1
\$\begingroup\$

I would like to create a mobile game which communicates with my own backend server.

For authentication I want to use google Sign-in(https://developers.google.com/identity/sign-in/android/backend-auth), so users don't need to create an account.

My backendserver uses a TCP connection to communicate with the client and I don't want to send the google login auth code unencrypted over the network. I read alot about SSL encryption, but I'm not sure if it is the thing I need and if this is sufficient.

Another question I would like to ask is do I need to encrypt all packets my client is sending to the server. Because when I just do authentication over an encrypted connection, potential hackers could simply perform a man-in-the-middle attack to access the account of a player after they logged in.

So what would be the best way to send this token to the server, is SSL sufficient for this and do I need to encrypt the whole traffic my game creates?

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.