Players in MMO games can usually send messages over different channels (private, public, guilds, et cetera).
How would I transmit and store this data so as to prevent outside users from being able to access somebody's private chat messages? Should I store the data in a temporary game log, or a database?
You're never going to really remove the ability for an outside party to intercept chat packets from clients, and you shouldn't worry too much, because when you're building an MMO you're building a game, not a industrial-strength crypographically secure chat platform.
You should implement chat messages as follows:
The most-vulnerable point here is the initial client-to-server transmission. If somebody snooped those packets, they could see messages not technically intended for them. You could encrypt the data, but that's a lot of effort for only minimal gain. The client must be able to decrypt chat packets eventually, and intercepting the packets as they leave the client would be the best place to do the aforementioned snooping, so the key is already available to the snooper, just a little harder to find.
It's very important that you pass your chat through a server that you are in control of, though. It need not be the game server, it can be a dedicated server for funneling chat, but you want to control the routing. It lets you have oversight for GM disputes, it lets you enforce user requests to block or mute other users, it solves the issues you might have with NAT punching or other networking shenanigans you can have trying to do peer-to-peer chat, and it provides enough of a barrier to casual hacking (which peer-to-peer chat is prone to) to solve 90% of the security concerns. Which is about as good as you'll get.
I am honestly not 100% sure what you are asking. But hopefully the following is helpful.
If you look into planeshift, an open-source MMO, you can look at their code and see how they decided to architect their system. This will not give you exact insight into all MMO's but most likely implementations are similar across different games.
Here are some directions for downloading their source. You will need to check it out via SVN
I have taken a look and if you go into src/client/gui/ you will see a ChatWindow class. It takes care of sending messages back and fourth to the server for chatting and it also takes care of input history. It looks like they package up information and send it off to the server for it to deliver. So I imagine this chat information is stored on their server and thus not reachable by just anyone. That is unless you are able to get into the servers database to access chat records. I cant imagine them being able to keep everything either. If they do keep chat logs its probably only for a certain amount of time (A few days perhaps?)
Anyways, a broad answer for a broad question. I cannot really do much better than that without a more focused question. Feel free to comment if you have more narrow questions and I can try answering them.
Edit1: Also note that in the client folder, you can find and authentclient class. This handles client authentication, etc. I imagine it will also handle chat-related security in terms of authenticating itself into a chat server. They may not have dedicated servers for chat. So it could just be the game server that is also running chat services for all its clients. This is something you could figure out by really studying the code.
For bigger MMO's I would put money on them having dedicated chat servers just for taking care of chatting between players. (Just like they do for instances).
Most MMO's I played do not store messages for a longer period of time. Because that would most likely turn them into a GameCompany with a negative badge like the NSA. Unless, the players had direct access to their database.
Runescape has the messages stored in cache, and it only is avaiable for a small ammount of time. I have never heard of anybody getting banned due to the fact that such data has been stored. If one should ever report another play for what he said. He has to be quick, until his 500~ line chat limit gets used up. After that time all his messages will be deleted. In the most crowdy place, where players shout out each other it is up to 10 seconds.
The messages are always sent via server, and storing takes place at server not client. Otherwise, Player A who hacked into the client, would be able to manipulate the array responsible for chat and literally write that PLAYER B wrote something else. After a short while he could report that player for writing something and the other players cache might no longer hold such info.
If you store the messages on the CLIENT, which has done by a chat portal GaduGadu.pl the users will lose the ability to check their chats on different PC's. The data generated by the user would be vulnerable to third persons. Mostly in public internet Cafes. Or at friends house who might seek vengeance on his former friend.
If you store it on your server, it is impossible for Player B to access data of Player A and vice versa. Keep in mind that saying "can player B access that data" is a broad question. You can never tell if the data is safe, unless your server is offline! Here is an example.
Storing messages is only needed for delivery when you want to deliver them at a later time. For example when you want to allow people to send messages to players which are offline which are delivered the next time they log in or when you want to allow an admin to read chat at a later time.
When you don't need this, chat handling can and should be done completely in-memory.
Each chat message a client sends has to include some information about the recipient (public, guild, private message to player X). The server should then determine the characters which are allowed to read the message:
The message should then be sent to the clients which control these characters.
Sending a message to a client which is not supposed to show it to the user is a waste of traffic and a violation of the "never trust the client" principle.
