0
\$\begingroup\$

So, I have a game in Unity for mobiles that gives you the possibility to sign-up with username, email and password to unlock extra features. The datas are sent, through a POST request, to a PHP+MYSQL server that expose an API. I'm developing both so I have complete freedom on how to implement it.

My question is what is the correct way to:

  • save auth data on player mobile device so it can automatically login on subsequent runs of the game
  • how to safely send username and password to my server for the authentication

I want to protect data from man in the middle attacks and I don't want to send clear password because users tends to always use the same email/password combination.

Thank you

\$\endgroup\$
  • \$\begingroup\$ This is subjective. For the love of your players, though: transmit securely and don't store in plaintext. \$\endgroup\$ – Vaughan Hilts Nov 18 '14 at 16:54
  • \$\begingroup\$ I'm asking for the correct way to do this within Unity and towards a PHP API. \$\endgroup\$ – Erik Nov 18 '14 at 17:15
3
\$\begingroup\$

You want your webserver access to go through HTTPS; that will encrypt the traffic so people in the middle can't read it.

\$\endgroup\$
  • \$\begingroup\$ Yes, but it requires me a Signed Certificate from a Third Party (not self signed) and I don't think that Unity is capable of generating an encrypted POST. Please don't give me general advices but specific implementation with Unity and PHP web server. Thank you \$\endgroup\$ – Erik Nov 18 '14 at 17:14
  • 1
    \$\begingroup\$ You are vulnerable without HTTPS. I'm just calling it like it is. Implementing your own security would A) be insecure B) take a very long time. Our Unity game goes over HTTPS, and it works fine. As far as my personal projects, I'm at a webhost that does HTTPS for me. They do myproject.secure.hostcompany.com, and they have a shared certificate for secure.hostcompany.com that their subscribers can use without extra charge. \$\endgroup\$ – Almo Nov 18 '14 at 17:57
  • \$\begingroup\$ Did using https with Unity in your iOS build give you problems with App Store approval? (they ask you you use encryption) \$\endgroup\$ – Erik Nov 18 '14 at 19:23
  • \$\begingroup\$ No trouble with Apple at all. \$\endgroup\$ – Almo Nov 18 '14 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.