How much security?

[Jackolantern]

How much security do you think is right for a non-commercial game? Should you buy an SSL certificate with a TCA (Trusted Certificate Authority) just for logins? The lowest I have found it for are $100 for a year, but the "big dogs" like Verisign start at around $800. If I'm not mistaken, using a self-signed SSL certificate is what creates that awful "We can't verify the certificate" pop-up on sites that scares away so many people.

If you are currently running a site or browser game with logins, are you using SSL/TLS, or are you just sending the username and password plain text?

[Lord Rahl]

Because all my sites take money via paypal or other such services I see little point in buying such a certificate.

[Jackolantern]

Thats true. The more I work on this, the more I am beginning to think this is over-kill just for a login system for a simple web game.

[Lord Rahl]

It probably is. You have to ask yourself what's the most sensitive piece of information you're going to hold? If it's a credit card number invest, if it's simply the password for your site...

[a_bertrand]

You can have very cheap SSL keys:
https://www.namecheap.com/ssl-certificates.aspx

8$ per year is not bad, and would give you a full SSL security even if your site would not be EV Cert.

I would personally use SSL if you have some sensitive data, yet for the login, you could do it by simply hashing the password with some keys like user IP or others on the client side, and check it on the server side again. With such tech, you would never send the password as plain text.

[hallsofvallhalla]

Oh good link. I guess we need to make a topic of "Great links" and sticky it.

[Jackolantern]

I did some looking around, and yeah, almost nobody that doesn't have payment info associated to their accounts uses SSL for logins. Pretty much no PBBG I could find does. And even if you do want to have some commercial aspects to your game, you could just use Paypal for it (probably a good, safe idea anyway) and make them worry about it. I see how it is done in node, and that is really what I was after in the first place. It is dead simple in node, btw, since you just create both an http and a https object (using your certificate and key for the https), and just use them as needed lol.

[a_bertrand]

Beside for the price which is way not over expensive, having an HTTPS does slow down your site. Encryption is not free in term of CPU, both on the client side (which as host you could care little) and on the server (which you definitively care). That's the main reason why people don't use HTTPS I believe.

[Jackolantern]

Yeah, I knew it would slow things down, and SSL is far from trivial, but I had figured it it was just used for the login and registration it wouldn't hurt too bad.

Of course, putting registration over HTTPS opens up a strong vector of attack, since you don't need an account for registration (obviously), and HTTPS can really strengthen DOS attacks since they eat up more server resources.

After review, I am forgetting about SSL for a simple game that doesn't process payments. After looking around at other sites, I couldn't find a one that protected a simple login that wouldn't lead to payment details with SSL/TLS.

Thanks everybody!