Android Question Online DB Security (mySQL)

[wonder]

Hello DB gurus!

In my game HyperBloX, I'm using an online DB to store the highscores.
Everything works fine, no complaints here.

There is one thing, however, I'm not really comfortable with.
The DB password is stored in Process_Globals (obfuscated).
In theory, any user who obtains the password may access it and drop all the tables without effort.

Is there another way to do it, or at least a "read-only" mode for the DB?

I'd like to have a secure environment where the user will have access only to his own data, in "read-only" mode.

 

[Erel]

Are you connecting to the DB directly from the Android app (not a good practice)?

 

[wonder]

Hi Erel, thanks for the quick response.
Yes I am. What's the good practice method?

 

[Erel]

It is better to connect to a web server (middleware) that connects to the database server. It is safer and also more maintainable (you can change queries or change your credentials for example).

You can use RDC (or jRDC) for that.

With RDC you define the possible commands in the server. The user can never execute an undefined command.

 

[wonder]

So would it be possible for my webserver interface to be written in B4J and the DB an SQLite DB?
App <=> WebServer (B4J) <=> SQLite DB

If so, would I have to host it at home in my personal computer?

 

[DonManfred]

The DB password is stored in Process_Globals (obfuscated)

Have a look at the F5Steg library from @Informatix (part of the Pro bundle)
Together with his security guide you can save your code and password.

 

[inakigarm]

So would it be possible for my webserver interface to be written in B4J and the DB an SQLite DB?
App <=> WebServer (B4J) <=> SQLite DB

If so, would I have to host it at home in my personal computer?

I think you can have sqlite as db on B4j server; the b4j server can be on your Pc (need to ve accessible from internet if you want to be accessed bt your hyperblox users) or better, on a Vps (may@be linux) system

 

[Erel]

So would it be possible for my webserver interface to be written in B4J and the DB an SQLite DB?
App <=> WebServer (B4J) <=> SQLite DB

Yes. RDC (or jRDC) works with SQLite databases.

https://www.b4x.com/android/forum/threads/31616/#content

You can host it on any computer you like.

 

[wonder]

Sounds like an interesting challenge to me and another opportunity to learn something new!
Thanks!