Actual content sent from game server User-generated content (Character descriptions) Assume we have to secure character descriptions Only people in the game should see them. What about phishing? What if somebody stole isoptera and replaced it with a different server? The client should authenticate the server Solutions: (all stated from client side) (TLS does all this) 1. Authenticating the server: (client) Receive certificate from server (with public key from server) (client) Make up a number, encrypt it with the public key (client) If the server replies with the decrypted value, trust the server 2. (client) Make up a key for symmetric cipher, encrypt with server's public key, send to server 3. After this, the server and client communicate with symmetric cryptography Solution from server side: We'll let clients save characters with a password Assuming more than one character per account: Type 15 (login), username and password Need a couple more error codes: Wrong username/password Characters: Each character name would be owned by a particular user Suppose n usernames and m passwords: If we say correct username, bad password: O(n + m) If we just say bad login: O(n * M)