Comments on: The Flash Game Micro Transactions Debate

By: A Freelancer’s Flash Bash [4] | Freelance Flash Games News

A Freelancer’s Flash Bash [4] | Freelance Flash Games News — Wed, 22 Jul 2009 22:42:22 +0000

[...] a virtual world he’s been working on called WebbliWorld. There’s also a fantastic post on microtransactions and their ramifications. Change is brewing in the flash [...]

By: Freelance Flash Games

Freelance Flash Games — Mon, 13 Jul 2009 19:12:09 +0000

Great article. Gives a lot of insight into what could go wrong with microtransactions. We’ll have to hope for the best, although I could see hacking being a problem as you mentioned. Actionscript isn’t exactly known for being tough to hack. Any idea how the big virtual worlds such as WebKinz deal with this problem?

By: 8bitjeff

8bitjeff — Wed, 08 Jul 2009 04:12:14 +0000

Nice write-up, rich! Security can be a joke with no real money changing hands. It will be a disaster if a simple TamperData or Charles user pops open his tool kit and finds a way to insert his “craft” into the http request / response.

By: Video | Enjolt.com | Innovate for Success

Video | Enjolt.com | Innovate for Success — Tue, 07 Jul 2009 18:58:36 +0000

[...] I hope you will enjoy it!! Related Games: Reflection Reflect the laser to hit both targets The Flash Game Micro Transactions Debate – photonstorm.com 07/06/2009 I read this thread on the Mochi forums today where a portal owner was [...]

By: Paul

Paul — Tue, 07 Jul 2009 10:27:11 +0000

I disagree with the issue of the Portals having to trust the game dev. I have yet to see a single instance of a game dev with a popular game deliberately screwing the Portals. There are many examples of Portals screwing the devs however. MT will evolve the Flash space very quickly. There is lots of money out there and those that tap it will make 10x what they were making in ad revenue. And the games will follow suit in size and quality. The Portals that do not take the latest MT enabled games will suffer a huge quality shortfall in their content. I expect most of the larger ones to roll their own MT system or deal directly with Mochi / GamerSafe.

The Portals should get a cut on the revenue if only to incentivise your game on their site. The try/buy sector has worked that way for years.

By: rich

rich — Tue, 07 Jul 2009 09:59:27 +0000

They are not snake oil because the benefit they give you is real, albeit virtual.

But I do appreciate where you are (ineloquently) coming from.

By: dogs

dogs — Tue, 07 Jul 2009 09:35:49 +0000

Microtransactions are the worst thing to come to games EVER!
Take EA for example, paying £1.50 for a stat boost in a golf game, WHAT THE FUCK!

Fuck microtransactions, and fuck anyone who puts them in their products, its fucking snake oil.

By: rich

rich — Tue, 07 Jul 2009 01:48:19 +0000

Hi Bob – Yes I did make it clear that I expected all transactions / data-collection to happen server side. That doesn’t mean there aren’t server code related security issues though (it just means they haven’t been found yet.)

I trust there is a comprehensive audit trail going on behind the scenes? so that anomalous requests from rogue/hijacked games can be pattern matched and identified promptly before the problem gets out of hand and too many customers are affected? There is a very real concern that a popular game could be downloaded, hacked to replace the Mochi Coins part with a phishing site, and spread. That’s just one attack vector off the top of my head.

I think the system and concept behind it is excellent (as is GamerSafe), I just truly hope that these kinds of issues have been considered and addressed already, because sadly they *will* happen.

By: Bob Ippolito

Bob Ippolito — Tue, 07 Jul 2009 01:11:00 +0000

“Let’s face it, Mochi doesn’t exactly have the highest security track record going. Their Mochi API is so easily hacked that script-kiddie programs exist to automate this process.”

The script-kiddie programs don’t attack the Mochi API, they attack the games by editing memory while the game is playing. Not many games have defense against this, although we provide some classes that developers can use to prevent it.

MochiCoins never collects secure information in-SWF, and the digital goods are all server-side.

By: rosedragon

rosedragon — Tue, 07 Jul 2009 00:00:26 +0000

whoooaa this article sure knock the head. You really aware what it takes, good post photonstorm!