1

I'm developing a quiz with which you can win a few cool prizes. Therefore I'm afraid, that someone might try to hack/manipulate it.

All participants have to be logged in and the website takes 15 questions from the db, gives them to Javascript, which paint's the quiz then. When a user finishes all questions or answer one false, the quiz makes an Ajax call to the backend and insert the points in the db.

To decide what answer (there are always 4) is correct, the quiz must know which one is correct. This data is provided as Base64 encoded string and then decoded in Javascript.
Question 1: Is this secure? Are there better ways?

Always when the quiz is started, I save the quiz id in the database. When the final Ajax call is made, I check for that id, I check if the given answers are the one associated with the quiz (and the order of them), I check a token (there is one in the session and one in Javascript, both generated based on the quiz and some salt values, they are generated using md5, sha1 and substr in PHP)
Question 2: Is this secure? Are there better ways? Did I miss something?

  • Trh using ajax for printing (writing ) and php for validing . Using only js for validing is very unsecure. – magic-sudo Jan 23 '15 at 11:10
  • @gmk I know that JS is unsecure for validation, therefore I validate every thing before I write it to the db. Do you suggest, instead of giving the date to the JS script, to make for each step an Ajax request that delivers the HTML structure and validates the user input? – wawa Jan 23 '15 at 11:17
  • prices -> prizes ? – user49075 Jan 23 '15 at 11:25
  • @RickyDemer exactly – wawa Jan 23 '15 at 11:38
9

Your proposed mechanism is not secure.

Anything available to JavaScript is available to the person running the client browser. Base64 encoding only mildly obscures the answers. Even encrypting them using strong crypto like AES will not work because the JavaScript must have the key.

Would someone go the trouble of figuring out the Base64, or encryption? It depends on how cool those prizes are and is anyway security by obscurity.

You can deal with this in one of two ways. The simplest way is to send all the answers to the server at the end of the quiz and check them on the server with PHP. If you want to provide feedback for each question, you should make an Ajax call after each question is answered.

I can't really tell about your second question because there isn't enough detail. However, everything related to security must be done on the server. You can pass an opaque session ID back and forth between server and client, but you can't do anything on the client that forms a basis for the security of the system.

Finally, I worry about "some salt values." Rolling your own crypto is not safe unless you have a Ph.D. in mathematics and ten or more years' experience with cryptography.

  • 2
    I see your "Rolling your own crypto is not safe unless you have..." and raise you a "Rolling your own crypti is not safe even if you have..." based on, for example, the results of Round One of the AES competition - in particular, the sections on major and lesser attacks stand out. – Anti-weakpasswords Jan 23 '15 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.