Persistent Browser-Based Games Blog

Preventing voting cheaters

You know how in many game listing sites they allow games to reward users for votes by sending the game server some data when a legitimate vote is counted? Yes, that’s a very nice and easy way to get lots of votes from your players.

However, there’s a lack of security involved. If somebody could figure out what the secret voting page is where the data is sent to, they could possibly fake a vote and get rewarded automatically every day/week, depending on when the votes are reset. There’s a simple way to avoid this: give that file a ridiculous long, random name and hide it in sub-sub-sub-directories, which might be bordering on paranoia.

Here’s a simple suggestion to any game listing owners, if you read this blog: give each game owner a unique key, and send that key along when you are sending user/voting info to a game server. It’s a very simple way for the game listing to identify itself and for the game server to verify it!

To be honest, I don’t know of any cases where somebody found a way to automatically fake voting by sending POST or GET requests to a page in a game, but it is possible. This suggestion just provides a little bit of security without having to require large code rewrites for the game listing and for the game owner.