We're running a popular social game and we have a security problem that is growing more and more popular these days.
We have the following product requirements:
- There should be no registration to the game, simply giving Facebook permissions is enough (ie. no password, email validation, etc)
- Players interact with each other using their scoped Facebook IDs
- The servers must be highly scalable and support millions of players and CCUs
Unfortunately since the Facebook ID is our single way of identifying players, this opens up the following exploit:
- My friend did something that annoys me (I can easily access his Facebook ID / scoped ID)
- I create multiple fake Facebook users
- Even though these fake accounts aren't friends with my friend, I can simply send the victim's ID to the server and he will allow it, since we have no way of knowing this at the moment
The "obvious" solution would be to load the player's friends list on the server on login and store it (server to server is a big no-no for us + storing and loading huge amount of duplicated data from the database) - or loading the friends list on every action which interacts with other players and making sure they are friends (which causes for much, much more server to server actions).
We're looking for a workaround to this issue which will at the very least make it very hard to use this exploit, while not hurting our performance and scale.