Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I am making a game which i will be open sourcing. Its a simple arcade like game but requires a network connection because it is meant to be played with other people.

The thing i am worrying about is how would i be sure that the client is the one that i put out for the end user to play with? Kind of a like of sv_pure for Team Fortress 2.

I was thinking of different ways to combat this such as the server requesting the client's version or even it's md5 hash but people with simple java knowledge could just force a method to always return what the server wants.

share|improve this question
5  
-1. Google "secure login". This question shows no research effort, which is really only in your own interests. gamedev helps those who help themselves. –  Nick Wiggill Nov 13 '11 at 16:12
    
If it's going to be open source, then it's going to be hard to really secure the login. An md5 hash of the version is a nice simple solution, though. –  thedaian Nov 13 '11 at 16:15
3  
An MD5 hash solves nothing - anyone with the code can just edit it to send whatever value they like, removing the hash function entirely. –  Kylotan Nov 13 '11 at 17:13
3  
You could sign all your 'official' JAR files - at runtime merely check that your signature matches (as the JRE will do the actual signature verification for you) - you control the private key for the signing, so you can decide what is official. You could also look into draconian DRM for inspiration (where your 'permanent connection' is with your peer). –  Jonathan Dickinson Nov 14 '11 at 12:10
6  
@thedaian you could not be more wrong. Being open source is completely irrelevant to the login system you use, since security by obscurity is wrong anyway. –  Lohoris Nov 14 '11 at 13:43
show 5 more comments

2 Answers 2

up vote 20 down vote accepted

There is no way to guarantee that the client in use is the client you want them to be using, there are always ways around every technique, even with a closed source application. When it comes down to it, with a closed-source application, any good reverse engineer with some free time can spoof packets to/from your server. In an open-source application, it would be even easier to have some fun. All you can do is make sure to give the client limited control over the game. The less control you give the client, the less you have to worry about what is sending your server packets.

share|improve this answer
2  
+ and the less the client control over the game, the more client side work in needed. –  iamcreasy Nov 13 '11 at 19:21
1  
Just to expand, be sure that the game server and match making makes it easy for players to avoid cheaters. Cheating is unavoidable, and the best you can do give players the tools to make their play experience better. Reputation systems, preferred/avoided player settings, friend lists, and skill-based match making all helps tremendously with this (if implemented well, at least). It's all about helping players find the kind of people they want to play with. –  Sean Middleditch Nov 15 '11 at 0:20
    
@iamcreasy, did you mean, "the more server-side work is needed"? –  Cyclops Nov 19 '11 at 13:13
    
@cyclops No. Its like predicting / transitioning between 2 states/positions. –  iamcreasy Nov 19 '11 at 13:45
add comment

I have 2 rules of networking that I keep in the back of my mind when programming.

  1. Give the client, only what information it needs. This isn't completely relevant to the question, but still on the same topic. The client doesn't need the position of all the gold in the map, if they are no-where near it

  2. Keep it server side.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.