What is site lock

[sandy234]

What does site lock means. Why publishers ask for this??

Does site lock means you cant sell your game to any1 else.

[rich]

No an "exclusive license" means you can't sell to anyone else. A site lock is a left-over term from the Flash days to be honest, it just means you provide a game to the portal specifically for their one web site only, and they are not allowed to put it anywhere else. Flash games (and some html5 ones) usually had code in that checked the URL so they only ran from the agreed domain name.

[Ezelia]

btw rich, do you know about any efficient method for HTML5 sitelock ?
coz even with obfuscated code, breaking sitelocks is easy ...

[sandy234]

Do you charge more or less for sitelock version???

[rich]

Ezelia - the only thing I've seen that does it is JScrambler.

 

sandy - less (than an exclusive license, but there's no real reason why you'd ever want to sell exclusive anyway)

[@99golems]

I don't do sitelock for my games. honestly i've never had anyone ask. I suspected it was a remnant from flash game days and not entirely relevant to html5 games, and according to Rich up above apparently i was correct.

[sandy234]

what benefit does a sitelock version has to publisher??

Whats use if game isnt exclusive anyway

[Daikrys]

no real benefit, they just think its safe but its not

publishers often think some protection is useful but its mostly a waste of money

[wizardstudioz]

Obfustication is no harm but anyways it will not help in theft.

[joannesalfa]

Alternative method, use AJAX to get a file using PHP or some server side language to unblock the game which it's more secure than client side even cross-domain is not allowed to other websites.

 

Comparing domain name doesn't help because the rippers are looking all strings to change their own strings, except this method as comparing domain name would help against lazy rippers. 

[Evan Burchard]

My kneejerk response was this:

"Maybe I don't understand the technique well, but couldn't a sitelock be defeated pretty easily with an iframe?"

 

Did a bit of research and found this (okay):

http://answers.unity3d.com/questions/358990/how-do-i-sitelock-a-game.html

 

Then this (much more informative, but a tad old):

http://www.codinghorror.com/blog/2009/06/we-done-been-framed.html

 

"sitelock" relies on "frame-busting" in order to have iframe resistant html. But it sounds like a bit of an arms race.  According to the coding horror article "If an evil website decides it's going to frame your website, you will be framed. Period."

 

It also describes a link between framing and click jacking, where users click on fake links.

 

The article is from 2009 though.  Anyone know if all of this is still true?

[joannesalfa]

My kneejerk response was this:

"Maybe I don't understand the technique well, but couldn't a sitelock be defeated pretty easily with an iframe?"

 

Did a bit of research and found this (okay):

http://answers.unity3d.com/questions/358990/how-do-i-sitelock-a-game.html

 

Then this (much more informative, but a tad old):

http://www.codinghorror.com/blog/2009/06/we-done-been-framed.html

 

"sitelock" relies on "frame-busting" in order to have iframe resistant html. But it sounds like a bit of an arms race.  According to the coding horror article "If an evil website decides it's going to frame your website, you will be framed. Period."

 

It also describes a link between framing and click jacking, where users click on fake links.

 

The article is from 2009 though.  Anyone know if all of this is still true?

 

 

Better check this:

http://en.wikipedia.org/wiki/Framekiller

 

Edit:

 

If your server uses PHP, this is a good solution:

 

http://stackoverflow.com/questions/5224286/how-to-limit-display-of-iframe-from-an-external-site-to-specific-domains-only/5224410#5224410

Edited July 26, 2013 by joannesalfa

[Ezelia]

@joannesalfa the php Ajax solution or .htaccess solution will not protect anything.

for ajax solution, the hacker can allways capture ajax respons, copy the game on his server and simulate the same Ajax response.
for .htaccess solution he can access the game from an authorised domain name then copy the content ...

[Chris]

The second you offer your contets to be accessed by a user, they can be downloaded and saved as well.

You can't do anything about it - it simply works this way. Sitelocks for HTML/JS stuff is impossible.

 

Sitelocks in Flash were (partly) possible, since Flash games/files compile into a blackbox (swf).

But even SWF files can be edited and their sitelock can be removed, altough its a lot harder compared

agains plaintext javascript.

[joannesalfa]

@Ezelia I know AJAX is a client side that we cannot trust it but how do you read PHP content with HTTP and domain conditions then without echo function?

Did I mention about .htaccess? I dont think I posted about .htaccess here..

[Ezelia]

@Ezelia I know AJAX is a client side that we cannot trust it but how do you read PHP content with HTTP and domain conditions then without echo function? Did I mention about .htaccess? I dont think I posted about .htaccess here..

 

why would you need to read PHP content what PHP do is generating a response ... that response can allways be simulated even without knowing the PHP logic ... also, the ajax call can be remove from the game .

I don't see how you can protect your game this way ?!

[rich]

Got to agree with Ezelia here. Once the game is in your browser, no matter how it got down in there, it's trivial to steal really.

[Chris]

Its something different when you tie your game to serverside logics, tough!

Leaderboards, Savegames, Player Accounts, ...

 

The more the game relies on serverside logic, the harder it gets to steal and make it functional again.