I have a small game that I would like to keep track og global hiscores for. The basic is simple: username and score is submitted to a server for storage and later polling. However how do I ensure that these scores aren't faked?
Obviously, just accepting a submitted user+score blindly will allow people to telnet in their desired score. To combat this, I've thought up two approaches:
Checksumming - In addition to the score and the username, the application sends a checksum of the two using an obscure algorithm and salt. If the same checksum doesn't add up, the server will reject it. However, how easy is it to reverse engineer the checksumming used, considering that this is an android application?
Submitting the entire game - In addition to user+score, the steps taken to reach the score is also sent. The server then emulates the game to see if the steps result in the same score, and if not, rejects it. I consider this to be the safest, but for some types of games this can be very hard to do, as the factors are far too many.
Is there a middle road? Are there any other methods worth considering? It's not like this is vital to national security or anything, but I would prefer if the users aren't left with "HackedYourGame: 999999999 points" on top of the list.