Skip to main content
31 votes

Why is account sharing so bad?

From both a legal & security standpoint, the single biggest factor I'm aware of is accountability. If you cannot determine who is responsible for the account, you cannot reasonably hold anyone ...
Pikalek's user avatar
  • 12.4k
27 votes

Why is account sharing so bad?

In addition to all the other answers: Prohibiting this has also the benefit of balancing the game from the point of view of players that won't be sharing their account. Assuming that account sharing ...
Pedro A's user avatar
  • 371
19 votes

Why is account sharing so bad?

Besides the legalese mentioned in other answers, there are also simple business reasons. Some games like World of Warcraft charge people by account. If you let two people share an account, you lose ...
Philipp's user avatar
  • 120k
10 votes

Why is account sharing so bad?

It is absolutely standard that if you have an account for a service, then you are responsible for what is done with that account. In game terms, some of the things which can be done with an account ...
Maximus Minimus's user avatar
6 votes

Why is account sharing so bad?

In addition to the many fine answers, there is another reason. Game companies don't want to arbitrate your personal squabbles. If you share your account with someone, you allow them to delete your ...
Scott's user avatar
  • 421
6 votes

Why is account sharing so bad?

In addition to all the other answers, there is another reason: Ensuring leaderboard integrity by prohibiting account sharing and multi-account usage. A famous example is the rhythm game osu!, which ...
F. George's user avatar
  • 161
5 votes

Why is account sharing so bad?

I can see a single aspect why they would ask you not to do it: money. If you share your account credentials with someone you trust, but end up losing all your stuff because that someone ended up not ...
Vaillancourt's user avatar
  • 16.3k
5 votes
Accepted

Security concerns related to HTML 5 games

I would like to know if people could modify an HTML 5 game's code Yes. Like all web technologies, the client has full access to the local code; they can browse the source, modify it and send ...
Vaillancourt's user avatar
  • 16.3k
4 votes
Accepted

Could executing OpenGL shaders sent from a server be dangerous?

I think the difficulty of successfully exploiting a machine through shaders is pretty difficult but not impossible or unprecedented. There's a small chance of that happening -- for example, there was ...
Jimmy's user avatar
  • 9,029
4 votes

Is allowing the server to remotely execute code on a client a security risk?

You might want to ask yourself if you really need client-sided scripting at all. You might be able to make many interesting mods possible by simply making your network protocol powerful enough. Most ...
Philipp's user avatar
  • 120k
4 votes
Accepted

I want to use the GameJolt API, how do I protect my private key which is in my game?

This question has actually been asked several times, and the answer is always the same thing; you're not going to like it. It's impossible to keep things like this a secret. You can however, take ...
Krythic's user avatar
  • 790
4 votes

Why is account sharing so bad?

I'm not a gamer, but my first thought was that if multiple people use the same account, any analytics collected about the user would be difficult or impossible to interpret. Not sure if games collect ...
Jon's user avatar
  • 141
4 votes
Accepted

How do I prevent modders from creating malicious code?

You cannot prevent it (in situations which are equivalent to running arbitrary native code supplied by others). You can: curate the mods screen submissions with a scanner restrict your API as much ...
Pikalek's user avatar
  • 12.4k
3 votes

Unity AssetBundles, server and security concerns

but is this an issue? Could someone find the ID and password from say, the .apk file? Could be an issue if you don't want people to download those files or you use that ID and password for more ...
César Augusto's user avatar
3 votes
Accepted

Obscure primitive data types against cheating

The major flaw is that you are adding random values between int.MinValue and int.MaxValue leaving no more space for your real ...
Olivier Jacot-Descombes's user avatar
3 votes

Verifying client file integrity

I get that this check can be circumvented by using an unmodified client to generate the hash and sending it with a modified client. So you've handed every player the exact recipe for how to lie to ...
DMGregory's user avatar
  • 135k
3 votes
Accepted

online game, NPC monster death and hit detection to gain experience points

When you want a cheating-proof client/server game, then you need to handle all game mechanics which are worth cheating on the server. Don't send "Player X hits enemy Y for Z damage". Just send "...
Philipp's user avatar
  • 120k
3 votes

Prevent replay attacks on multiplayer character movement

The most likely way such packets could occur is through cheats that people would code for your game. Either the cheat would hijack the connection on the client's side and send duplicate packets, or ...
Magma's user avatar
  • 205
3 votes
Accepted

Intergrating Easy Anti Cheat - Do we need to add Epic login?

EAC requires some way to identify the user/client to do its job. The EOS_AntiCheatClient_BeginSessionOptions structure requires a user ID, which is acquired from logging in to EOS successfully. ...
Romen's user avatar
  • 396
3 votes

How to Prevent Fake Packets?

When the player joins the game, have the server generate a random token to send them as part of the "successfully joined" confirmation message. The player can then send that token back with ...
DMGregory's user avatar
  • 135k
2 votes
Accepted

How I can I prevent users from downloading games they're not authorized to?

For this you would require an implementation of user authorisation (wikipedia). This could be implemented in many different ways. You will need to look at your requirements and see what needs will be ...
Zolomon's user avatar
  • 1,650
2 votes
Accepted

Let both clients know of complete game-state in turn-based game?

This is not safe. As soon as you let client know something, consider the player knows it too. Even if the information is hidden from players view in GUI, it can be more or less easily extracted from ...
Kromster's user avatar
  • 10.7k
2 votes
Accepted

Should all stats only exist on MySQL database for my Flash browser RPG?

"All the logic will be handled in Flash" there's your problem. It doesn't matter where you store the stats if I can hack my client to ignore them and just always report back "Yeah, I toooottally won ...
DMGregory's user avatar
  • 135k
2 votes
Accepted

How to unpack game data files encrypted with AES key?

Yes, the encryption key must be somewhere, otherwise the game would be unable to open those archives. But unfortunately there are just too many ways one could store such a key. It could be somewhere ...
Philipp's user avatar
  • 120k
2 votes
Accepted

MMO Client-Server Spoofing Vulnerabilities

IP spoofing on the public Internet has become difficult because most ISPs take countermeasures to prevent it. There isn't much one can do to screw with people's games, unless they control a router ...
Philipp's user avatar
  • 120k
2 votes
Accepted

How can I prevent players from reading a puzzle solution out of the game's code?

The first step is managing expectations. Remember that "the client is in the hands of the enemy" — if you're making an offline game, then you're giving your attacker both the lock and the ...
DMGregory's user avatar
  • 135k

Only top scored, non community-wiki answers of a minimum length are eligible