   Stupid question about SSL, REST, RoR and highscores
  Hi mates! I'd like to know your suggestions.I'm creating a highscore server using RoR (ruby on rails) for an iPhone game. Comunicacion is done using REST web service, that is, POST to create a new highscore and GET to retrieve all highscores. Upload highscores mus be don e only by my game, and download highscores, by everyone (my game or a my game's website).I would like to add SSL in order to avoid cheated highscores, but, if I'm honest with you, I have no idea about SSL, so I have some question:I would like my iPhone game upload highscores using SSL, but, my question is, can anyone upload a highscore in the same way our browsers access HTTPS websites?(did I say I have no idea about SSL?)-Should I use any kind of authentication? (for instace, basic http authentication inside my game in order to avoid others programs to upload a cheated highscore)Thank you very much for your help, I appreciate it a lot.   
Quote:Original post by ricardo_ruiz_lopezI would like my iPhone game upload highscores using SSL, but, my question is, can anyone upload a highscore in the same way our browsers access HTTPS websites?Sure, all they need is a valid certificate. True identity cannot be established, which is why banks use multi-factor authentication and one time pads, to reduce the risk of stolen identity. But they cannot prevent it.But all of this still addresses only the problem of identity - it doesn't address the real problem of data integrity. Nothing ensures that application on the other end wasn't tampered with to report incorrect scores over a valid secure connection.The device, transport and protocol used don't really change the underlying problem. The only way to get around that would be to send entire game replay on each submission, so that server can run it independently.   ;Quote:Original post by AntheusQuote:Original post by ricardo_ruiz_lopezI would like my iPhone game upload highscores using SSL, but, my question is, can anyone upload a highscore in the same way our browsers access HTTPS websites?Sure, all they need is a valid certificate. True identity cannot be established, which is why banks use multi-factor authentication and one time pads, to reduce the risk of stolen identity. But they cannot prevent it.But all of this still addresses only the problem of identity - it doesn't address the real problem of data integrity. Nothing ensures that application on the other end wasn't tampered with to report incorrect scores over a valid secure connection.The device, transport and protocol used don't really change the underlying problem. The only way to get around that would be to send entire game replay on each submission, so that server can run it independently.Thanks for reply.Sending all game replay is too much, and it has no sense when using REST (a highscore is a resource)I read this on this website: "http://en.wikipedia.org/wiki/Transport_Layer_Security":"The TLS protocol allows client/server applications to communicate across a network in a way designed to prevent eavesdropping and tampering. TLS provides endpoint authentication and communications confidentiality over the Internet using cryptography. TLS provides RSA security with 1024 and 2048 bit strengths.In typical end-user/browser usage, TLS authentication is unilateral: only the server is authenticated (the client knows the server's identity), but not vice versa (the client remains unauthenticated or anonymous).TLS also supports the more secure bilateral connection mode (typically used in enterprise applications), in which both ends of the "conversation" can be assured with whom they are communicating (provided they diligently scrutinize the identity information in the other party's certificate). This is known as mutual authentication, or 2SSL. Mutual authentication requires that the TLS client-side also hold a certificate (which is not usually the case in the end-user/browser scenario). Unless, that is, TLS-PSK, the Secure Remote Password (SRP) protocol, or some other protocol is used that can provide strong mutual authentication in the absence of certificates."I guess I can use what that article call "bilateral autethentication" in order to allow only my iphone game to upload a highscore. Am I right? Any idea about how can I integrate this in a objectiveC program?Thanks a lot.   ;Quote:Original post by ricardo_ruiz_lopezMutual authentication requires that the TLS client-side also hold a certificateThis means that each individual installation (copy/iPhone) will need to have a unique digital certificate.Who will issue them, who will track them?But more importantly, this doesn't solve problem of identity (on which phone is a certain certificate, who is the actual user), doesn't prevent scores from being tampered (it is not third-party to worry about, it is the legitimate certificate holder that will change the score) and adds considerable hardware requirements.Simplest way: When sending a score, compute a hash over IP, contents of the map, username, actual score and perhaps some other info. Perhaps SHA. Then simply send a regular post with this data: "leetdude,48324,a9syothw4ao7yasq348398ahlt34unf5l4yta4yot"On server, compute the same to verify submission is legal.This can be cracked by reverse engineering the executable. But if someone goes through that much effort, they will also obtain the digital certificate and use that to send false data through all that fancy encrypted channel. And since TLS is standardized, they'll just use existing libraries, perhaps plain internet browser with imported certificate.   ;Quote:Original post by AntheusThis means that each individual installation (copy/iPhone) will need to have a unique digital certificate.Who will issue them, who will track them?Are you sure? I mean, if that's true, then my idea is not factible. As you say, I need another authentication way.Quote:Original post by AntheusSimplest way: When sending a score, compute a hash over IP, contents of the map, username, actual score and perhaps some other info. Perhaps SHA. Then simply send a regular post with this data: "leetdude,48324,a9syothw4ao7yasq348398ahlt34unf5l4yta4yot"That should not work beyond a router, actually, using REST (or SOA) you use HTTP avoiding routers (changing IPs).I think your idea is good, but not factible uising REST, because IPs could be different, and then, legal scores could be misinterpreted as a ilegal scores. What do you think?Thanks.   ;  Even without IP, there is still other information from which the hash can be generated. It's just about security through obscurity.   