0
\$\begingroup\$

Dumb question but I want my game to be secure as possible. Right now I have classes interfacing with each other in order to save/load player information. Right now I have all the variables in my classes as public, and saving / loading the saved variables into them. But I don't think that's as secure.

Code:

public class PlayerRP : MonoBehaviour {

public string charName;
public string charRace;
public string charClass;
public string charClassSpec;
public string charBackground;
public string charGender;

}


public class CharacterManager : MonoBehaviour {
public void SaveCharacter() {
    BinaryFormatter bf = new BinaryFormatter();
    FileStream file = File.Create(Application.persistentDataPath + slotFile);

    CharacterSaveFile data = new CharacterSaveFile();

    // Character RP
    data.charName = playerRP.charName;
    data.charRace = playerRP.charRace;
    data.charClass = playerRP.charClass;
    data.charGender = playerRP.charGender;

    bf.Serialize(file, data);
    file.Close();

    LoadCharacter();
}
}

Would it be safer (or more efficient) to instead make methods in the playerRP class to get/set the variables separately, rather than have them as public?

\$\endgroup\$
3
\$\begingroup\$

From a security standpoint, where security means "protecting the data against access or modification," it does not really matter. Access specifiers like public and private are generally relevant only to the compilation process (and for C# and other languages with reflection support, occasionally to the reflection process).

Making data private and exposing it via accessors will not make the source of that data any harder to find and modify in memory at runtime. There may be (and often are) good reasons to do this from a software architecture standpoint, but from a security standpoint the impact is essentially zero.

\$\endgroup\$
  • 2
    \$\begingroup\$ Adding onto this, the one instance where there could be security implications is where you have a "safe/secure" method of doing a thing - which applies the necessary data validation & protocols - and an insecure method that's only used internally on pre-validated inputs. If both are public, then a dev may accidentally use the insecure version, opening a security hole that could have been avoided by using the correct method. Access control won't give any guarantees of security (in particular, code running on clients is never secure in any absolute sense), it just makes some mistakes less common \$\endgroup\$ – DMGregory Feb 6 '17 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.