High Score Web Site

[Dzz]

I am planning to do this type of thing for future games of mine -- having some embedded code that spits out an encrypted character string containing a name and score. Then a player could type that string into my web site and it would get decrypted and added to a database.

The system is completely dependent on being difficult to reverse engineer however. I believe I can make it so difficult that nobody in our small community would bother just so they could pretend to have gotten a high score on some little game I wrote. However, I can not think of a way to do this as a general solution that other people could use.... if the source code or even a linkable binary module gets out of my secret fortress, it would become MUCH simpler for somebody to reverse engineer.

I certainly admire the dedication of whoever is planning to look at all of the screenshots and do the data entry into the system as it has been described here so far.

 

[Parkydr]

open source + obscured high scores = unobscured high scores.

Not true e.g. openssl code is open source but having the code won't help.

Why not use a public/private key system. If developers use the same method and public key, only the private key can be used to decrypt it.

 

[Dzz]

open source + obscured high scores = unobscured high scores.

Not true e.g. openssl code is open source but having the code won't help.

Why not use a public/private key system. If developers use the same method and public key, only the private key can be used to decrypt it.

The problem is that there is no way to verify who is encrypting the data in the first place. Encrypting something using the web site's public key means that it can only be decrypted by the web site, but that isn't our concern. We would need to encrypt the data with the app's private key to verify that it came from the app, but that only works if the private key is secret, which it cannot be since it has to be embedded in the application.

 

[^RaZ]

open source + obscured high scores = unobscured high scores.

Not true e.g. openssl code is open source but having the code won't help.

Why not use a public/private key system. If developers use the same method and public key, only the private key can be used to decrypt it.

The problem is that there is no way to verify who is encrypting the data in the first place. Encrypting something using the web site's public key means that it can only be decrypted by the web site, but that isn't our concern. We would need to encrypt the data with the app's private key to verify that it came from the app, but that only works if the private key is secret, which it cannot be since it has to be embedded in the application.

can we not use digital certificates? the high score server would have to act as the TA tho :unsure:

 

[Wite_Noiz]

can we not use digital certificates? the high score server would have to act as the TA tho :unsure:

I agree with Dzz. The problem isn't the encryption method, it's that the users will have access to the encryption method - so the website will have no way of telling if it was the app that encrypted the score or the user.

I can only think of obfuscation (making it difficult for a human to understand what is happening), but that's not a solution in the long run.

It's a nice idea, but I can't see any way of guaranteeing that the scores are legitimate. And there will always be people out there wanting to screw the system

 

[jbrodack]

I'm thinking it would be somewhat like how hotornot.com approves new pictures. Automated yet requiring approval from people. The high score web site would have a main administrator but could also have extra people that would approve screenshots as authentic. since this is a fairly small community and since the site would only focus on homebrew I don't think there would be an overbearing amount of people submitting high scores.

yes there probably will be people trying to cheat but its not like this is for money its for fun. having some form of human approval just seems like the best and most foolproof way to do things plus if set up well the whole load of approving scores wouldn't have to rest on one person.

im opposed to any automatic encryption system because there will be people trying to crack that just for the sake of it. it would add extra complexity to the whole thing and probably not be secure enough anyway.

 

[^RaZ]

To be able to read encrypted data both the method and key is required, to make plain text.

To be able to encrypt data both the method and key are required, to make the cipher text.

Having the method to encrypt data is not enough to break the system, you would also need the key. in a assymetric system your gunna need the private key and in symetric systems well u just need the key =)

Assymetric- one key is capable of decrypting cipher text created by the other key, the decrypting key is usually the private key.

why bother with encryption at all? Can we not just generate a hash of the highscore information instead this could be sent along with the plain text information, should they not match then its a cheat? This kinda gets me confused :huh: and i know should someone know the method of hashing then the highscore could be faked again.

Whay not just not release the source for that part of the program? Just make life simpler!

 

[PSyMastR]

How about this. Post your high scores here, and if you cheat, well good for you.

 

[jbrodack]

well i know there was a thread where people posted their vektar high scores and i don't think anyone cheated in that. the reason i wanted a web site was so there would be one centralized consistent place to compare your high scores at.

now im thinking that there should be a site where people post there high score and a screenshot and it automatically gets posted. however it would require you to create an account and log in. right there that will limit the amount of cheaters a large amount. if someone is caught cheating their account and ip could be banned. there could also be a system where after you log on you could go to a page called report cheaters and you would pick someones score send a description of why you think they are cheating and it would get sent to the site admin. also there could be a public count next to the score of how many people submitted such a complaint so people will be able to see if a score is possibly questionable and if it is verified 100% valid by the site admin it could go back to zero on that complaint/suspespected cheating count.

this way anyone who creates an account get post there scores without it being approved which means less work for the site admin. it also means the site would be able to self police itself a good amount. since even though no scores would automatically get removed if something is a really obvious fake people will report it and people will see that its fake and even if still on the site anyone keeping track of high scores could just not count it.

I've gone through several ideas but I think this is really the easiest and best way to go. even if a lot of bogus scores are posted you could compare your scores to people in the forums who you know wouldn't cheat since everyone who posts their scores would have an account.

remember that from the start i said this should be fun. theres been so much talk about whether encryption would work and all that that i think the idea of just comparing your scores with others and having fun kind of got lost.

the MAIN thing needed is accounts so that you could compare scores with trusted friends. the point of the site isn't JUST to see who has the highest score but more to see how you compare to others on the forum. if some random guy who you have never heard of post some insane high score that won't matter as long as you can still compare your score to those that are at least somewhat familiar to you.

I really think the site can work if it goes more in this direction instead of all this encryption stuff. more towards a community site where you can compare scores with a number of friends rather than a site where you try to have to have the highest score even if its by cheating.