Need to encrypt javascript die roller output

[googlegroups]

Hi, I'm making a javascript program for rolling dice for a roleplaying
game that's played in a forum. The die roll gets generated, gets stored
as text in a hidden form field, and then gets written to the mySQL
database upon form submission.

What I want to do is prevent cheaters from being able to create their
own die roll, and the best way I've come up with to do this is to
encrypt what gets stored in the hidden form field. However, since all
javascript code can be viewed by the user, they can see what key I'm
using.

Any suggestions on what to use as a key that a user cannot get access
to? Data hard-coded into a java applet, perhaps? Even that might be
hackable by someone a tool capable of inspecting javascript variables
at run-time.

Is it simply impossible to prevent cheating if my code is in
javascript? There must be some way to secure hidden form fields to
insure that their content is code-produced only. Is there? Or is there
some other way to make a cheater-proof javascript die roller I haven't
thought of?

[googlegroups]

I question whether this actually solve your problem, but perhaps only

because the problem hasn't been stated precisely yet :)

I guess the precise problem is simply that I want to make a
cheater-proof die roller as a forum mod. (The forum is SMF, BTW.) I
want to do it in javascript for speed.

>If different results, what prevents the user from reloading until
he gets a good number?

As long as he wanted to store it in a db serverside, he should have
no problems maintaining state during the session serverside.

Yup, so a user who keeps rolling will have each roll put into the db.

>Yep, here's one cheater-resistant way. The CHAP protocol uses a technique
to prevent such a man-in-the-middle attack. And using that, no, there's no
cleartext password exchanged over the wire.

But what prevents the player from fixing the die roll itself.

Secure transfer is not the problem, but preventing him from substituting
Math.random with function(){retu rn 1.0;} is.

Thanks for the info about CHAP. It looks very interesting, but yeah, I
think it's not good enough in this case. The die roll needs to be
generated server-side or else it will always be vulnerable to
client-side manipulation.

With AJAX, I can dynamically load a simple php file using javascript.
This simple php file will simply generate a random number, insert it
into the database, and return the result to the calling javascript
function. Even if the user manipulates this, he can't (theoretically)
ever manipulate the database.

To see what I have so far, check out:

http://herbaloutfitters.com/dierolle...;num_replies=2

Click the two red dice to open the die roller popup.

Kanon

[Lasse Reichstein Nielsen]

go**********@he rbaloutfitters. com writes:

With AJAX, I can dynamically load a simple php file using javascript.
This simple php file will simply generate a random number, insert it
into the database, and return the result to the calling javascript
function. Even if the user manipulates this, he can't (theoretically)
ever manipulate the database.

True. It seems you can roll without being logged in, but if you record
the client ip address wih the roll, you should still have a clue
whether someone is rerolling for a good roll.

On the other hand, if one post contains multiple rolls of the same
type, the player can still rearrange them to his needs, like using
his magic arrow for the second attack, not the first, decided after
rolling both attack rolls.
Another solution could be to add a tag, e.g.,: [dice=5d4+5]damage[/dice]
which is expanded server side into "damage (5d4+5=17)"
You can even add extra parameters to show individual die rolls, e.g.:
[dice=10d6,show]fireball[/dice] becoming
"fireball (10d6=4+2+4+6+2 +1+3+2+6+6=36)" . I still think this is a lot
simpler than using extra server calls and trying to control the user.

/L
--
Lasse Reichstein Nielsen - lr*@hotpop.com
DHTML Death Colors: <URL:http://www.infimum.dk/HTML/rasterTriangleD OM.html>
'Faith without judgement merely degrades the spirit divine.'

[googlegroups]

Lasse Reichstein Nielsen wrote:

True. It seems you can roll without being logged in, but if you record
the client ip address wih the roll, you should still have a clue
whether someone is rerolling for a good roll.

Actually, I just configured that test forum to allow guests to post
(and therefore roll dice). In actual use, only members of a game will
have the ability to post in it. This is yet another mod I'm working on.

On the other hand, if one post contains multiple rolls of the same
type, the player can still rearrange them to his needs, like using
his magic arrow for the second attack, not the first, decided after
rolling both attack rolls.

Not once I actually make that reason textbox work. I'll put a note to
the players saying to be specific about what the roll is for.

Another solution could be to add a tag, e.g.,: [dice=5d4+5]damage[/dice]
which is expanded server side into "damage (5d4+5=17)"

Problem with this is that it's nice to know the result of your roll
while posting, not just after. For example, if the GM tells you to roll
vs. your IQ to detect something, you can do the roll and respond with
your character's actions based on whether or not you succeeded.

Another member of the team I'm doing all this with (see
http://www.ayeka.net/smf/index.php?board=89.0 for our developer's
discussion area) has made a dieroller very much like what you describe.
It's simple and it works. You can see it in action on his site:
http://forum.technodragon.net/ , but you'll have to register to get
posting (and therefore rolling) access.