MMOCCForum

Hey

I am basically hoping to start work on my own achievements system for a few games I plan on making in Flash. Basically I have never made anything like this before and while I know I can make the Flash game simple call a PHP file whenever achievement criteria has been met I want a fine layer of security to prevent people from obtaining achievements by hacking.

Now I know that nothing is really ever secure but I'd just like any experienced coders out there to guide me towards the right direction when it comes to securing this type of thing.

If you could help me in any way possible I would really appreciate it. Also please feel free to post links to any useful resources.


Thanks

EDIT: I'd just like to point out that users will be logged in while playing these games, just incase that helps

If i where to do this, i'd use the Mysql database to secure it all. Letsay they create an account it automatically puts it into the database, Now say they have an achievements Table in the database, for each achievement lets says 0 = Not complete and 1 = Bronze 2 = Silver 3 = Complete/Gold. When they create a account it will default them all to Zero and for a single achievement it could be changed straight to 3 or a Over time achievement it can slowly go up 1, 2 then 3. Anyway Sorry if i havn't helped atall because i don't know if thats what you wanted x]
I hope i helped. I will reply if i havn't.
-Soyabean+

Thanks for the post but I am more concerned with stopping users from reverse engineering the game's swf so that they can easily get all the achievements without performing the intended achievement's criteria. I'd just like it if some experienced users could help me with ways on preventing this.

I take it you've thought of encrypting any values passed.

Actually I've done more than that. Since I made the post I've done some pretty extensve research into this.

I've concluded that the best way to handle this type of thing is through a multiuser socket server. Basically you track every event as it happens. If the user does something which is a step towards the achievement, it is sent to the server and validated etc. If someone sends the final step for the achievement before the other steps then it's invalidated. This mixed with some RSA encryption, timer to ensure steps aren't sent quicker than they can be possibly achieved in game and tokens to prevent replays should ensure a pretty secure achievements system.

I guess you can also implement this through the typical HTTP GET as long as you allow for the time lag (but then that should guarantee that any steps sent within a time limit are most definitely malicious messages).

So yeah, solved my own problem haha. Pretty much posted this for anyone else interested. This thread can now be closed.