Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I'm wondering what would be the best way to store password and login in the client. Many people complain that they need to re-enter this every time they log in and they want me to make a way to save it. But how to save it? Saving it as plain text in game folder wouldn't be clever, but neither crypting it would help so much. It would be still easy to decrypt the data.

How would you do that?

Best regards!

share|improve this question

1 Answer 1

up vote 6 down vote accepted

I think there are two issues to keep in mind:

  • unauthorized access to your server
  • learning the password to access other services (because people are lazy and reuse passwords)

How to prevent abuse of the decrypted password elsewhere?

The second attack vector can be prevented by not storing the real password in any decryptable form at all. But a token generated by the server or a password hash that the server will accept instead of the password.

How to prevent unauthorized access to your game?

We are assuming here, that the attacker has access to the users computer in order to retrieve the password file. Based on this assumption it is likely that the attacker has write access, too. But if he has write access, he can modify program files and do all sorts of nasty things. So we have lost.

That being said, there is a number of things you can do to make it more difficult for the attacker. Based on my experience with Stendhal most attacks are done by family members, who don't have a deep knowledge. So easy tricks make a difference:

  • hiding the password file somewhere outside the game folder
  • "bind" it to a specific computer by using the MAC address of the first network card or the serial number of the hard disk to encrypt the authentication information with.
  • "bind" it to the username by using it to encrypt the authentication information with.

Note: None of this things give you real security. But they do reduce the number of incidents and thus reduce support costs.

By the way: WoW, which is quite famous, does not allow to save the password.

share|improve this answer
    
EVE-Online used to allow you to, but required a manual INI tweak to even display the option. The option has since been removed altogether as far as I'm aware. –  Matthew Scharley Oct 25 '10 at 5:39
    
Nice answer. I would combine some of the strategies you listed. Do not store the password locally; instead, store a token returned by the server on successful authentication. A good token should have a built-in expiration and should be bound to both the user name and the machine (using either method you mentioned). You could tighten security even further by binding the token to the local Windows account. Doing so could help guard against attackers with access to the machine but not the player's Windows account. However, a knowledgeable attacker could still get around this. –  Mike Strobel Oct 26 '10 at 18:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.