loicteixeira / gj-unity-api

[MOVED] Game Jolt API wrapper for Unity.
https://github.com/InfectedBytes/gj-unity-api/
MIT License
16 stars 13 forks source link

Add a remember me option to the Sign In window #18

Closed loicteixeira closed 6 years ago

loicteixeira commented 9 years ago
InfectedBytes commented 6 years ago

I've implemented it in my fork. I've added a rememberMe parameter to user signin. If true, the credentials are stored in the PlayerPrefs under a key defined by a string in the settings. The UI window will automatically try to fill the text fields with the stored data (if they exist). For security I encrypt the credentials with XTEA and an user defined key. It is not as secure as AES or TripleDES, but secure enough. XTEA is super slim and by using it we don't have a dependency to the cryptography namespace, resulting in a smaller build size. Of course we can't store the data 100% secure (even if we would use AES), because we have to built the key into the application and therefore a real attacker would be still able do get the credentials, but since it is "only" the user name+token (and not his password), it isn't that bad. RememberMe Branch XTEA implementation

loicteixeira commented 6 years ago

I had a chat about the security aspect of storing the credentials with some other developers (some being the maintainer of the GameJolt API plugin of their game engine of choice) on the GameJolt Discord channel a while ago, and the consensus what that it doesn't need to be that secure. Obviously the more secure the better, but the API uses the user's token (which can be revoked at any time), not its password.

I'm not too familiar the XTEA but I'll have a look. Please make a PR so I can review the changes.

InfectedBytes commented 6 years ago

can be closed