0

I'm making a online game where I need to preserve some things for the players so each will have an account. However, I don't want to get into the business of storing user created passwords since that's dicey these days.

So I was thinking what's the point of even asking for the user to create a password for most apps these days? With the advent phone/email verification why not just have the user enter their e-mail address and then have the server create a temp pw good for 15 mins and then send it to that email address and have the player copy/paste that into the game to login? A phone number could be used as well. This is usually step 2 in a 2-step auth these days anyway so since it's, I'd say, more secure than the user generated pw, why not just make that the only step?

I get the slight inconvenience but I think people are getting over that these days because of security. This seems like it passes the buck to the email provider and their security which will be better than what most people with an app come up with. To prevent someone who knows your email and the app from spamming the system could track last temp pw try and only allow so many in an hour.

Thoughts?

Improve this question
6
  • if i guess your email password I get access to all your other services
    – Ewan
    Mar 4, 2018 at 18:07
  • @Ewan Hackers guessing people's email passwords is happening right now outside of my game existing. That's why this seems like a better method. It puts the validation onto the email provider.
    – user441521
    Mar 4, 2018 at 18:20
  • If you think about it I use google auth to access this site which is the same situation. If someone steals my email pw they can now log into any site that allows to use google auth which I've previously allowed. No difference.
    – user441521
    Mar 4, 2018 at 18:43
  • 1
    I guess the problem is A: its an impossible question to answer because its about the future. B lots of apps use openid facebook/google tokens yes, but thats not quite what you have asked. C if everyone did it it might break
    – Ewan
    Mar 5, 2018 at 15:19
  • 1
    This is what OpenID and OAuth are designed for, and those are much easier processes from the user's perspective. I'd suggest using one of those instead, just for the sake of simplifying things for your users.
    – Jules
    Mar 5, 2018 at 18:36

1 Answer 1

Reset to default
1

There are a couple of problems with your approach, although I do believe it's a better idea than storing passwords incorrectly, which is very negligent.

As a user I would feel annoyed that I've got to go check my email each time I want to log in. Not only that, but it seems quite unprofessional. That might not be a problem since is a game, but anyways.

Another problem is that sending a couple of mails is not that hard. But if you happen to get a big user base you'll start dealing with problems such as your emails being detected as spam, your email sending server might get blacklisted, if you use eg Gmail, it might block you after sending a couple hundred emails.

So my thoughts are that it looks as a bad idea, not the worst, and it might get more complicated if this grows a lot.

Possible solutions: - If it is a browser game use a cookie based approach and store the information of the game in the client pc, maybe even encrypted, so that the user is not able to cheat you. If the user wants to change to another pc/browser, you can offer him to copy this data and paste it on another browser to continue where he left. If I'm not wrong, this approach was used at Cookie Clicker, a browser game that was relatively popular.

  • Probably the best thing: if it's a browser game or not, use a third party auth and let them handle it. Be it Google, Facebook, Auth0, etc. In this way you'll trust them to store the passwords correctly and they'll let you know. The bad thing is this might charge you after you reach an amount of users, as an example for Auth0 you get 7,000 free active users & unlimited logins. Then you've got to pay.

  • Bad idea if you don't know what you are doing: Accept user generated passwords and store them correctly, activate the account via email to check that the user used its real email and allow password reset via email. This might really hard to get right and really bad is you mess up. Even the big companies messed up at this one.

  • Mixing the last two suggestions. If a user prefers to authenticate using Facebook let him do it, if he prefers to make up a password let him do it.

Improve this answer
5
  • It's a desktop game but thank you for your thoughts on this. I have mixed feelings on going to the email to get a token being an issue. 2 step auth is becoming popular and while that has you going to your phone most of the time, it's a very similar user experience. I personally do 2 step auth on everything because it's more secure and I always have my phone on me. The thing I like about the approach I explain is that everyone has an email account so it's usable by everyone. I don't even want to give the option to store passwords. I'll take the hit if that deters a person.
    – user441521
    Mar 6, 2018 at 17:56
  • I should note this is a PC game only. Not a console of mobile game so people are sitting at their PC's playing so that's why I feel it's not that inconvenient to open their emails and copy/paste the code into the game client, and it's just as secure as OpenID since at the end of the day it's the users email account to validate. The cost of emailing out is an interesting thing to consider though. I'll have to dig into that.
    – user441521
    Mar 6, 2018 at 18:06
  • @user441521 Depending on how massive this game is, it can be a challenging thing to send an email each time. You seem to like your idea, it doesn't look good IMHO, it is not what a user would expect, it looks sketchy, amateur and even though 2 step auth is popular, it doesn't necessarily mean that you have to go to the 2nd step each time. Usually the first time I log into a site on a new device I've got to do the 2nd step auth. If every time I log into my bank account I'm forced to verify it on my phone I would personally hate it. But that's me. Good luck with your game!
    – Maximiliano
    Mar 8, 2018 at 0:58
  • Someone was mentioning because it's a desktop PC game storing a session token locally that expires maybe weekly or monthly (stored on server as well obviously). That's an option. I counted the other day and I have 48 passwords to apps/sites/games/work etc. 48! I have to assume average is around 20 which is still a lot. Nobody is remembering 20 different passwords. So people either reuse pw's or have a scheme. Both which are highly insecure. It sucks that we're sort of forced to be insecure because of the things we want to do/read/enjoy. This does help avoids that.
    – user441521
    Mar 8, 2018 at 16:28
  • The thing I'm finding interesting and I'm not sure if there is an age cutoff here, but my phone is always on me. It's easier for me not to have to remember a password (1 of 48!) and just enter in a 6 digit code to login that I got texted to my phone or emailed to me since my phone is right in my pocket.
    – user441521
    Mar 8, 2018 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.