Question

As far as I know, it’s really not possible, but I just want to be sure before I’m moving to flash.

can I make an html5 game secure enough so people won’t be able to change their score and other variables while playing?

thanks!

Answer 1

since your users can see all the source code this is a rather complex problem.
they can easily change any function or variable at runtime without your script ever knowing.
even if use a complicated signing function to validate the results.

and i am sorry but i don’t think colins way would work either. i could just change any input to make the server do whatever i want.

maybe a constant monitoring of the score thru the server would be able to detect any impossible changes. still someone cheating in the realms of “possible” results would be uncaught.

in the end i would say u can only make it rather difficult to cheat but not impossible for someone with a little bit of skill.

don’t use it for any games where u can win something by scoring the highest.

since the matter seems rather puzzling to people:

flash delivers compiled swf files, that cannot (since flash 9) be decompiled to useful.smth
so u can put a secret in there which you use to sign the score.
i.e. send the score and the md5 of score+secretkey. so the server (which also knows the key, can check it).
furthermore flash variables are not so easy to temper with (you would have to find them in ram and alter them there, which is a very complex task), while javascript vars can be easily edited using, for example, webkit developer tools

update

actually i correct myself => all swfs can be decompiled
this just leaves us with code obfuscating and “encrypting”

i guess the world is a bad place after all 😉