31
votes
Why is account sharing so bad?
From both a legal & security standpoint, the single biggest factor I'm aware of is accountability. If you cannot determine who is responsible for the account, you cannot reasonably hold anyone ...
- 12.5k
27
votes
Why is account sharing so bad?
In addition to all the other answers:
Prohibiting this has also the benefit of balancing the game from the point of view of players that won't be sharing their account.
Assuming that account sharing ...
- 371
19
votes
Why is account sharing so bad?
Besides the legalese mentioned in other answers, there are also simple business reasons.
Some games like World of Warcraft charge people by account. If you let two people share an account, you lose ...
- 122k
10
votes
Why is account sharing so bad?
It is absolutely standard that if you have an account for a service, then you are responsible for what is done with that account.
In game terms, some of the things which can be done with an account ...
- 20.2k
6
votes
Why is account sharing so bad?
In addition to the many fine answers, there is another reason.
Game companies don't want to arbitrate your personal squabbles.
If you share your account with someone, you allow them to delete your ...
- 421
6
votes
Why is account sharing so bad?
In addition to all the other answers, there is another reason: Ensuring leaderboard integrity by prohibiting account sharing and multi-account usage. A famous example is the rhythm game osu!, which ...
- 161
5
votes
Why is account sharing so bad?
I can see a single aspect why they would ask you not to do it: money.
If you share your account credentials with someone you trust, but end up losing all your stuff because that someone ended up not ...
- 16.4k
5
votes
Accepted
Security concerns related to HTML 5 games
I would like to know if people could modify an HTML 5 game's code
Yes.
Like all web technologies, the client has full access to the local code; they can browse the source, modify it and send ...
- 16.4k
4
votes
Accepted
Could executing OpenGL shaders sent from a server be dangerous?
I think the difficulty of successfully exploiting a machine through shaders is pretty difficult but not impossible or unprecedented.
There's a small chance of that happening -- for example, there was ...
- 9,039
4
votes
Is allowing the server to remotely execute code on a client a security risk?
You might want to ask yourself if you really need client-sided scripting at all. You might be able to make many interesting mods possible by simply making your network protocol powerful enough. Most ...
- 122k
4
votes
Accepted
I want to use the GameJolt API, how do I protect my private key which is in my game?
This question has actually been asked several times, and the answer is always the same thing; you're not going to like it. It's impossible to keep things like this a secret. You can however, take ...
- 790
4
votes
Accepted
How do I prevent modders from creating malicious code?
You cannot prevent it (in situations which are equivalent to running arbitrary native code supplied by others).
You can:
curate the mods
screen submissions with a scanner
restrict your API as much ...
- 12.5k
4
votes
Why is account sharing so bad?
I'm not a gamer, but my first thought was that if multiple people use the same account, any analytics collected about the user would be difficult or impossible to interpret. Not sure if games collect ...
- 141
3
votes
Verifying client file integrity
I get that this check can be circumvented by using an unmodified client to generate the hash and sending it with a modified client.
So you've handed every player the exact recipe for how to lie to ...
- 136k
3
votes
Unity AssetBundles, server and security concerns
but is this an issue? Could someone find the ID and password from say, the .apk file?
Could be an issue if you don't want people to download those files or you use that ID and password for more ...
- 130
3
votes
Accepted
online game, NPC monster death and hit detection to gain experience points
When you want a cheating-proof client/server game, then you need to handle all game mechanics which are worth cheating on the server.
Don't send "Player X hits enemy Y for Z damage". Just send "...
- 122k
3
votes
Prevent replay attacks on multiplayer character movement
The most likely way such packets could occur is through cheats that people would code for your game. Either the cheat would hijack the connection on the client's side and send duplicate packets, or ...
- 205
3
votes
Accepted
Intergrating Easy Anti Cheat - Do we need to add Epic login?
EAC requires some way to identify the user/client to do its job.
The EOS_AntiCheatClient_BeginSessionOptions structure requires a user ID, which is acquired from logging in to EOS successfully.
...
- 406
3
votes
How to Prevent Fake Packets?
When the player joins the game, have the server generate a random token to send them as part of the "successfully joined" confirmation message.
The player can then send that token back with ...
- 136k
2
votes
Accepted
How I can I prevent users from downloading games they're not authorized to?
For this you would require an implementation of user authorisation (wikipedia).
This could be implemented in many different ways. You will need to look at your requirements and see what needs will be ...
- 1,650
2
votes
Accepted
Let both clients know of complete game-state in turn-based game?
This is not safe.
As soon as you let client know something, consider the player knows it too. Even if the information is hidden from players view in GUI, it can be more or less easily extracted from ...
- 10.7k
2
votes
Accepted
Should all stats only exist on MySQL database for my Flash browser RPG?
"All the logic will be handled in Flash" there's your problem.
It doesn't matter where you store the stats if I can hack my client to ignore them and just always report back "Yeah, I toooottally won ...
- 136k
2
votes
Accepted
How to unpack game data files encrypted with AES key?
Yes, the encryption key must be somewhere, otherwise the game would be unable to open those archives. But unfortunately there are just too many ways one could store such a key. It could be somewhere ...
- 122k
2
votes
Accepted
MMO Client-Server Spoofing Vulnerabilities
IP spoofing on the public Internet has become difficult because most ISPs take countermeasures to prevent it.
There isn't much one can do to screw with people's games, unless they control a router ...
- 122k
2
votes
Accepted
How can I prevent players from reading a puzzle solution out of the game's code?
The first step is managing expectations.
Remember that "the client is in the hands of the enemy" — if you're making an offline game, then you're giving your attacker both the lock and the ...
- 136k
2
votes
Accepted
Asset Bundle download from server: how does one prevent scripted attack?
The reason that Unity does not provide any specific mechanism to limit download requests is that the Unity Engine powers your client-side application. It does not run your asset-serving server, and ...
- 136k
2
votes
Accepted
Online Leaderboards: reducing cheaters without authoritative server verifying every move
This solution is quite a lot of work, but still not as much as an authoritative server, and it also provides other benefits: Add a record-and-replay feature to your game.
Record all inputs and any ...
- 122k
1
vote
Accepted
What harm would be done if a user were able to play the client side of a multiplayer game without logging in?
1.) This scenario seems possible, as there also exist private servers of some MMOs.
2.) I don't think that this could cause much harm. The important data for your game are on the Server. So they won'...
- 536
Only top scored, non community-wiki answers of a minimum length are eligible