Security in Network/Internet Data Interaction

[DracisLooby]

I'm having trouble finding a method for secure data to be transferred over a network, or the internet, such as user credentials, or "sensitive" data,

Interaction with server side coding like PHP/Python/MS.ASP is easy, making it secure is not, there is no reliable way to safely transfer ANY data over HTTP, because everything is sent over plaintext, and can easily be sniffed by something like WireShark no problem.

The obvious solution would be HTTPS, but GET object does not support SSL, so you would have to rely on the Download object, but then you are limited to GET requests, instead of POST, which is essentially just as insecure.

My second method would be to use Sockets, and use Hash Encryption of text data, but it can also be sniffed just as easily, and is not nearly as cross-platform.

So, I've become stuck. I have no idea where to go from here, other then writing a new/modifying a current object for this specific task, which is, atm, beyond my skill set.

Any help would be appreciated, as well as any possible ideas I could work off of.

[DracisLooby]

Bump?

[DracisLooby]

Last bump, taking it for no-one has any ideas/no interest.

[StingRay]

Which Platform are you developing for?

[ouly]

Hi DracisLooby,
I didn't had to work with this kind of problematic. The only thing I can say is that having only HTTP is annoying but not hopeless. Inside HTTP, you can just drop some cyphered data and define your own kind of protocol. If you search on the forum, there were some discussions on cyphered data exchange between MMF and PHP (especially using Blowfish at the time). It's not so easy but possible
ouly

[Konidias]

Have the client handshake with the server first?

1. Client sends some numbers to server (plain text)
2. Server receives numbers, generate its own random numbers, then sends the generated numbers back to client. (plain text)
3. Now using the two sets of numbers you can create a hash that the client and server can both use.
4. Send encrypted data back and forth, use the hash to decrypt.

Of course, sure... someone could intercept the numbers between the client/server... but then they'd also need to be able to know what system you have set up to calculate the hash, and then what encryption is being used, etc...

It really depends on how extremely secure this needs to be. Obviously nothing is ever 100% secure... so you only really need security to a level that you feel comfortable with.

[DracisLooby]

Hey, thanks all for the replies! Logic based security is good for less sensitive data, but high sensitivity data, like real-user information, should never be sent over HTTP, even when the content itself is encrypted.

Even with a 'random' numbering system, you would have to determine the legitimacy of the numbers based on a existing chart, or predictable key, to prevent someone from just intercepting, and either changing the data, or even emulating the real server.

The combination of creating a predictable, yet non-patterend salt, as well as a custom encryption setup, would take more time then just writing a extension that supports HTTPS/SSL/TSL.

Speaking of which, I decided to finally go ahead and do just that, writing a cURL extension using libcurl with SSL support for windows, but because cURL is cross platform, writing plugins for iOS/Android would not be difficult (and Mac when that point is met).

More updates on that as it progresses. Thanks for all the good ideas though!

[SirEatAlot]

I use AES encryption to submit and recieve data over HTTP between MMF and a PHP server. It works great and should be very secure, even if the connection itself is not encrypted, AES is used by many goverments to encrypt higly classified data. http://en.wikipedia.org/wiki/Advance...ption_Standard

Should be enough for most game centric uses at least!