8
\$\begingroup\$

Is SSL necessary for a web game? I'm using Node.js with socket.io.

Without it, when using unsecured networks someone on the LAN could change commands being sent to the server and "take over" a player. But this could only happen on unsecured shared networks, so it doesn't sound too bad. Or is it?

And lets ignore the authentication phase for a moment and assume this part is secured, are there any other reasons why I should use SSL on the sockets?

\$\endgroup\$
1
  • \$\begingroup\$ This might get better answers on the security SE \$\endgroup\$
    – Lucien
    Commented Feb 5, 2016 at 21:46

2 Answers 2

Reset to default
7
\$\begingroup\$

Yes. You definitely should.

Use Let's Encrypt to get a free SSL certificate (or as many as you want or need). SSL is always good to have: without it, man-in-the-middle attacks will be launched, by the NSA if no-one else.

Most multiplayer games (e.g. Minecraft) just use raw packets. There's little reason to encrypt packets after one is authenticated as only the network service provider (e.g. Verizon/Virgin/TalkTalk) can fake TCP packets.

However, if you're hosting your game on your website then the whole thing has to be in SSL (unless you want to have a sign in page over SSL and another page with no SSL, cringe).

Advantages of SSL:

  • With Let's Encrypt, the certificates are automatic and free
  • Actual security
  • A sense of security for users (browser status bar shows lock icon)
  • Privacy, no NSA spying
  • +1 PageRank in search engines for using SSL
  • Negligible performance cost

Disadvantages:

  • If your game has such high performance requirements that WebSocket SSL is a deal-breaker, then your game is probably too intensive for browsers to begin with, SSL or not.
  • I can't think of any others.
\$\endgroup\$
3
  • \$\begingroup\$ managing certificate a little headache (even with awesome free services) and yet another thing to worry about. however, the +1 on page rank for ssl convinced me (it was new to me, thanks!) as well as that little green lock which is important to some. I still don't think its mandatory but you convinced me it worth the time. Thanks! \$\endgroup\$
    – Ronen Ness
    Commented Feb 5, 2016 at 22:59
  • \$\begingroup\$ @Ness np, FYI, LetsEncrypt will have automatic renewals when they're out of beta so that's a nice thing too \$\endgroup\$
    – Lucien
    Commented Feb 6, 2016 at 7:15
  • 3
    \$\begingroup\$ Also, encrypting even trivial stuff makes everything more secure—an attacker can't distinguish between what data is important and what isn't, so even if they're able to throw some datacenters at some random SSL packets and crack some of it eventually, the more those packets just contain unimportant web game update packets, the less they'll feel like continuing doing that. \$\endgroup\$
    – Anko
    Commented Feb 6, 2016 at 22:40
1
\$\begingroup\$

Just in addition to @Loblums answer:

AFAIK socket.io uses WebSocket as its default transport. With WebSocket being relatively new, not all intermediaries on the internet may be aware of it and handle it correctly. With an encrypted connection, chances of a WebSocket connection succeeding increase a lot, since then from the outside it's indistinguishable from an encrypted HTTP connection.

\$\endgroup\$
1
  • \$\begingroup\$ Interesting point. Personally I've never seen any service / network device that can't handle WebSockets, but I can imagine it might happen. thanks for the input! \$\endgroup\$
    – Ronen Ness
    Commented Feb 6, 2016 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .