2
\$\begingroup\$

We're trying to implement AssetBundles in our current Unity project for Android and iOS.

My question is about security. To download AssetBundles, our application need to connect to our server. On our server, we got a web service that returns the download link for the bundle needed by the application.

However, the ID and password to connect to our web service are written in plain text in our application. This may sounds as extremely naive, but is this an issue? Could someone find the ID and password from say, the .apk file?

I don't have a lot of knowledge in the field of servers and network security, so I'm trying to keep up with what our team is doing.

\$\endgroup\$
  • \$\begingroup\$ Question is, is it harmful if some 3rd party connects to your web service and download some defacto public file? It may and may not be depending on circumstances. \$\endgroup\$ – wondra Mar 21 '17 at 11:03
3
\$\begingroup\$

but is this an issue? Could someone find the ID and password from say, the .apk file?

Could be an issue if you don't want people to download those files or you use that ID and password for more important stuff. And yes, people can easily decompile your .apk and find the ID and password.

Anyway, I don't see the need in having to use an ID and password just to download some Asset Bundles, as when it's downloaded onto the user's device they can do whatever they want with it.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ One reason I could see for authentication is that lack of authentication allows anyone to download the asset bundle even when they haven't bought the game. Now the question is what value the asset bundle has for anyone without the core game. But that's a question we can't answer. \$\endgroup\$ – Philipp Mar 21 '17 at 14:28
  • \$\begingroup\$ Exactly. That depends for each game. But the user is going to have those files on his/her device even if you manage to securely lock them behind authentication anyway, so in most cases it's a wasted effort. \$\endgroup\$ – César Augusto Mar 21 '17 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy