1
\$\begingroup\$

I am currently building an iOS MMO and I'm leaning towards using TCP as my networking protocol over the higher level HTTP (for the speed difference and the fact that it does not require the client to poll constantly for updates.)

Now, through my research I know that with MMO and any client-server multiplayer games, you should never trust what the client sends to the server. As an extension of that, you wouldn't want anybody to read your packets to see the contents so it's harder for them to send correctly formatted data to the server. (Maybe I'm paranoid.)

The only problem is, where in HTTP there is great support for a secure channel in HTTPS through SSL where the setup occurs mainly server-side, I am not aware of a way to achieve the same thing on TCP. Is there any resource I could be referred that could help me achieving similar security, or at least good enough, on both the iOS side and server-side?

On a side note, if the answer involves doing the encryption and decryption on the client-side, would that severely impact the performance of my application?

Thanks!

\$\endgroup\$
3
  • 1
    \$\begingroup\$ All encryption and decryption done client side can be reverse engineered by someone wanting to build their own client, and will add some extra latency. I wouldn't bother with it. \$\endgroup\$
    – Adam
    Jan 5, 2012 at 12:21
  • \$\begingroup\$ @Adam thanks for the advice. That does make sense. I will probably not bother with encryption and only do secure connections during authentication then. \$\endgroup\$
    – Jamornh
    Jan 5, 2012 at 14:46
  • 1
    \$\begingroup\$ Encryption is to prevent a 3rd party listening in on the communication, it has no point if the aim here is to prevent your legitimate users being naughty. \$\endgroup\$ May 11, 2013 at 13:26

1 Answer 1

2
\$\begingroup\$

If you are looking to prevent people from modifying the client, the short answer is, you can't. Seeing that you plan on making a turn based game it doesn't really matter, you just have to make sure that the client doesn't get any information that the user is not supposed to get, and that the server disregard any illegal action.

Still, you could use an encrypted channel to protect the user, but that is a feature you can always tag on, there should be some security libraries that make this pretty easy.

\$\endgroup\$
5
  • \$\begingroup\$ Thanks for your answer. So if I understand correctly, I shouldn't bother with encryption or decryption to protect the data as it can always be cracked. The only reason I should do a secure connection would be to protect the user's username and passwords and maybe private data from being stolen. Thus, through the majority of the game time, I don't have to bother with it other than at authentication? \$\endgroup\$
    – Jamornh
    Jan 5, 2012 at 14:45
  • 1
    \$\begingroup\$ That would be sensible. After all, it is just a game, and simply knowing other peoples game data isn't really interesting. \$\endgroup\$ Jan 5, 2012 at 15:15
  • \$\begingroup\$ You can check for modified clients by checking the Checksum of each file. If The checksum is not the same as the checksum of the file you produced, the file must be modified. This is done by some games I know. \$\endgroup\$
    – Thomas
    Jan 7, 2012 at 16:46
  • 1
    \$\begingroup\$ @Thomas And if you are into modifying executables anyway you can modify the checking part to simply send the desired checksums regardless of the actual files. You can turn this into an arms race, but if the game relies on any skill that a computer can do better than a human there is always going to be a way of cheating. \$\endgroup\$ Jan 7, 2012 at 20:02
  • \$\begingroup\$ I'm sure anything will be "hackable", it's just about making it as difficult as possible or as time consuming as possible. \$\endgroup\$
    – Thomas
    Jan 8, 2012 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .