Communication Security

How secure is only listening to a specific UUID.

It sounds like it should be very secure, given that the data isn't important just acting on it is as it a control system.

should be fine as long as the data isnt whats needed to be protected

Exactly.

In that case I'd be looking at md5 encrypted with a string of random keys to rotate though unless there is a better way ?

if the object only listens to a specific uuid, it's secure from replay and spoofing, if however the info being transfered is sensitive (CC numbers, personal info, uuids of objects that DON'T filter, texture uuids, etc) then you might want to keep going and add encrytion... otherwise the filtered listen provides all the Authentication you need

Right now the UUID listen is sufficient.

Is md5 encryption the prefered method for more sensitive data ?

MD5 is not for encryption, just for authentication.

It can "guarantee" that the info came from a genuine/valid source, but does nothing to obscure the data itself. For that, you will have to use a different algorithm, like XTEA.

However, in most cases, authentication is all you need, as the info rarely is important by itself to obscure.

If your only listening to one UUID though then securing the information shouldn't be at issue since only you, LL, the people who run the pipes your data is running through, your ISP, and your neighbor who's leeching off your open wifi connection (theoretically) could possibly get that information in the clear.

I'm not so sure about that.

Assuming we're talking about listening to a specific object (as opposed to a specific av), the circustances and permissions on the object may matter. If the permissions aren't correct, then the owner of the object could drop in an additional script. Since the object's uuid would be the same, the listener could not determine which script within the object sent a message by only looking at the uuid.

Obviously, this depends upon how it's been used. If it's just to control multiple objects with the same owner, then this isn't an issue. But if the listener is a central controller for some sort of game, then not only don't you want players to spoof messages from other players, you also don't want players to spoof messages from themselves.

Thats a very good point, I hadn't thought of that.

Now in my case it isn't an issue as the owner is configuring multiple remote units.

But I think the added thought is a very useful idea to put on the msg board.

good point, I left a bad assumption in there, that being the communication was between two objects under the OP's direct control (such as a server/vendor setup).

although replay would be limited/complexrequiring both a script to engage the replay in the object, and a script in another object to listen for the data to send, which it would pass back to the spoofing script. still a very real consideration, and one that's often overlooked in link message communications (i've used something similar to test link messages sent and recieved by other peoles scripts)

@Gordan:
assuming says and listens, any information passed is able to be interceted, rather trivially, but if it's not sensitive it's not a big deal if you can authenticate the sender (as via uuid). sensitive info (things that can be repurposed texture uuids, CC #'s) obviously shouldn't be sent this way

just my 2 cents

IF anyone would want to know what your prims are saying, they can create a script that listens on all channels (wouldn`t be nice in performance tho) so i`d recommend to encrypt some if not all data if it`s sensative

prepare for the worst and hope for the best