Most flash games and other browser games usually don’t require you to go through some kind of registration phase to be able to play. Some games even provide the functionality to save your game state and continue later. The boundaries to start playing are lowered by these features as there is no consequence is playing, starting over or screwing up whatsoever. Epos of Realms and Alliances (ERA) is supposed to be lightweight and easy to get started with. Analogous to the flash games, we provide the possibility to play the game without registration. As a matter of fact, no registration is required to play or to continue playing. Starting over can be as easy as pressing instant play, yet the possibility to load an already existing journey remains.

Below I will elaborate on the mechanisms between instant play, the limitations and how the registration process takes place. Specifications are provided so one can learn and continue from and on this article as he or she likes.

Feature

Press a button and start playing. This mode is activated when you launch the game and press (instant) play. You will spawn in the world with your character randomized. Later in the game you have the possibility to restyle yourself. However, if you are unsatisfied with your looks, you can always start anew. The story is not directly introduced, but will be presented gradually. As for game play, a short tutorial guided by a sequence of images will provide all the necessary knowledge to freely roam the world. This way a more comprehensive tutorial (but also invasive as to freely roaming) is not mandatory each time you start a new session, with the side note that some players just don’t like tutorials.

Authentication

To explain how the feature works internally I first need to explain how authentication works in the first place because the feature is a special case of this authentication. Please remember that we use distributed servers that are eventually consistent, but for the sake of this post, assume that we only deal with once server and one database on that server.

The MD5 approach

In the time we didn’t knew any collisions for the md5 hash algorithm it was practice to hash the password – preferably salted – and save this password in combination with the username in a remote database. Even though this was already bad practice, rainbow tables where not used that much. A simple select statement would yield the validity of the credentials and the account. Nowadays we know that there is much wrong with this approach in the first place and that it is easily compromised. Using a rainbow table, this method is the same as saving passwords as plain text and that is not a very good thing to do. Read about these methods and their strengths here.

Apart from the fact that a rainbow table reveals all short passwords if the database would have been hacked, a man in the middle attack – where someone poses as the destination server but in fact records everything that is said or in our case sent. Sometimes data is modified as well. To deal with this problem, SSL uses a third-party (certificate authority CA) to authenticate the endpoint(s). This third-party connection is something we can’t afford in terms of speed and complexity, at least not every connection, so we had to come up with another approach. In fact, we would like to look at the following 6 points (taken from the section security analysis of the SRPP paper):

1. Prevent an attacker from being able to guess and verify password P based on exchanged messages.
2. No useful information about the session key K is revealed to an eavesdropper during a successful run.
3. The protocol should prevent the intruder from gaining access to the host or learning any information about passwords or session keys, even if an intruder has the ability to alter or create his own messages and forge the origin.
4. If the host’s password file is captured and the intruder learns the value of v (password equivalent such as a compute(P) value saved on the server), it should still not allow the intruder to impersonate the user without an expensive dictionary search.
5. If the session key K of any past session is compromised, it should not help the intruder guess at or otherwise deduce the user’s password P.
6. If the user’s password P itself is compromised, it should not allow the intruder to determine the session key K for past or present sessions and decrypt them.

The secure remote password protocol

A guy from Stanford (could have easily been a girl) called Thomas Wu came up with a secure way of handshakes to make a third-party redundant while also obscuring passwords in such way that the password is never sent over the network and not saved in the database. All the six points from above are covered. I would suggest, if you are interested to read about it because it’s a pretty good read. Here is a link to the paper itself with the following abstract.

Registration

So the method of authenticating is secure, but we have no way yet to insert verifiers into the database (password equivalent such as a computation on P. We don’t like to send the password over the network so instead we do it a little bit different. This time we have to make sure that:

1. The password is not transferred over the network.
2. The registration server is valid (we don’t want any man in the middle attack).
3. The connection is secure.

The specifications of the authentication algorithm are open to anyone and it doesn’t break with that property. This means that calculating the value of verifier v can be done by anyone, if you know password P. We use this to eliminate point one. If you read the paper you realize that even if some client knows v, but not P, any authentication attempt will fail because this client will not be able to compute any verification code as this client misses the value of P.  All this means is that capturing v while registering will not directly compromise the password without some extensive dictionary search.

But we rather not have it being captured, so we have device some contraption in terms of code to make sure that the road on which the information travels is a private road and that the destination is … well us and not some third-party. Right now we didn’t see any other solution than setting up a one way secure connection since we only need to send information towards the server, which will record this information. And what better way to use a SSL connection? What we need is a SSL certificate on the server end which will be able to decrypt the information it was send – this is the private key. Which each client (or web-server) we include a copy of a way to encrypt the information – this is the public key and voilà, we keep the connection secure and validate the endpoint by using SSL.

Anonymous registration

Ok, we can now register new members in a secure way and authenticate them too. How do we go from that to instant play? All we need is a unique anonymous registration. So what we do is call up the registration service sending “Anonymous” and no password. The server generates an unused username (just some numbers and letters) and sends these back to the client. We don’t mind it being unsecured, the username U is publicly exposed during SRPP. The client now generates a password P and stores this with the username in a key-file on the computer. The client now calculates the value v and sends this – encrypted – back to the server to complete registration.

The key-file is used when hitting instant play (continue) and destroyed when choosing instant play (new). We don’t mind someone not being registered, since would still be able to block IP’s and hostnames as we would when someone is registered.

Limitations

Storing the anonymous values as plain text in a key-file itself is insecure. If this file was stolen, the player would lose his or her account. However, this is just one of the downsides of playing with this method. What we could do is provide the capability to encrypt the key file with a password which one must enter to play, but that would defeat some of the beauty of just pressing enter and playing directly.

Since the usernames are generated we don’t allow players to add friends to their profile. Friends don’t go per avatar but per user. Furthermore, support tickets can’t be requested by instant play users, since we don’t have any clue who this person is and we don’t have an e-mail address that goes with the account. In case of security questions we would never be able to verify that this person is actually the original owner of the key-file, so we simply don’t allow it.

You can only play the instant play session on the computer you created the session. However we do provide the ability to save the key-file and thus making it possible to import the session on another computer. This also means that you could have various session stored on one computer, but this is all much more work to maintain.

The new website is now running. This is merely a post to confirm the migration was successful.

Update 10 January 2012

The website has been upgraded to use HTML5 and CSS3. The number of templates used by the site is greatly reduced and the style sheet was completely rewritten to use CSS3 and be more clean and efficient. There are some great posts on how to convert a theme to the new HTML5 and CSS3 and the posts I used are mentioned below.

• Convert theme to HTML5
• HTML5 and CSS3 techniques

This was not the only update I made, because I also added the author meta data box as you can also see below this post. It will show you how created the content and a little bit of information on that author. I didn’t use another plugin, I simply followed the post below as instructed and voila. I am going to make some more changes to add a little bit more information.

• Displaying Author Meta Data in WordPress 3

The series metabox was also restyled and I added Facebook connect to the comment system. I only did this because later on Facebook connect will also be used to – if you want to – register you for the game. When you write comments we can link your ERA account to these comments and so forth and so on.

Dear devoted fans,

A month prior to the summer break of 2011 we resumed working on the development of ERA with the help of a new team-member I picked up on the university. We restarted the project code-wise, as we now like to release the clients as tech-demo and want to use developing ERA as a way of autodidacting and evolving ourselves in the wonderful world of programming. Making a tech-demo means we will try to exploit the language, the framework, the hardware and ourselves in the best and worst way we possibly could in order to create an advanced product. This might result in complicated mechanics in the game, but we will do our bests to resolve such problems the best we can and we will design to entertain all kinds of gamers. From now on regular updates are on the agenda, either with text or non-text. The following things are at hand:

• If you really like to stay in the loop, I encourage you to follow us on Twitter (@ERA_RPG). The updates placed here will be too short to post on Facebook, here or other community sites but may contain valuable or interesting information we’d like to share.
• If you would like to participate in closed test rounds, I advice you to also like our Facebook page. Closed test rounds will last between hours and days and participants are selected from our Twitter followers, Facebook fans and Forum subscribers. It will give you exclusive access to the development cycle of ERA and give you insights into new features. These tests will be scheduled starting this fall.
• Game Mechanics changed and bit by bit will be revealed. As you can see numerous TBA mark the sticky topic on this board and information hidden from you right now will be released in time. Don’t worry, we will announce it each time an update took place, so you don’t need to check our posts each and every day.
• The ERA Team would like your input. What would you like to see in ERA? Please tweet us or share us your ideas on Twitter or Facebook. Later on we will have the polls up on our forum.

We are back baby and are better than ever before.

Once arrived you have a good look around, because the world you are now entering seems so much different than the lands previously visited. A small fishermen-village lays before you and with enthusiasm you start exploring your surrounding. It’s not much later that you learn that much of the villagers are actually fishermen, but that not everyone is honest about their achievements and the fish they catch. You hear rumours about some fishermen making deals with the devilishly blue creatures, the nightmare of all fishermen – not only because they seem immensely strong -  because they scare away all the fish with their screaming and their stench. You decided to investigate the matter. Are these fishing spots overflowing by coincident or is there a secret society behind all this mess… ?

Diary entry of The Confused Traveller: Village

Diary entry of the The Confused Traveller: Cave

In the north-west of Dublith County you discover this mystical and mysterious structure, which has been used as church. It has been years since the last service, but it seems that activity in and around the church has been increasing dramatically.  You decided to enter…

Diary entry of The Confused Traveller: Monastery

Diary entry of The Confused Traveller: Ghosts

Woah. You are glad you are outside again. Now fleeing from the scene, you head eastbound, to the countries capital called Dublith, also Lewa’s biggest city. Here you trade some goods and talk to locals. You solve some of their problem and you excite yourself with new secrets to unravel. On your way here you pass the great lake and a stone road leads you to the heart of the city, safe from all the dangers hidden in the forests and fields between the church and the city.

Diary entry of The Confused Traveller: Lake

Diary entry of the Confused Travller: Village

Your last stop before Dublith is this outpost. The soldiers are training together to protect the civilians. It’s a place where they can improve their skills but also take a break in their hectic lives. We call this place Cortez Outpost and it’s one of the many outpost on the trade route. Salesmen will try to sell their goods, while the leaders of the outposts try to recruit new blood.

Diary entry of the The Confused Traveller: Cortez Outpost

The meeting has been going for an hour when a light vibration in the air mutes all the voices. Silas sees that everyone is looking straight ahead. He doesn’t understand why they all just stopped talking. Suddenly the room is brightly lit and a loud reverberation bangs like a boot made of smooth metal hitting a marble floor. From the light that keeps floating in the air like a portal steps a large, armoured figure. The giant is roughly twice of Silas’ size and every inch of his enormous body is covered by strong metal in golden and white colours. His pounding footsteps are followed by an empty silence. Everyone except for the prophet is mumbling prayers while their hands are joint.

With a calm pace the giant moves towards the Prophet, who is looking at him, serene and unruffled. Each step fills the room with a freezing sound. The Prophet greets him, upon which the appearance makes an unusual gesture with his long fingers. The helmet of the stupendous armour moves almost unobserved when he starts speaking with a deep ineluctable voice. Silas, who doesn’t master any form of magic or followed any strange study, is not able to understand any of the words that fill the room. The Prophet however didn’t seem to have any difficulty answering the apparent questions of the giant.
Confused and afraid, Silas tries to whisper his colleague to find out what is going on, but he regrets that decision in an instant. The Prophet looks disturbed towards Silas and the mysterious creature slowly turns his helmeted head towards the anxious guard. When the giant looks at him he feels like he is staring into a deep ravine. Behind the gunsight of the helmet he can only see darkness and while it’s making him even more anxious, a clashing feeling of trust and loyalty overcomes him. It’s an ancient being that possesses powers even the mightiest magicians can’t withstand.

After a long, bleak yet empowering silence the ancient deflects from Silas and continues his dialogue with the Prophet as if nothing happened. It’s not long until the conversation comes to an end, upon which the giant takes a step back. The same portal of light is called in existence and he dissolves in thin air. Silas is relieved, because even though he felt the wisdom the giant seemed to radiate, his eyes emitted emptiness. It was better the creature was no longer with them.

The being that appeared in the conference room of the Arcane Order, is a direct descendant of the Gods and has been existing on Alva since her birth. We call them the Moduli. These were created – when the Gods went down to Alva after they finished composing her – in their image. The Moduli were less powerful than the Gods themselves, but nonetheless were they gifted in manipulation synths and had no limits in what they could create. The Gods left Alva and donated the world to the Moduli as an empire to live on, symbiont with the nature.
During thousand years the Moduli explored every corner of Alva. They’ve built a mighty city, Altmodus, high up in the mountains. To honor their creators, they constructed palaces and temples of faith, while engraving all their collective knowledge on the walls of these sacred structures, in effect mapping the entire world. Prosperity came to an unexpected end.
No one knows why, but one day the might of the Moduli started to decline. Over the next few years, their gifts diminished until after a hundred year, their power to create was completely obliterated. A few great qualities remained, but magical strengths kept decreasing. Despair made the Moduli glance to the skies, made them pray to the God for forgiveness, without knowing the act that called upon this damnation. An answer never came.

Broken and knocked down the Moduli returned to Altmodus, the only home they had left in their once so beautiful world. A place now even for them not without dangers…

Snapshot of the Trade Route Post near the Great Lake

The Trade Route that crosses Dublith County is much used by all kinds of traders and salesmen. Naturally the act of transporting goods is never completely without danger. This is why the Lewan Empire instated roadblocks where all that come true are thoroughly  screened and those with evil intentions are captured before they can do any harm. Nonetheless, the area’s around these outposts aren’t free from hostile animals. Luckily you’ve got some guards to come to your rescue…

Snapshot of a Dublithian Village

On Alva’s timeline, Lewa doesn’t cover a lot of space. The region is fairly young and not everything is heavily populated and therefore a lot of farmers existence remains, just like this friendly village – at least that is what they want you to think – where stress and pressure is not found in the dictionaries. Buy local items, such as food to recharge you on your journey, or new weapons, by farmers used to cultivate the fields. Perhaps you’ll find your destiny or just a quest that will earn you some money…

Snapshot of the Great Lake

Next to mountains, fields, forests, villages and beaches, these humongous lakes are part of Alva’s scenery. The lake you can see here can be found in Dublith County. It just looks like a bug puddle of water, but a closer look might yield some unexpected mysteries to be seen. Ask yourself: Why is there so much growing in this lake and while it’s so filled with vegetation, it seems that animals are almost abundant in existence. But more importantly, how got all this water over here in the first place? Unravel the secrets of Lewa to become a real Lewan or better yet to better understand the people around you. With the trading route connecting this lake to Dublith and the other more civilised regions of Dublith County, the lake is passed daily by a lot of people. You might catch some useful information or mere rumours from passing civilians, on your journey to the unknown…

Snapshot of the Arcane Order Camp near the Great Lake

Throughout Lewa you will encounter all the different camps of the Arcane Order. Some still very much alive and heavily populated, others abandoned and completely empty. These camps were used and are still used by the Arch Mages their followers and preachers to lure in new members. Take a look in one of the tents and who knows what happens. You might find yourself an ally, or enemy. Because the Arcane Order doesn’t want to deal with the guards protecting the more civilised area’s, these camps are usually located in fields and forests and not inside a thriving city. Don’t be scared if you will come face to face with an Imp, Wolves or another hostile…

Snapshot of a cave entrance on one of the Dublith Beaches

These are the Beaches of Dublith. One of the most serene places between the sea and the border to Hawkswood and Viridea Vale. There are many beaches with equally much sand to be traversed. The Sahagin-like beasts rule these places – together with other water-freaks – filled with sand, stone and some vegetation. Come come for solitude and others to train. Digging up treasures or catching fishes – there’s enough opportunity for action and it’s up to you to take it…

Snapshot of the entrance of The Monastery

This old building purposed as church a long time ago. It has been abandoned for years, but lately there seems to be more activity around and underneath this house of faith. There is yet someone to to be who has the courage to investigate this phenomena. Is the basement of this monastery filled with things that should never see the light of day or are there only lost treasures all that is left on this sacred place….

Snapshot of The Shrine near The Monastery

Outside the monastery one can still find some relics that indicate off a faithful existence. This shrine remains ever so preserved, rumor has it that the ghosts of the ministers and clerks who past away protect the relic. Stories speak of the white ghosts that used to appear when danger was near, but there is yet to be a person who can confirm seeing this with their own eyes…

Music Sample

Step right into the atmosphere of the ERAExperience by listening to this compilation while reading the post. It’s a taste of what you will hear in the game, once it’s accessible for everyone. The music, such as the background songs for the epilogue, the caves, dungeons and so forth and so on are mainly arranged by Milan Rang, a part from a few songs by Derk-Jan Karrenbeld. All the pieces are of the uttermost quality, since we want to take you on the perfect gaming experience. That said, this is still the internet and bandwidth is everything but unlimited, the reason the sample is half the quality of in game sounds.

Download ERA Sample Compilation (MP3)

Enemy Armies

You’ve been reading about the struggle – the endless battle – in which the New Age Alliance and The Arcane Order take their stand. But what we haven’t told you is that we created some third-party-threats, which we call Enemy Armies. They aren’t in the same way entangled in the story and history of Alva, but made their fair share of appearances in the past and beyond. As war has commenced, no one is left to keep these armies from rising, in effect making them stronger and more powerful over time, and that is a bad thing for everyone, whether you’re controlling synths or machines.

Nationalities

In ERA you’ll meet people with one out of four different nationalities and inherent with those one out of four races. They all originate from different places, but the war on Alva has brought them together. Even though the boundaries of the countries keep shifting, the four people nationalities still carry their specific marks:

• The first people you will encounter are Lewans, all part of a Celtic civilization. Their skin has no tan, but they do seem to have just that little bit of colour that separates them from the northern folks. Dublith is their capital.
• The more humid and warmer area’s of Alva are mostly populated by Sumni, the people with the dark skin that mostly live on the southern hemisphere. The biggest groups of Sumni make their way in and around the cities Barani, Roj and Nishati.
• Closer to the Dun’Aroon Wastelands you can find the human most alike to our Arabs. The captital of the Dal’Ahani is called Basra.
• Finally we have the race that populates the land up north, where the wind breezes colder and the rain falls harder. Where plants refuse to grow as big as anywhere else. The skin pale but rough, the latter is the same for their posture. If you like these mostly bald men, go towards Brunhilde, the cornerstone of their society,

Habitat of the Lewans

At some point you will arrive at Dublith, the harbor in the Celtic territory. Dublith is the Amsterdam on her most flourishing days during the Golden Century; magicians, artists, salesmen and thieves; their all present. The region around Dublith carries the name of Dublith County, under which an extensive network of Sewers lays till every corner of the area.

More north to Dublith County is Hawkswood, a large forest with many mysteries. Viridia Vale has a lot of agriculture and Shadowfall Forest is densly packed with flora in particular.  Below you can see the Celtic territory in a schematic manner: