0

In the context of a game (HTML5/Flash/Silverlight) which sends data to an online service to record progress (e.g. player killed an orc), would communicating with the service over SSL implicitly prevent the player from recording and replaying the message? I know SSL includes a nonce, but does it remain constant for the duration of the connection or does it change after each request/response cycle?

1
  • But assuming that the request is something more complicated, like a POST of RSA-encrypted data, SSL's nonces will prevent the request being replayed? May 24, 2010 at 15:45

2 Answers 2

2

The nonce is at the transport layer level and not at the application layer. SSL would only prevent replay if the player captures the TCP packets and tries to replay then. But within the browser at the HTTP level the user can create a new request easily by simply refreshing the page...

1

No it wouldn't because the user could use a proxy which would decrypt the data being sent either way and that proxy would show all the requests and all the responses. He'd learn that the request sent when he killed an Orc is something like GET /killed/orc and he could just send that from a browser or Curl. He could then write a script which kills an Orc 100 times using a simple bash loop.

You'd need to be checking that you'd actually sent an Orc for him to kill at the very least. Probably give that Orc a unique identifier so at worst the user could only kill things you have actually sent.

1
  • Upvoted cos the Orc-UUID idea is good, thanks. May 24, 2010 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .