I'm working on the server side part of my game (develop your village/farm) and trying to build user identification system. I'd like to have a password-less mechanism: user downloads my app from the store, run it and that's all. He doesn't have to type any login or password. The game connects with the server requesting new player creation so he can start playing as soon as he opens the app.

I assume that this process is connected with GameCenter/GooglePlayGames. A game retrieves player ID from those services and then use it for future requests (saving user progress, game specific data - like village/farm facilities' positions, other information on my server). Is it a valid and safe assumption? If not can ask you to describe how it works/should be done?

I have some doubts regarding security? Single PlayerID seems to be quite weak solution, isn't it?


I didn't mention it but I would like to move my progress from one device to another also without creation of any account with login and password.

  • \$\begingroup\$ I'm not sure this stack is the best suited to ask about security related questions, even if it's for a game... perhaps Information Security or Stack Overflow? \$\endgroup\$
    – Vaillancourt
    Mar 22, 2016 at 14:15
  • \$\begingroup\$ Security is only additional part of this question. The main problem is how it should be implemented - I mean password-less authentication. Is usage of Google/Apple services a good idea? If not how it is (and should be) done in real games. \$\endgroup\$
    – ppablo28
    Mar 22, 2016 at 14:22
  • \$\begingroup\$ How would you know which devices should be paired if there was never any form of authentication connecting them? \$\endgroup\$
    – wondra
    Mar 22, 2016 at 17:32
  • \$\begingroup\$ I'm not sure what do you mean by "paired". But I you think about my Edit note then I assume that if I'm using PlayerID form GC/GPG then on both devices (of course on both the same ID is used) I'll be able to recreate my progress - from data saved on my server. \$\endgroup\$
    – ppablo28
    Mar 22, 2016 at 17:37

2 Answers 2


For my game LowDown: A Social Experiment, I did this:

The first time a user submits a number to a contest, there's a CAPTCHA to filter out bots. The server assigns the user a UserID, which is just the next index in the database table. It also assigns an invisible password (I call this a key; it's a randomly generated string). The client saves both the ID and the key.

Future logins are sent using the ID and the key, and is sent encrypted via string concatenation and hash. It concats the userID, the key, the contest id, and the user's entries into a string and hashes it. The hash of the string plus the submission are sent, and the server verifies that the submitted data results in the sent hash. This is to (hopefully) verify that the submission is coming from an actual client, not a bot.

This means the user can only log in from that device, since the keys are hidden from her. If she wants to log in from another device, she can register the account. This involves giving the server an email address and desired password. From then on, the user can log in from any device provided they log in with the email address and password.

This system reduces new-user friction to a minimum, yet allows them to log on through other devices if they really want to.

  • \$\begingroup\$ Thanks for your answer. That's an interesting concept. But still involves usage of login and password if you want to move your progress between devices. I'm looking for the solution where it's not required (I didn't mention it in my question - I'll edit it). Btw if user removes your game or even remove game data then the only way to save his progress on the device is still to create account, right? Otherwise everything will be lost as far as I understand the flow of your authentication. \$\endgroup\$
    – ppablo28
    Mar 22, 2016 at 16:49

There is a concept in security called two-factor authentication - where you authenticate two aspects of the user. Often this comes in the form of a password and device code.

I bring this up because if you don't want a password you can just use the device code portion of these techniques and if you properly implement it you have the same level of security that a password offers if you allow your users to stay logged in with a cookie. You need to be aware of and accept that level of risk. (All login systems have some amount of risk of being defeated.)

Specifically that could mean using gamecenter/googleplaygames as a means to verify the device account - however this carries with it the risk that a player will lose their game if they lose their gamecenter account.

Alternately you can send them an email with a code and link and if they click that link you give them a cookie and use that cookie to keep them logged in. If performed correctly, this is fine. Please do research into how to do this properly.

You can simply start a new game by giving them a cookie with a random code, if you want. Their game will be lost if the clear their cookies or if they move to a new device - but games like Cookie Clicker and other browser games have successfully used just that.

You need to match your techniques to the security of the game. If the game is light and free - having no security scheme could be acceptable. If the game has a monthly fee, micro-transactions with a wallet of currency, transferable items that could be stolen off the account and/or a high level of competitive play with tracked scores that might make an account desirable to own - you'll probably want device codes, passwords with enforced lengths and complexity and optional or even required cryto-keys like RSA or DUO; with account recovery tools like second email addresses, text message recovery or a staff of people verifying scans of photo ids such as Blizzard has.

Match the security of your game to the features of the game.

  • \$\begingroup\$ Thanks for your response. Yes, I know the concept of two-factor authentication. Sending an email is not acceptable for me. It still requires an action from the user. I'm trying to do something with PlayerID from GameCenter but I'm not sure I can even do that (according to Apple policy). I think about sth like that: send PlayerID to my server and based on that create some token which will be used for future requests. There is only one GameCenter Player ID so the game state can be shared between devices. \$\endgroup\$
    – ppablo28
    Mar 22, 2016 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .