for each day's code to be the first few letters of the md5 hash of (previous day's code + a secret value). Here it is in js:

function checkPromoCode(codeToCheck) {
    var secretString = "ABCDEFGH"; 
    var startDate = new Date(1388534400000);    // Jan 1 2014
    var currentDate = new Date();
    var todaysCode = "";
    while (startDate < currentDate) {
        todaysCode = md5(todaysCode + secretString).substring(0,6);
        startDate.setDate(startDate.getDate() + 1);
    }
    if (codeToCheck == todaysCode) return true;
    return false;
}

Am I correct in thinking that the only reasonable way for an attacker (who knows the algorithm I'm using and knows some previous days' codes) to determine today's code is by figuring out the value of secretString? I understand that a determined attacker could figure out the value of secretString by brute force or by analysis of the apk. Nothing is uncrackable; the goal here is just to make it reasonably difficult. Am I missing anything obvious? And is MD5 an appropriate hash to use?

0

1 Answer 1

1

Not commenting on the security, this is what I got from a once over:

  • It is considered better form to have a single comma-separated var statement
  • You could do var startDate = new Date('2014/1/1'); and then you dont need your comment
  • You can write

    if (codeToCheck == todaysCode) return true;
    return false;
    

    as

    return codeToCheck == todaysCode;
    
  • Other than that I like the naming of variables, the flow of the code and general readability
2
  • Thanks, these are helpful reminders, but I'm going to leave this open in hopes of getting a response about the security aspect.
    – DevOfZot
    Oct 17, 2014 at 17:42
  • 1
    Sure, no worries. This is probably the first CR review on security :P
    – tomdemuyt
    Oct 17, 2014 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .