Skip to main content
Game Development

Return to Answer

Grammar and formatting. Some wording clarifications.
Source Link
Anko
Anko
  • 13.5k
  • 10
  • 56
  • 82

For our game Moblox, we use at first ourThe internal system we used for Moblox (now it islater replaced with OpenFeint) worked like this:

  • we sendSend a JSON message onover plain HTTP (not HTTPS). In this message, we madeInclude a md5 onMD5-hash of all fields plus a magic string and add it in the message;.
  • onOn the server, we check the integrity of the message with the same operation;operation.

To crack the system, you mustyou'd have to find this key (the magic string). It is possible with reverse engineering. But, it'sbut painful.

OpenFeint, ScoreLoop and CocosLive usesall use the same trick, but with HTTPS. Very easy to implement.

For our game Moblox, we use at first our internal system (now it is OpenFeint):

  • we send a JSON message on HTTP (not HTTPS). In this message, we made a md5 on all fields plus a magic string and add it in the message;
  • on server, we check the integrity of the message with the same operation;

To crack the system, you must find this key (the magic string). It is possible with reverse engineering. But, it's painful.

OpenFeint, ScoreLoop and CocosLive uses the same trick with HTTPS. Very easy to implement.

The internal system we used for Moblox (later replaced with OpenFeint) worked like this:

  • Send a JSON message over plain HTTP (not HTTPS). Include a MD5-hash of all fields plus a magic string.
  • On the server, check the integrity of the message with the same operation.

To crack the system, you'd have to find this magic string. It is possible with reverse engineering, but painful.

OpenFeint, ScoreLoop and CocosLive all use the same trick, but with HTTPS. Very easy to implement.

Source Link
Ellis
Ellis
  • 3.6k
  • 21
  • 28

For our game Moblox, we use at first our internal system (now it is OpenFeint):

  • we send a JSON message on HTTP (not HTTPS). In this message, we made a md5 on all fields plus a magic string and add it in the message;
  • on server, we check the integrity of the message with the same operation;

To crack the system, you must find this key (the magic string). It is possible with reverse engineering. But, it's painful.

OpenFeint, ScoreLoop and CocosLive uses the same trick with HTTPS. Very easy to implement.