Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support saving with encryption enabled #1851

Conversation

Pheubel
Copy link
Contributor

@Pheubel Pheubel commented Oct 30, 2023

This allows for developers to opt-into saving their data with a layer of encryption. In order to opt-in, they have to go to the settings, navigate to the Saving section and add a password to the Encryption Password field.

When setting a password, it is highly likely that existing saves made for testing become invalid and cause errors to pop up. To get rid of the errors, they can remove the files and let it set up new ones. But i would recommend to ignore setting an encryption password until exporting the game in order to make debugging easier.

Along the way i did come across some security concern when it comes to arbitrary code execution when loading variables from a file. It is possible to inject code into a save file and have it run on the end user's computer.godotengine/godot#80562

It should be noted that by making use of encryption, it becomes a fair bit harder to create a code injection, as long as the password does not get known to the attacker.

So for now I would personally recommend developers making use of an encryption password when releasing their game.

@Jowan-Spooner
Copy link
Collaborator

Hey, thanks for the implementation. It looks pretty good to me, will try to do some testing on it.
Do you think it should be a concern that we save the password in the project settings? I don't know how easy it is to edit those on an exported project, but I think after a certain point it probably doesn't matter.

Dialogic is mostly used for single-player games where cheating is of much less concern. Same goes for arbitrary code execution which, while obvioulsy bad, in this case is less of an issue, because most times cheating players would only harm themselves.

@Jowan-Spooner Jowan-Spooner added Feature✨ Approved This can be added, but is not on any roadmap yet labels Nov 1, 2023
As this was the suggested behaviour by default only exported projects will use encryption.
@Jowan-Spooner
Copy link
Collaborator

Okay I've tested this and it seems to do what it should. I've also added a setting "On (non-debug) exports only" which think should be on by default for easier debugging. It can be turned off.

Thanks for your work and patience.

@Jowan-Spooner Jowan-Spooner merged commit 96fc88f into dialogic-godot:main Nov 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Approved This can be added, but is not on any roadmap yet Feature✨
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants