1
\$\begingroup\$

Based on information from my friends working at game studios, it seems most commercial mobile games are using HTTP instead of HTTPS for communication between the phone and the server, and I am wondering why that is the case.

Based on my understanding it would be much harder for hackers to send fabricated message to the server and cheat if HTTPS is used. Is there a big drawback for HTTPS or is it just because the games my friends worked with are small (and larger games are actually using HTTPS)?

\$\endgroup\$

1 Answer 1

3
\$\begingroup\$

Based on my understanding it would be much harder for hackers to send fabricated message to the server and cheat if HTTPS is used.

That is not correct.

HTTPS uses transport layer encryption: it protects the message while it's in transport, so the third parties relaying it can't peek at its contents or modify it.

HTTPS does not do anything to limit what the sender can send. If a hacker wanted to send a fabricated message, they could do so just as easily. HTTPS would just ensure that their ISP or routers elsewhere in the net couldn't inspect or modify that fabricated message.

So, it's not the right tool if your threat model is a player using a hacked/forged client.

The main threat model HTTPS addresses is spying. Say your user wants to send you their credit card information to make an in-app purchase. That's valuable information that someone would try to sniff off the wire if you let them, so it's important to protect that.

Similarly for personal information like their login, which a dishonest third party could use to hijack their account (or accounts if the user has recycled the same password on other services). So user authentication is another case for HTTPS.

You probably also want to encrypt in-game chat communication. Otherwise your game could be used by an oppressive government to spy on what players are saying in ostensibly-private conversations.

But "I moved by (+2.3, -0.2, +0.5)" "I shot in direction (0.8, 0.6, 0.0)" you might consider to be information that's uninteresting to bad actors under your threat model. There's an argument that it's still a private conversation between the player and your game and no one else's business, and if you already use HTTPS elsewhere you might as well encrypt this too on principle or for consistency.

Developers may disagree about that one, and performance may be the deciding factor:

Is there a big drawback for HTTPS

Initiating the encrypted channel, encrypting messages to send, and decrypting them when received, all takes some work, which can contribute to CPU load and latency. This has gotten better with newer chips and the cost is quite reasonable for many uses, but it's not free. Profiling is the best way to determine whether the cost here is significant.

There is some system administration work involved in setting up a server to handle HTTPS communication correctly, though this is becoming standard in the default configuration for many server technologies and hosting platforms.

HTTPS requires an SSL certificate to authenticate your server. This can require purchasing one from a certificate authority and keeping it up to date - though Philipp points out in the comments that services like Let's Encrypt now offer such certificates for free, and that making your own self-signed certificate may be sufficient for this use case. Most game companies will need an SSL certificate anyway for other purposes, so although this is a complication, it's not really a determining factor in whether to use HTTPS.

\$\endgroup\$
1
  • 1
    \$\begingroup\$ You don't need to pay for HTTPS certificates anymore. There are services like Let's Enrypt offering them for free. Further, in the context of a game which is distributed as a binary, you can also use a certificate you generated and signed yourself and add it to the games asset files. The usual arguments why self-signed certificates are bad do not apply in this context, because the channel through which you distribute the certificate (the game download) is secure. \$\endgroup\$
    – Philipp
    Commented Oct 8, 2021 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .