I am making a flash game that will interact heavily with the server. For quite some time already I am using 'request hashing' technique to make sure that request data hasn't been tampered with. This works pretty well. However, in this game I'd like to go a little bit further and completely hide the protocol from the observer (right now it's plain JSON).

I imagine that I could zip and encrypt data (using one of symmetric algorithms). That would make it pretty unreadable by human, right (also smaller)? And SWF encryption/obfuscation should protect the encryption key (it is being done anyway).

As a side benefit that will also protect dynamically loaded resources from directly saving them to disk (or copying from the cache).

* are there tools that allow you to simply dump the SWF with all its content, received and decrypted? If yes, this will render 'the side benefit' invalid.
* do you think it's worth it to burn all that CPU power?

To support my point, I will say that I like to inspect data being exchanged between client and server. And occasionally I find a bug or two which I can use to my benefit. But then there was a game that was sending and receiving some binary data. Being a lazy attacker, I decided not to analyze further. Otherwise, who knows what I could find :-)

Comments, ideas, criticism, suggestions? :-)


2 Answers 2


Yes there are many tools that allow dumping of the full swf, and/or all of the actionscript. http://www.buraks.com/asv/index.html being one of the many out there.

No, its not worth the CPU power as it will be easy to crack and design a fake program using your "hidden" key. If someone is going through the trouble of hacking your game, a "hidden" key and data transfer protocol are going to be easy to find.

Treat the client as hostile, always, and assume any protection that is in the client program will be hacked.

Design your server software to detect cheating instead of the client.


The golden rule of security is "always assume that your client is compromised". You're giving the client away, and no matter what you do, someone, somewhere WILL hack it. Unless no-one play your game, of course.

So, encrypting protocol with a key "hidden" in the client is about the same as not encrypting at all. If you're worried about cheating, the best way to cope with it is check everything server-side. If you're worried about players' privacy, use safe protocol like SSL for communications. AND check everything server-side.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .