Comment by jfactorial

The credentials are stored as a string so you can search the binary for a pattern matching what the credential looks like and it will be in there somewhere.

In client server architecture, the client is always untrusted. An executable shouldn't need to authenticate itself to the server. The executable should authenticate as a user or account using details provided by the person.

In cases like telemetry these endpoints usually accept unauthenticated or lightly authenticated data and perform layers of validation to prevent abuse (and are usually write/append only)

> I'm under the impression an executable binary shouldn't be easily read to find such credentials

Why would you assume that? binaries are perfectly easily readable on non-locked-down platforms.

You'd have to have a system where the executable is encrypted and a secure part of the CPU die handle decryption against a private key, and even then it'd probably be only a matter of time before someone delidded the chip to get the key.

> I'm under the impression an executable binary shouldn't be easily read to find such credentials

If the computer can read it, and you have full control of the computer, then you can read it. Physical access is game over. Even if they encrypt it and put the encryption key in an HSM (probably not possible on an arbitrary client's machine anyway), at some point the game is going to decrypt that string and put it in memory. Memory that you can read.

If the program has access to the credential, and the program is running on your computer, you also have access to the credential no matter how they try to obfuscate it.

What the game dev is supposed to do is have an account system on their backend, and ask the player to enter their credentials in the game. The game can then identify itself as this player to the backend servers. That way any actions on the backend can be attributed to a particular player and you have a good basis to make security decisions on.

>I'm under the impression an executable binary shouldn't be easily read to find such credentials

It's hard but not impossible. It's more annoying than trying to extract strings out of a minified js file, but far from impossible. There are tools for it (eg. IDA), so you're not searching for credentials amongst anything that vaguely looks like a string.

>and I don't know what else a game dev is supposed to do if their executable needs to authenticate itself with a remote server.

The problem isn't that that the binary has hardcoded credentials, it's that the credentials are privileged.

The strings command is pretty old can do it if you're naive enough to embed a username and password into the game client.

The main thing is that its privileged - having a token shouldn't let you do anything besides say, report your game stats to a central server or enumerate the server lists, things like that.