in my game the client logs in and receives a map made of tiles (they differ in height and terrain type) from the server. I'm storing these tiles in a SQLite database on the client. The next time the client logs in, it communicates to the server that it already has the map. This saves network load and cpu on the server and decreases loading time.

Now I wonder if I'm doing the right thing. Because it would be very easy for the player to modify the tiles in his local SQLite database, turn a mountain into flat land client-side and walk right through it.

I will of course implement a system on the server that picks one or a few players at a time and checks if their reported positions are valid (as in, they aren't hacking), but I can't constantly run these checks on everyone for performance reasons.

This brings up the following questions:

  1. Can I encrypt the SQLite database locally?
  2. Would I hide the key in the code?
  3. Is that safe? Could the client find the key?
  4. Can the map be altered on the client even if I don't store it in a database?

Thanks everyone


closed as off-topic by concept3d, MichaelHouse Jan 18 '14 at 16:09

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions that aren't specific to game development are off-topic here, but can be asked on Stack Overflow. A good rule of thumb is to ask yourself "would a professional game developer give me a better/different/more specific answer to this question than other programmers?"" – concept3d, MichaelHouse
If this question can be reworded to fit the rules in the help center, please edit the question.

  • \$\begingroup\$ Why would you need to store the map on client side? why you don't just resend it each time the client connects? About security, if you only send the map to the client for rendering purpose, you don't really care about the player modifying the map since it will only affect his own game experience, you are suppose to handle map collisions/interactions on server side. \$\endgroup\$ – nathan Jan 18 '14 at 12:15
  • \$\begingroup\$ I would store it on the client side to allow faster loading times and reduce network load. \$\endgroup\$ – spacecoyote Jan 18 '14 at 12:18
  • \$\begingroup\$ Should I really check on every single collision on the server side? I thought I'd only make sample checks of certain randomly picked players. I'm expecting several hundred connected players (whether this is realistic or not, that's what I'm planning for.) \$\endgroup\$ – spacecoyote Jan 18 '14 at 12:19
  • \$\begingroup\$ Why would you encrypt it if you are going to decrypt it a second later during runtime? Also, if you expect a lot of players, it means you should have the finances sorted out. Buying computation power and bandwidth is not as expansive as it used to be. \$\endgroup\$ – wolfdawn Jan 18 '14 at 14:17
  • 1
    \$\begingroup\$ This seems off topic because it's not directly related to gamedev. I think this is better asked on Stackoverflow. \$\endgroup\$ – concept3d Jan 18 '14 at 14:28

I think the answer is that 90% or more of the clients would not find a way to use all these exploits but it is enough that one person will and it's on the net and the damage is done.

Often times it is sufficient to cheat a small amount of times at certain critical points to gain unfair advantage. You may not be able to detect cheaters if you randomly check once in awhile.

Short answer: Send the client the tile/height map once and check the result for every action the client performs. If you care about security, never let the client tell you the result.

Long rant: If you let the client-side make decisions about anything that has to do with game logic, such as your height map in this case that affects mobility, it is an invitation welcoming hacks. I wouldn't modify the tile-map, I would use a pkt sniffer and simply send the server pkts that contain the decisions I would like. I would do it for fun and challenge.

This strategy to optimize server performance is much like a bank, saying, well, you tell me how much money you have in your account and I'll check if I feel like it. Basically offering no form of security at all. It is not even exploitable, cause you are leaving the gate wide open. It is more like a feature.

  • \$\begingroup\$ You're right, cheating a critical points would be enough to ruin the gameplay experience for others. I'll keep allowing the client to store a copy of the map, but I'll also check each of his movements. (His height-coordinate must at least be the height of the tile, plus jumping range at max.) You're also right in your comment, encryption doesn't make sense in that case as it isn't needed. \$\endgroup\$ – spacecoyote Jan 18 '14 at 15:33

Anything stored in the client can be found, read, and modified. Never store something in the client without adequate server-side enforcement. If someone has the time and desire to change those files, then I can assure you that they will.

For example, there's plenty of hacks and tools for the popular MMORPG World of Warcraft. If I wanted to, I'm sure I could find a tool or script that works with the current version of the game that would let me fly through the world. There are also certain programs that play the game for you, and they read the navigation meshes stored on the client.


Not the answer you're looking for? Browse other questions tagged or ask your own question.