I'm working on the authentication scheme for a multiplayer game using only C++ and SLD2.
It's an RPG with a kind of complicated character-group/permadeath scheme, and world-instances are intended to be hosted by the players. So it matters that players have exclusive access to controlling their characters. I want players to be allowed to save the current state of a multiplayer world instance, close it, and come back to it later, or set up their own dedicated world instance for them and their friends to join/quit/rejoin at will. Absent player characters will simply not be present in the world until their creator returns
Servers will be hosted by player-computers. I'm not planning to set this up with a dedicated hole-punching or identity server, so players will just be playing with people who they intentionally connect to. I don't want to deal with encryption, so I'm not planning to require passwords to log in. I figure since there's no formal identity server and no encryption, passwords might do more harm than good. Player character names will change over the course of the game, and I don't necessarily mind if two players have the same username.
Here's my current authentication strategy:
When a player creates an account on his/her game instance, the account will just consist of a username and an automatically generated (random) UUID. The username and UUID will be stored in a SQLite file that the user can copy onto any computer with this game installed, and access their unique account. The username and a naively hashed UUID will be stored in a connection log on every server that the player connects to (so the server can assign them to the right character when they log back in). I recognize this means that programmers who know what they're doing will be able to hack each other's accounts, but I'm not convinced that I should really be concerned about that in the case of this particular game.
Here are my questions:
- Is copying the file too much to expect from users who want to switch computers?
- Can you guys think of any potential issues with this, other than what I've already pointed out?
- Is there a better (common) way to achieve what I'm trying to do?