in my game the client logs in and receives a map made of tiles (they differ in height and terrain type) from the server. I'm storing these tiles in a SQLite database on the client. The next time the client logs in, it communicates to the server that it already has the map. This saves network load and cpu on the server and decreases loading time.
Now I wonder if I'm doing the right thing. Because it would be very easy for the player to modify the tiles in his local SQLite database, turn a mountain into flat land client-side and walk right through it.
I will of course implement a system on the server that picks one or a few players at a time and checks if their reported positions are valid (as in, they aren't hacking), but I can't constantly run these checks on everyone for performance reasons.
This brings up the following questions:
- Can I encrypt the SQLite database locally?
- Would I hide the key in the code?
- Is that safe? Could the client find the key?
- Can the map be altered on the client even if I don't store it in a database?