{"action":"created","issue":{"url":"https://api.github.com/repos/TAD-SEC/Generation_2/issues/2","labels_url":"https://api.github.com/repos/TAD-SEC/Generation_2/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/TAD-SEC/Generation_2/issues/2/comments","events_url":"https://api.github.com/repos/TAD-SEC/Generation_2/issues/2/events","html_url":"https://github.com/TAD-SEC/Generation_2/issues/2","id":54695791,"number":2,"title":"Client-Server Data Transfer Protocol - Spoofing, Tampering & Interception","user":{"login":"Diitto","id":8968477,"avatar_url":"https://avatars.githubusercontent.com/u/8968477?v=3","gravatar_id":"","url":"https://api.github.com/users/Diitto","html_url":"https://github.com/Diitto","followers_url":"https://api.github.com/users/Diitto/followers","following_url":"https://api.github.com/users/Diitto/following{/other_user}","gists_url":"https://api.github.com/users/Diitto/gists{/gist_id}","starred_url":"https://api.github.com/users/Diitto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Diitto/subscriptions","organizations_url":"https://api.github.com/users/Diitto/orgs","repos_url":"https://api.github.com/users/Diitto/repos","events_url":"https://api.github.com/users/Diitto/events{/privacy}","received_events_url":"https://api.github.com/users/Diitto/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/TAD-SEC/Generation_2/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/TAD-SEC/Generation_2/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/TAD-SEC/Generation_2/labels/help%20wanted","name":"help wanted","color":"159818"}],"state":"open","locked":false,"assignee":{"login":"CoolDoctorWho","id":4654283,"avatar_url":"https://avatars.githubusercontent.com/u/4654283?v=3","gravatar_id":"","url":"https://api.github.com/users/CoolDoctorWho","html_url":"https://github.com/CoolDoctorWho","followers_url":"https://api.github.com/users/CoolDoctorWho/followers","following_url":"https://api.github.com/users/CoolDoctorWho/following{/other_user}","gists_url":"https://api.github.com/users/CoolDoctorWho/gists{/gist_id}","starred_url":"https://api.github.com/users/CoolDoctorWho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CoolDoctorWho/subscriptions","organizations_url":"https://api.github.com/users/CoolDoctorWho/orgs","repos_url":"https://api.github.com/users/CoolDoctorWho/repos","events_url":"https://api.github.com/users/CoolDoctorWho/events{/privacy}","received_events_url":"https://api.github.com/users/CoolDoctorWho/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-01-18T13:01:21Z","updated_at":"2015-02-01T10:48:54Z","closed_at":null,"body":"I have studied many different security-based scripts that transfer data from the server to the client and vice versa, and I have not found a clean way of communication...\r\n\r\nSpoofing can be dealt with, but tampering and interception are bad factors.\r\n\r\n1) I had the idea of only letting certain scripts commune, but I believe that RemoteFunctions can be replaced.( return )\r\n\r\n~~2) If I used StringValues, the delay in replication could allow others to grab and change the value of the stringvalue before the client received it.~~\r\n\r\n~~3) If, by chance, someone was dedicated enough to grab the data and bruteforce it, and they found what it equaled, they could catch all other data transfers.~~\r\n\r\n4) If I use RemoteFunctions, can't the client just intercept it and have it return something else entirely?\r\n\r\nEDIT: \r\n\r\n(2) is dealt with.\r\n\r\n(3) is false, for the key changes constantly.\r\n\r\nAs a supportive to (1) and (4) for einsteinK and Pkamara, \r\n\r\n```lua\r\n--// Server\r\n\r\nlocal Port,Socket='1375CB86EC04FB7D2BF',Instance.new('RemoteFunction',game:service'ReplicatedStorage');\r\nSocket.Name='InternetSocket';\r\nwait(2);\r\nSocket:fireClient(NoobPlayer,...);\r\n\r\n```\r\n\r\n```lua\r\n--// Client\r\nlocal socketIP,InternetSocket='1375CB86EC04FB7D2BF',game:service'ReplicatedStorage':findFirstChild'INTERNET_PROTOCOL';\r\n\r\nInternetSocket.OnClientInvoke=function()\r\n\t--// Do stuff...\r\n\treturn Stuff;\r\nend;\r\n\r\n```\r\n\r\n```lua\r\n--// Harmful Script\r\n\r\nwait();\r\nscript:destroy();\r\n\r\nlocal Target=game:service'ReplicatedStorage'.INTERNET_PROTOCOL;\r\nwhile(wait())do\r\n\tTarget.OnClientInvoke=function()\r\n\t\treturn 'LOLOLOLOLOL';\r\n\tend;\r\nend;\r\n\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/TAD-SEC/Generation_2/issues/comments/72359959","html_url":"https://github.com/TAD-SEC/Generation_2/issues/2#issuecomment-72359959","issue_url":"https://api.github.com/repos/TAD-SEC/Generation_2/issues/2","id":72359959,"user":{"login":"einsteinK","id":6892280,"avatar_url":"https://avatars.githubusercontent.com/u/6892280?v=3","gravatar_id":"","url":"https://api.github.com/users/einsteinK","html_url":"https://github.com/einsteinK","followers_url":"https://api.github.com/users/einsteinK/followers","following_url":"https://api.github.com/users/einsteinK/following{/other_user}","gists_url":"https://api.github.com/users/einsteinK/gists{/gist_id}","starred_url":"https://api.github.com/users/einsteinK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/einsteinK/subscriptions","organizations_url":"https://api.github.com/users/einsteinK/orgs","repos_url":"https://api.github.com/users/einsteinK/repos","events_url":"https://api.github.com/users/einsteinK/events{/privacy}","received_events_url":"https://api.github.com/users/einsteinK/received_events","type":"User","site_admin":false},"created_at":"2015-02-01T10:48:54Z","updated_at":"2015-02-01T10:48:54Z","body":"Yes, that's possible, hence the algorithms stuff.\r\nIf the client doesn't return the right response, assume it's taken over, and create a new socket."}}