Welcome to the Gamebase 64 forums.                 An attempt to document ALL Commodore 64 gameware before it's too late!

Adult filter

Discuss GameBase, the Universal Emulator Frontend!

Moderator: Jimbo

JohnCKirk
New Member
Posts: 24
Joined: Sun Apr 20, 2008 1:28 pm

Adult filter

Sun Nov 29, 2009 1:32 am

At the moment, GameBase has an "adult filter" built in, which is password protected. The idea is that you can choose to block adult games/music, and then nobody can change that without knowing the password. I'm wondering how best to implement this in GameBase.NET, so I'd be interested to hear from anyone who uses this feature.

Going into a bit more detail, GameBase stores two values in the registry: the filter itself (on/off), and an encrypted version of the adult password. These two values aren't stored in an obvious location, i.e. the key name has nothing to do with GameBase, so if someone went poking around in the registry then they'd be unlikely to stumble across these. The problem is that this relies on "security by obscurity". I don't mean any disrespect to James when I say that: I'm sure this made sense when the first version of GameBase came out, but now that the program is open source that means that a sufficiently determined child could go through the source code to find out where this information is stored, and how to decrypt the password.

More generally, all of the registry settings are currently stored under HKEY_LOCAL_MACHINE. The main reason I started working on GameBase.NET is that I want it to work properly as a standard user, i.e. you should be able to run it without needing local administrator rights. So, I've changed most of it to use HKEY_CURRENT_USER instead. However, I've kept these two values under HKEY_LOCAL_MACHINE, since they need to apply to everyone who uses the computer (not just the current user), and if your children have standard accounts then they won't be able to change anything. This also means that I can store the values in a more obvious location, since it no longer needs to be a secret. I'm using a one-way hash for the saved password, then hashing the password attempt that people type in, so I never need to decrypt the value that's stored in the registry.

Thinking about this a bit more, I'm wondering whether I really need to use a password at all. The alternative is simply to store the filter setting in the registry on its own, and rely on Windows authentication to protect it. Really, there are two scenarios here:
a) The child has a standard user account. This means that they can't update the filter in the registry, so there's no need for a password.
b) The child has an administrator account. This means that they can bypass the GameBase password altogether, and hack the registry to turn the filter off.

So, the GameBase adult password is only useful if you have a child with an admin account, who doesn't know enough about computers to modify the registry, and who you don't trust. At that point, I'd say that you'll probably wind up with a computer full of viruses anyway, so adult games are the least of your problems! Still, I'm happy to keep the password in there if anyone else actually finds it useful.

As a related issue, supposing that we keep the password, is the "Reset password" option useful? This requires you to type in the current admin password, then it removes the password. However, the next time you change the adult filter (to show/hide adult games), it will ask you to enter a new password. This won't help if you've forgotten the password, so it just seems like an indirect way to change the password (via two separate operations). Again, I'm happy to keep it if it's useful to other people, and I may have missed something obvious.

Anyway, comments and suggestions are welcome...

Return to “The GameBase Frontend”

Who is online

Users browsing this forum: No registered users and 37 guests