Hacker News Reader

Comment by AsymetricCom | Hacker News Reader

The leaderboard is already hacked.

It wouldn't surprise me if it was since it is so easy to do, but I don't think it has been (yet).

I think the leaderboard might have been generated during development when I was playing 'single player' spawning asteroids and spaceships and shooting them. (Hold down 'o' or 'p' a bunch to get some easy targets.) It is much easier to get a high score that way, although I just noticed that you don't get points for that any more.

Since you cannot trust other peoples' scores, I think apps like this should just show you your own high score (which you can note yourself when you die for now).

Edit: (1 hour later) pwned

Yup. You can set your score to a string and it just puts the latest as highest. You can also manually rename yourself. Are all firebase apps this vulnerable?

edit* I left a message in the high score box for anybody looking for something proofy

I love Firebase but these kind of security holes make me hesitant to use it for anything serious. Is it even possible to prevent without adding an extra server layer?

well, you are exposing the database at the javascript level. If it is javascript then you can mess with it in your browser via the developer console. So if you are using firebase via javascript your application is fundamentally insecure. You cannot even put serverside sanity checks like "this person should not ask for this value" or "nobody should have a string for a score" because of firebase's limitations.

There was a time when that was true, but these days you can easily do those sorts of things using Firebase security rules: https://www.firebase.com/docs/security/security-rules.html

Aha! My only use of firebase was writing a chat application for fun back at their launch marketing push. This is good to see, and I think I might go play with it more.

I still don't see how setting security rules would prevent cheating. I would love to know how to fix this issue as I'm making a similar MMO game with Firebase.

You have obviously never tried Firebase.

So how would you prevent people from just setting whatever score they want in this game?

Reply on news.ycombinator.com