0
\$\begingroup\$

I have two features in my game that need to a server of some kind that require authentication: a bug reporter and a leaderboard.

The bug reporter will take the users report and add it as a card to my trello board. In my code I have my personal accounts key and token, the board name, and the list name. This is hard coded so if someone ever decompiled my game, they could destroy my trello board. They could spam it, add new lists, delete my existing lists etc.

The leaderboard can't use something like steamworks leaderboards or gamecenter leaderboards as I intend to sell my game on many different stores, some of which don't have leaderboard systems. I also don't want to have to manage different leaderboard systems for every store - that will get messy.

How can I connect to my own server with a database of scores without hard coding the password into my script?

I've seen people say to put it into App.Config, but I believe that is only for winforms/wpf etc. Some say to store it in an encrypted config file, but then I will need to store the key to decrypt it somewhere... Others say it's completely pointless and futile.

Surely there must be a way!

\$\endgroup\$
2
\$\begingroup\$

Don’t. You cannot secure your password indefinitely. What you can do is restrict access remotely. I don’t know anything about trello, but if it allows multiple logins with multiple permissions, you could create a user with more restrictive permissions and include those credentials in the game.

Another alternative, if this is not supported, is to make a second server which the game connects to, and that server turns requests from the game into requests to trello. The server is what holds the trello credentials. Make an entirely separate API on this second server, just for you bug reporter. The server then processes the content, making sure it’s valid before passing it on using trello API calls. You can have another form of credentials to access the bug reporter if you want, although as mentioned earlier, they won’t be secret forever.

Same thing with your leaderboards. You can’t keep it secure forever. You can introduce player logins, cryptographic signing at multiple levels of complexity, and encryption to deter casual hacking, but consider how important it is for your leaderboard remain 100% accurate before heading down that rabbit hole. The only way to be sure is to run the game on a server, instead of on the player’s device. Probably not necessary. Just make sure you have an API on the server for handling the leaderboard, rather than directly exposing the database to the internet.

\$\endgroup\$
  • \$\begingroup\$ This seems like a good solution. I looked into account permissions but trello doesn't offer much. I can make give a user read/write access to a whole board, or make them an admin. What would be nice is to restrict their permission to only writing to a specific list in a specific board. \$\endgroup\$ – mr-matt May 27 '19 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.