Introduction to security

Security in online games is one of the largest issues for any successful game. If you ever plan to make it big, you are going to have to take security into account. I always see people wanting to make peer-to-peer connections between the clients (so every client in an area is connected to each other), and have most packets sent between them (such as talking, movement, attacking, etc) so the server doesn't have to handle it. While this is a good idea, it would be so easy to either manipulate the packets sent, or not send any packets at all, basically making you invisible to every other client (hello mass PKing spree!).

Another thing I see often done with major MMOs is too much client-side computing. My favorite example of this is the MMORPG Maple Story. Maple Story is a side-scroller "platform" game, having the server calculate collision detection between monsters and characters, along with characters and platforms, is going to be a lot of stress on the server. So, instead, they put all the collision calculations on the client directly, and the client tells the server when there was a collision. The result? Half the players on there are on godmode, can hit anything in the screen with a single attack, and can loot items from anywhere. It is probably one of the worst hacked MMOs I have ever seen. But, their servers can support a lot of players. But now, they can't move the collision detection server-side and make it hack-proof since most all hackers would just leave, or only stick around to sell their hacked characters. This would lead to legitimate characters being stuck in the dust, and there being a huge spur of high-level hacked characters. The only way to even things out is to do a complete wipe of the game. So, in the end, was it worth it?

If performance is such an issue with you, you can either design your server to work across multiple servers (have one server for each "channel" / "world", or one "world" and a server for each group of maps). This is a more expensive approach, but security never comes cheap.