In the context of a game (HTML5/Flash/Silverlight) which sends data to an online service to record progress (e.g. player killed an orc), would communicating with the service over SSL implicitly prevent the player from recording and replaying the message? I know SSL includes a nonce, but does it remain constant for the duration of the connection or does it change after each request/response cycle?
2 Answers
The nonce is at the transport layer level and not at the application layer. SSL would only prevent replay if the player captures the TCP packets and tries to replay then. But within the browser at the HTTP level the user can create a new request easily by simply refreshing the page...
No it wouldn't because the user could use a proxy which would decrypt the data being sent either way and that proxy would show all the requests and all the responses. He'd learn that the request sent when he killed an Orc is something like GET /killed/orc
and he could just send that from a browser or Curl. He could then write a script which kills an Orc 100 times using a simple bash loop.
You'd need to be checking that you'd actually sent an Orc for him to kill at the very least. Probably give that Orc a unique identifier so at worst the user could only kill things you have actually sent.