Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In the context of a game (HTML5/Flash/Silverlight) which sends data to an online service to record progress (e.g. player killed an orc), would communicating with the service over SSL implicitly prevent the player from recording and replaying the message? I know SSL includes a nonce, but does it remain constant for the duration of the connection or does it change after each request/response cycle?

share|improve this question
    
But assuming that the request is something more complicated, like a POST of RSA-encrypted data, SSL's nonces will prevent the request being replayed? –  Mark Rendle May 24 '10 at 15:45

2 Answers 2

up vote 2 down vote accepted

The nonce is at the transport layer level and not at the application layer. SSL would only prevent replay if the player captures the TCP packets and tries to replay then. But within the browser at the HTTP level the user can create a new request easily by simply refreshing the page...

share|improve this answer

No it wouldn't because the user could use a proxy which would decrypt the data being sent either way and that proxy would show all the requests and all the responses. He'd learn that the request sent when he killed an Orc is something like GET /killed/orc and he could just send that from a browser or Curl. He could then write a script which kills an Orc 100 times using a simple bash loop.

You'd need to be checking that you'd actually sent an Orc for him to kill at the very least. Probably give that Orc a unique identifier so at worst the user could only kill things you have actually sent.

share|improve this answer
    
Upvoted cos the Orc-UUID idea is good, thanks. –  Mark Rendle May 24 '10 at 16:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.