Security and RPCs

here is more about the onserialize function

http://docs.unity3d.com/Documentation/Components/class-NetworkView.html

Where is this resource that tells how to run any code with any client on a unity server via RPC?

Based on what I know of the networking and RPC system I'd say this is not possible.

RPC just work like that.. you type in the code you want to execute on the other client/server nothing validates if that RPC is coming from a non modified client you can try it out if want to just create a new unity project just add one script that does the following :

Network.Connect(yourserverIP, yourserverPORT);

 networkView.RPC("disconnecteverybody", RPCMode.All);

[RPC] void disconnecteverybody () { Network.Disconnect();

}

there is in fact the Network.InitializeSecurity function

but i've read that it doesnt validate the server

i've in fact read that somebody programmed a game that become a bit popular and then somebody programmed a hack for it that gets the same acces as the server and can manipulate everything... if a hacker can only manipulate a variable i wouldnt care about it ..

While its not directly related to the main question, it may be worth mentioning that you shouldn't be using MD5 for anything security related since its not secure at all (see wikipedia). MD5 is best used as a checksum at best these days. You should be looking towards SHA or something.

As for RPC... A quick google says Remote Procedure Call. This sounds like a very bad idea. Turning off the server is the very least of your worries, especially if it has access to the mysql database. Especially if you are storing credit card info in there. Worst case scenario is not so much "turn the server back on and scan for malware" but more like "get destroyed by the litigation of releasing all customers bank details and passwords".

However, I'm not sure how we went from WWW to RPC, so its possible I've misunderstood something.

Googled a bit more and it doesn't sound as bad as bad as I first thought- I thought it was running shell scripts or you were sending the php to the server. But generally, with all security based stuff, you have to imagine that the other site is corrupt. All input can come from something someone else built (or changed by something in the middle). If its just the client you're commanding its probably not such a big deal.

Also- Hashing and Encrypting are not the same thing. SHA is a hash. I think the correct process is you encrypt with public key, send the encrypted key to the server, decrypt it with your private key, use it to calculate a hash, and then throw it away. But I've never actually had to implement such a system :/ I would think that if you hash locally theres not much point other than to hide the original password; the hacker could log in with the hash. Maybe you hash each end... Quick google turned a blank and its too late for me to dig deeper ^^;