5 ms·
> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before
by Negitivefrags 14y ago
> The proper way to implement a promo code is logical: when the user attempts to apply a promo code, the server checks, has the user used this promo code before? by querying SELECT FROM transactions WHERE user_id = current_user AND promo_code = “OS3874XVC”. If the result set is empty, then the user hasn’t used the code, and everything’s good to go.
Be very careful here, it's not as simple as it looks. If you don't do the correct locking it is very easy to have timing attacks which allow keys to be used twice.
We learned this the hard way after posting a one use key for our game on 4chan. A thousand people rushed to try the key and around 100 people managed to get in using it.
- ams6110 14y agoIt really isn't as easy as it sounds, is it? A better approach might be to UPDATE promo_codes SET used = 1 WHERE ... AND used = 0, and then check that one update occurred. Or if your db supports it, SELECT ... FOR UPDATE OF ... and then update if the code is not yet used. You want the check and the update to occur atomically. And this varies depending on databases, for example in Oracle even if you explicitly begin a transaction, a select does not lock the row (unless you specify FOR UPDATE OF) so if you do the check and the update in separate statements, you still have a race condition).
- Negitivefrags 14y agoI actually wasn't personally involved in the solution, but I believe that we went with something involving SELECT FOR UPDATE.
- deleted 14y ago[deleted]
- nvmc 14y agoJust out of interest, what is your game?
- Negitivefrags 14y agoHere is our site: http://www.pathofexile.com/ http://www.pathofexile.com/
- nvmc 14y agoAh, I bought a beta key a while ago. Nice to see local developers making a mark. Certainly the best hack/slash game out right now.
- cheald 14y agoThanks for a great game. PoE has made me a happy gamer.
- danneu 14y agoMy friend recently linked me to Path of Exile's expansive passive skill tree. Pretty inspiring to play around with that without even knowing anything about the game. I've pined for that kind of skill tree since I was a kid. I recommend anyone to check it out: http://www.pathofexile.com/passive-skill-tree/ http://www.pathofexile.com/passive-skill-tree/. It looks like a star map.
- numair 14y ago... That's not a timing attack. A timing attack involves measuring the time taken to return an invalid response to a password attempt and, given enough tries, figure out the password based on this. It usually takes advantage of the way that string-matching code is written in libraries. Preventing this is not nearly as simple as you may think; for example, recent research shows that over a long enough period of time and enough attempts, it is possible for an attacker to factor network latency into their timing analysis. What you're describing is not the result of an "attack," but rather the result of code that wasn't designed to deal with database locking. You weren't hacked, nobody attacked you; you just didn't design your system to deal with tons of people trying to write/read the same thing at the same time. Again, it's a tricky problem, so it's understandable (and a lot of people would consider dealing with such issues to be "premature optimization"). I will also note that the OP needs to stick to his MySQL Cookbook rather than commenting on coding practices for large-scale, heavy-usage web applications. His code suggestion is terribly naive, arrogant, and embarrassing. Yes, EA made a mistake; no, you have no clue what the hell you are talking about.
- mherdeg 14y agoYeah, time-of-check-to-time-of-use attacks are not usually described as "timing attacks" but instead just called TOCTTOU. In this scenario you might also say "exploiting a race condition".
- trhtrsh 14y agohttp://ycombinator.com/newsguidelines.html http://ycombinator.com/newsguidelines.html