Secure version of "Player.Prefs"

Archived Forums Questions & Answers
1

Note …

sure enough this one has appeared in the Asset Store

http://forum.unity3d.com/threads/157606-Secured-PlayerPrefs-Release

Player.Prefs is, naturally enough, unusable on any realworld game in the app store - kids can of course trivially edit anything you keep in there.

I have no problem programming around this problem when I sober up, but, it’s hard to believe there isn’t a popular, stable, solution for this ?

I mean you can’t use it - it’s essentially a test/dev tool. Any thoughts?

(I always feel bad criticizing Unity in any way … they’ve achieved SO MUCH it’s a bit mean to arrive on the scene and point out “oh you don’t have such and such?” Just the other day I was complaining that there isn’t a load-then-continue concept for scenes (“How can you have a game engine without that?!”) but … they added it in the latest!)

Anyway, any common solution for secure paradigm preferences ?? Cheers!

I made a little script which encrypts the player prefs, it's not the most elegant solution, plus anyone can crack it eventually. Nothing will stop cheaters/exploiters/hackers.

 –

> Nothing will stop > cheaters/exploiters/hackers Use DestroyImmediate to break the game after you detect a hack :P

 –

2 Answers

2
2

I think the general advice is to not store anything on the client that you don’t want the client to muck about with. So, push the data-that-must-be-secured to a server. You can of course continue to use player prefs, but validate what the client has with what the server has, and, if anything is different, believe the server and not the client.

These days everyone just uses AntiCheatToolKit from the asset store, until Unity finally adds secure prefs.

 –
3

There Many under System.Security.Cryptography;

Example:

CspParameters cspParams = new CspParameters();

cspParams.KeyContainerName = "MyKey";
var provider = new RSACryptoServiceProvider(cspParams);

byte[] encryptedBytes = provider.Encrypt(
    System.Text.Encoding.UTF8.GetBytes("Hello World!"), true);
foreach (byte encryptedByte in encryptedBytes)
{
    Debug.Log(encryptedByte);
}

string decrypted = System.Text.Encoding.UTF8.GetString(
    provider.Decrypt(encryptedBytes, true));
Debug.Log(decrypted);

Impressive! I so admire people who are good at .Net. Do you know, would this work perfectly reliably in Unity on most platforms? (desktop, android, ifone, etc) No gotchyas? Cheers!

 –

Gotchas? Hmm maybe I dont develop for Mobile ^^ MD5 and SHA1 should work on all devices. I normmaly use Bcrypt its pretty good scalable on the Performance Side. You can use different Crypts for Different Purposses just keep your Keys, Salts, etc identical so it dont get more confussing ;P

 –

I suggest you take a look at msdn they got pretty much everything there with example! MD5 http://msdn.microsoft.com/en-us/library/system.security.cryptography.md5.aspx Overview http://msdn.microsoft.com/en-us/library/9eat8fht.aspx and Bcrypt http://bcrypt.codeplex.com/

 –

I see, so where you have said: provider = new RSACryptoServiceProvider(cspParams); one could instead have provider = new SHA1CryptoServiceProvider(cspParams); or provider = new MD5CryptoServiceProvider(cspParams); orir indeed the others on the left in the doco you provided. thank you very much! Magic.

 –

magic answer, thanks

 –