Wirebook › Lesson 13 of 18
How does a game know you really won?
When you win a game on your own tablet, the game itself is the referee: it watched every move, so it knows. But an online high-score table lives on the game maker's server, far away, and all it ever gets is a short message from your tablet saying "I scored 12". So what stops someone sending "I scored a million"? Play a quick game, then try to fool the server.
Who is the referee?
In a game you play on your own, your tablet is the referee. It knows where the stars were and which ones you touched, and it decides when you've won. Nobody else needs convincing. That's also why people can use cheat codes or edit save files in single-player games: the tablet belongs to them, and the only person "cheated" is themselves.
An online leaderboard is different. The server can't see your screen. All it receives is a message from your device, the client, a bit like the one in the box above. And here's the catch: anything on your device, including that message, can be changed by whoever is holding the device.
Three ways a server can check
1. Is it even possible? The simplest check. If only 14 stars ever appear, a score of 999,999 is a lie. Real games check things like "nobody can finish this level in 2 seconds" or "you can't have more coins than the game ever gave out". It catches the lazy cheats, but not a believable score.
2. Show your working. Like a maths teacher, the server asks for the moves, not just the answer. It knows where every star appeared (it gave the game the same starting number, the seed, so it can work out the same pattern), replays your taps and counts for itself. If its count doesn't match your score, somebody changed the score. Racing games do this with "ghost" replays of record laps.
3. Too perfect? A cheater can write fake moves that add up correctly. But people are slow and wobbly: most of us need around a quarter of a second to react, and never the same time twice. Taps that arrive 90 milliseconds after every single star, every time, look like a robot. This is how many games spot bots: programs that play for you.
Couldn't the game just put a secret code on the message?
Some games do: the app adds a secret stamp to each message, worked out with a hidden key, like the fingerprints in the secret-codes lesson. That stops anyone changing a message on its way across the internet (the padlock in your browser already does that too). But the key has to be inside the game app, and the app is on the cheater's device. A determined cheater can dig it out. A secret you hand to everybody isn't much of a secret.