Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm making a 'Pokémon Storage System' with a Client/Server model and as part of that I was thinking of storing an inventory file on the users computer which I do not wish to be edited except by my program. An alternative to this would be to instead to store the inventory file on the server and control it's editing by sending commands to the server but I was wondering if there are any situations which require files to be stored on a users computer where editing would be undesirable and if so how do you protect the files? I was thinking AES with some sort of checksum?

share|improve this question
1  
Encrypt with checksum should work fine for something like this. You probably won't have the NSA or the like trying to crack it. You could also verify against validation codes obtained from connecting to your server as an additional check. –  jfrankcarr Sep 4 '12 at 19:26

3 Answers 3

up vote 8 down vote accepted

Logically it's impossible - if the clients computer has all the information to edit the inventory then it has all the information necessary to edit the inventory.

You can make it harder by encrypting the data and hiding the key inside your program, storing parts of the key in different places and calculating parts based on some maths is popular. But ultimatly it depends on how much time/effort they are going to put into it. If this is just a kids game then simple encryption will do - if you are doing online gambling for big $$$ then it won't!

share|improve this answer
    
Thanks for your answer, it's just something I'm making for practice, the data is completely arbitrary but I'm designing it as if it's important implementing RSA and such. –  Joel Sep 4 '12 at 20:16
1  
You might as well use whatever proper crypto library is on your platform - but the weakness is normally hiding the key. –  Martin Beckett Sep 5 '12 at 1:14
1  
This. The number one error made by noobs to security and cryptography is to think that there is some Secret Sauce® whereby they can store the key on the computer and somehow (Giant Handwave) not have it be discoverable. You can't. Period. In that scenario, anyone who seriously wants the data will get the data. –  Peter Rowell Sep 5 '12 at 3:59

I was thinking AES with some sort of checksum?

No. If someone de-complies your Software they will get the Key and be able to modify the Check Sum. The ONLY way to secure this data from being modified is store it on your server.

If you install on a Computer you don’t have control of, assume the Computers owner has access to ALL the installed source code (and can modify it).

share|improve this answer
    
Thanks for your answer, that's defiantly a good way to look at it. –  Joel Sep 4 '12 at 20:19

It's a hacking race you can't win, but you can make the contest interesting by signing and/or encrypting the data. If there's a remote server involved, the remote can do the signing and verifying.

Also, consider that you need to prevent other things than fabrication or alteration - "good" inventory files might be shared (or sold), stored and reused, or many other creative kinds of abuse.

Remember that the weakest link is the one that will be attacked. If your signing and verifying methods are good enough, the hackers will just target the decrypted/unsigned form of the data that has to exist in order for it to be used.

share|improve this answer
    
If you missed that (its blatantly obvious) than you need to do some more reading on computer security. –  mattnz Sep 4 '12 at 21:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.