0

I'm making a mobile online game with Unity. Just like other online games, there is a login screen for entering an ID/password with TMP_InputField from TextMesh Pro. The password input field is covered with asterisks, but the value of the input field still contains the password string, so what if a hacker or malware takes this data? Is the input field secure enough? Or do I need to strengthen security in other ways?

Thanks

Peter Han
  • 1
  • 1
  • Nope... it is by far safe from security. You need to encrypt that inputfield., and store it on the seperate server(never in local devices). Try to take a look at AES 256 encryption method.. – Hikari Jul 01 '22 at 07:46
  • and to add that.. that asteriks input field is just purely for UI purposes.. and it doesnt have any no security method at all. – Hikari Jul 01 '22 at 07:48

1 Answers1

1

Well you could mimic WPF apps where PasswordBox was placed in the GUI with SecureString as the data structure. SecureString isn't perfect however, it merely shortens the time the decrypted string is accessible in memory (as opposed to a regular string which is subject to a unpredictable GC event).

Obviously you can't use WPF controls but you could easily create your own control using whichever Unity UI framework your prefer.

Note that in .NET 5+ (though from a Unity perspective technically doesn't apply) SecureString has a not recommended warning whose detail is covered here. However the debate over whether it's a good idea to deal with credentials in any app arguably still applies to Unity.

Alternatives

Generally the best security is when the application does not deal with usernames and passwords1.

e.g.

  1. Windows Authentication (though kinda pointless for games)
  2. Certificates (unheard of in gaming)
  3. Rely on an established SSO provider. e.g. XUser part of the Microsoft Game Development Kit for Unity

Signing into GDK in Unity (sample courtesy of GDK):

// Look ma, no need for passwords!
XUserAddOptions options = XUserAddOptions.AddDefaultUserAllowingUI;
SDK.XUserAddAsync(options, AddUserComplete);

private void AddUserComplete(int hresult, XUserHandle userHandle)
{
    if (!Succeeded(hresult, "Sign in."))
    {
        return;
    }

    _userHandle = userHandle;
    CompletePostSignInInitialization();
}

1 DE0001: SecureString shouldn't be used

See also