online game scores

A while back, somebody was setting up a free service for Blitzers so we could integrate an online high score database for our games. How is progress on this coming, or has it been dropped?

One thing I would like to know is how it prevents not very nice people to submit fake scores.

In your Blitz game you would have it so that when a person get a high score, they get to submit their name(in the game). The name is sent to a certain PHP page with its own password(so people can't just go to that page and submit a score) then into a database. It would be impossible for someone to submit a score unless thay actually got a high score(or they knew your password).

Not really -- a packetsniffer running while you get a high-score once would give you all the data you need to submit additional arbitrary scores after that.

To secure it further, you probably could also generate & submit a checksum code. (Some ormula, which takes your name & score, encrypts it in some form, and generates a 3rd variable)
You then have a PHP script or CGI or something on the webserver do the same calculations with the username & highscore, and only accept the score for inclusion in your highscore table if the submitted checksum matches the one the server calculated on its own.

That way you also need to know the exact formula to generate the 3rd value before the webserver would accept it, locking out 'fake' submissions of higher scores based on sniffed packet data.

It's trivial to see what server and page your program connects to, it's trivial to intercept username/password authentication over HTTP, and its trivial to resubmit slightly altered data to the same location... So unless you have a way of the server verifying that the data it received is authentic, or unless you encrypt all communications with the server flat-out, it can be tampered with.

Or people could be moral ...

Or you could set up the service so that it only worked for games that recorded the game as it was played. A little more complex to code the game, uses more resources too, but not impossible. The checksum mentioned earlier in the thread could be a running Adler-32 of the recorded data.

I haven't tested the function below, but it should work.

P.S. Don't use this for tiny things. No less than 512 bytes of binary data and no less than 1KiB of text. Failure to comply will result in your complete destruction. Err, I mean.. you won't get a very unique checksum :)

Function Adler32%(databank%)
    ;==========================================================================
    ; DESCRIPTION
    ;
    ; Computes the Adler-32 value for data stored in a bank.
    ;--------------------------------------------------------------------------
    ; PARAMETERS
    ;
    ; databank% : Valid Blitz bank.
    ;--------------------------------------------------------------------------
    ; RETURNS
    ;
    ; 32 bit Adler checksum for the data held in the bank.
    ;==========================================================================

    adler%=1
    
    length%=BankSize(databank%)-1

    s1% = adler% And $FFFF
    s2% = (adler% Shr 16) And $FFFF

    For i%=0 To length%
        s1% = s1% + PeekByte(databank%,i%) % 65521
        s2% = (s2% + s1%) % 65521
    Next

    Return (s2% Shl 16) + s1%
    
End Function

Very true, but that doesn't address the 'One thing I would like to know is how it prevents not very nice people to submit fake scores. ' question above.

Don't underestimate how much a twelve-year-old with too much time on his hands can ruin the gaming experience of all your other customers by preventing them from ever posting a high score when they 'rightfully' earned a spot?

Plus having a high score system that's easy to tap into and abuse is just digital graffitti waiting to happen...

We will soon be launching the subscription based IndieNet service, the service us built around our secure IndieNet.dll. The dll handles all communications with the server and provides a number of security layers so that only highscores generated by the game it's plugged into will be handled. It's also got a built-in profanity filter.

The following options will be available :

1) We Host :- We host the score database and provide you with the tools to manage your specific data. We will also supply pre-built scripts so that you can do simple queries to display the scores on your own sites.

2) You Host :- We provide the scripts, install tools and example integration code for a multitude of languages. You will receive a slightly different version of the dll which will also allow you to submit raw SQL querys to the database from your application - again all communication is secure.

All verisions of the dll give you access directly to the encryption systems, this will enable you to save game data like local highscores securly to disk. In addition you can encrypt things like score data and lives data in memory so even the more advanced hackers can't snoop the memory and change things.

We utilise the RC4 encryption technology with variable size keys. All encrypted data is also base16 encoded for error free internet transmission (base64 was unpredictible with some servers). A score can not be posted without 1) The Game ID, 2) The Game PIN, 3) The correct encryption key and 4) the database name and location. All key and Pin details are kept serverside, we do not transmit any information that may compromise the security of the system.

Costs? we have not decided yet, feedback from established developers indicate that they are prepared to pay up to $500 for a one-time unlimited license fee (no limit to number or games).

However since this was developed by indies for indies we want to make it accessible and affordable to all.

Expect to see an announcement within a couple of weeks.

Submitting to a website via PHP straight from the game itself is also not the best way of transferring the score.

A direct TCP connection made to a server which then does a secure handshake (akin to, or even 99% the same as, opening an SSH telnet session) before transferring a score.

Wellllll..... I've decided to have a go at this project myself. I'm making a site where you can login and manage your high score tables and such.

I had something like this in mind. The game logs the keypresses and sends them when a highscore is made. The server replays the game, but much faster of course, using those keypresses to verify the score.
But this makes it much more difficult to create a "free service for Blitzers so we could integrate an online high score database for our games".

Also, if the highscore server did function like this, what stops not very nice people to create their own game that contains a small backdoor/trojan? Suddenly the whole highscore server is a gigantic graffitti.

Oh and I forgot to mention that this stuff runs in a seperate thread so your application will not hang while scores are being retrieved or sent.

Back to the original question, what is the status of the free service a Blitzer was setting up?

@Brice, you are probably referring to our service, this *was* going to be free.

Ah.. TY, couldn't find the old post so I couldn't remember who was doing it ;c). The new service sounds nice, but $500 is way out of my price range for freeware games.

Hi Brice,

I'll give some serious consideration to a free "Freeware" version, I will probably stipulate that you put something like "Powered by IndieNet" somewhere in the game and on your highscore web pages. At least then I get some free advertising and you get free access to the software - you would have to host it yourself though.

What do you think? is this workable?

That sounds very fair to me and I am sure many would appreciate it. Unfortunately, to cut costs, I am using the web space provided for free by my ISP and I do not have the ability to host anything like that, so it wouldn't work for me.

BTW, Found the one I was thinking of:

http://www.tournamentblitz.com/html/index.php

Sounds more than reasonable!

Brice,

TournamentBlitz.com will offer this service FREE to all Blitz Game Developers to include a Gnet-like service with enhanced features. The Website (60%) and SDK (75%) and progressing.

Ty, Frank ;c)

Progress on mine (free) is coming along nicely. :)
You can host high score tables on my site as well.

My only issue is security of writing high scores. It seems there is no sure way of stopping people from submitting fake scores, you can only make it harder for them?

I read the above examples and even they aren't %100 safe eh?

Nothing is 100% safe -- even if you have a rock solid submission scheme, people can still crack the program itself, auto-increment your score to a bazillion, automagically 'win' and submit a highscore that way, using your own super-secret undecypherable uninterceptable submission routines.

All you can do is make it harder, never impossible.

I see.

Well, do you have any suggestions as to how to write fairly securly with the game coder doing minimum amount of work? I think I might just go for the simple password on both ends type thing.

It's always possible to hack the game memory whilst the game is running and change the scores that way, that is why we have made the encryption methods contained in the dll available to the user - you can encrypt the memory so a memory trace ain't going to work.

Here is the Freeware manual if people want to look at the instruction set : http://indiepath.com/tim/Manual_freeware.pdf

I security is really a concern (and it's unlikely to be a major issue) you can always keep a series of backups and if you notice (or someone) reports a "hack" you can then at least restore to a fairly recent one. Wikipedia does this too.