I am making a flash game that will interact heavily with the server. For quite some time already I am using 'request hashing' technique to make sure that request data hasn't been tampered with. This works pretty well. However, in this game I'd like to go a little bit further and completely hide the protocol from the observer (right now it's plain JSON).
I imagine that I could zip and encrypt data (using one of symmetric algorithms). That would make it pretty unreadable by human, right (also smaller)? And SWF encryption/obfuscation should protect the encryption key (it is being done anyway).
As a side benefit that will also protect dynamically loaded resources from directly saving them to disk (or copying from the cache).
Questions:
* are there tools that allow you to simply dump the SWF with all its content, received and decrypted? If yes, this will render 'the side benefit' invalid.
* do you think it's worth it to burn all that CPU power?
To support my point, I will say that I like to inspect data being exchanged between client and server. And occasionally I find a bug or two which I can use to my benefit. But then there was a game that was sending and receiving some binary data. Being a lazy attacker, I decided not to analyze further. Otherwise, who knows what I could find :-)
Comments, ideas, criticism, suggestions? :-)
