How I Cheated Mozilla's New HTML5 Game - Browser Quest | Hacker News Reader

How I Cheated Mozilla's New HTML5 Game - Browser Quest

raymondcamden.com

47 pointsGarbage24 comments

Neat! One can also just walk north without passing next to a monster, waltz into the throne room and wait until the crowd there starts killing the big boss. Chances are, you get to pick up the sword and armor in a matter of minutes.

might even be faster, but its an html5 game so you have to play with the html5 tech in it(i.e. localStorage).

As the author himself comments "To be honest, I don't think I would have done it any better. There is no player on player fighting, so my cheating only ruined the game for myself. It didn't really do anything else."

I don't know why this hit the front page, shouldn't that be a logical thing to assume when it comes to HTML5 games? That HTML5 games are not secure and in order to get what you want you just need to have some Google Dev tools skills.

No that's not the problem. This is no different than what game such as World of Warcraft have to deal with, you can't trust the client. The server should be validating the players moves, gear etc.

Sure you can hack the javascript easier than you can a compiled program but that never stopped modders.

>The server should be validating the players moves, gear etc.

Well, only if it matters. Here it just doesn't.

That's true it's just a demo but it should be clear that this is not a fault of using a browser&javascript.

It's just a demo so there's no strange at all, IMHO

Is it just me, or do the graphics of that game look extraordinarily similar to "The Legend of Zelda: A Link to the Past"? I'm not saying it is a rip-off, or that creating a clone of a popular game is bad at all. But the extreme similarity is very confusing. It's not only the graphic tiles, but also the map, the characters, everything.

The use of pixel art is very common, and well, as far as I know they wanted a Zelda like game, just because are similar dosen't mean is a copy. They weren't trying to make an original game just demonstrate a point.

It's not just the pixel art. It's the style of houses, grass, the color scheme, and the whole map. It's not that I think they deserve to be sued! But the similarity is so high, it is simply confusing to play this when you have played Zelda a lot in the past.

I never played Zelda. It reminds me a lot of the original Final Fantasy games. I thought that was what they were going for.

I think I would disagree in the similarity to LttP--not that it's not somewhat similar, but because there are games that are much, much closer to LttP, and which I still consider "different." GraalOnline[1] is one example.

In fact, I would sort of call "Zelda-style 2D top-down action-adventure game with swords, shields, and various key inventory items that each serve an overworld function" a genre (a subgenre to Metroidvania games, in particular), in the way that tower defense and DotA games are also now genres.

[1] http://itunes.apple.com/ca/app/graalonline-classic/id3432979...

My first look at it had me thinking of Earthbound, actually.

But it's not so similar that I would call it a copy of anything. How long has it been since you played LttP? Those trees aren't at all the same and the ground is much too flat.

It's probably just inspired by it. But many games have similar styles. Some aspects of it remind me of Pokemon, for instance.

You can also do this with most Flash games. A few companies encrypt the data, but in theory, the encryption key can still be reverse-engineered since it's on the client side. It just usually isn't worth the effort.

Just curious, are there any good practices that would minimize the damage?

Don't trust the game client.

Just store it on the server. There was no reason for inventory information to be hosted client-side. If the data was stored on the server and fed real-time you wouldn't have the security issue. What you WOULD have is latency issues, which is the primary issue with Node-based games (from my own experience), so that's probably why they avoided it. In a real game, that's how you'd have to do it.

The reason it is stored client-side is that it is just a demo app - there is no login, no truly persistent characters (I can't play the character I started at work from home), and no PvP.

You just have to validate everything on the server.

Am I doing something really stupid, or is this not working anymore????

Every time I tried this, chrome would "oh snap".

Watch out, we got a local storage cheater bad ass over here. Now seriously, people had cheats on games like WOW, Lineage etc witch are online (DB is online) and could cheat. The best ideea is NOT TO TRUST the client. But still is just a proof of concept and playing and not cheating was nice, 30 minutes tops to finish it (all achievements)

Reply on news.ycombinator.com