Password protection

Not sure this is what you''re looking for, but here''s what I know. Passwords are typically stored only in an encrypted form and never in their original, plaintext form. When someone attempts to log in and enters their password, it is first encrypted and then the result is compared against the stored version. Hope this helps!

-Glyph

Lookup "one way encryption", as said above you encrypt the passwords as they are recieved, and then compare them against stored encrypted passwords. Since the function is one way, even if you steal the database you still can''t login (you need the unencrypted password). Windows and Linux both use this to store passwords (since if you stored passwords in their original form what is to stop someone from booting from a CD and reading the file). The only advantage to stealing the database is that it makes a brute force attack easier (instead of trying many passwords on your server, which you would program to block repeated login attempts, they can try encrypting every possible password and comparing it to the file until they find a match. There are several tools designed to do this for Linux password files)

If you''re looking for a general solution to encryption for sensitive data, it goes something like this:

Passwords: One way hash, usually using a time seed.

Secure communication: Public key/Private key encryption to pass a one time secret key, stream or (more commonly) block cypher using the secret key.

Data security (local): stream or (more commonly) block cypher using a user-known private key (oftern kept for some time).

In general, online things like MMORPG''s do data security through firewalls rather than encryption, just using passwords for access (only real encryption). I''m not aware of any MMORPG''s that actually run encrypted data streams (except for billing).

Most likely setup:

Firewall to block DoS, etc. etc. and mediate.

One or more exposed web contact points / servers on the other side of the firewall (bastion hosts).

Seconary firewall to block access to inner network (only bastion hosts can ever reach this anyway).

Some internal architecture of systems with databases, etc. etc. which run the game world(s). Internal servers hold sensitive data. Users never get direct access.

Dunno if that answers your question, but it might help a bit.

I would hazard to guess that most MMORPG''s are actually full system designs, not just software, and include such things as firewall deployments, etc. as part of their design.