Q:

Would SSL prevent replay tampering by the authenticated user

In the context of a game (HTML5/Flash/Silverlight) which sends data to an online service to record progress (e.g. player killed an orc), would communicating with the service over SSL implicitly prevent the player from recording and replaying the message? I know SSL includes a nonce, but does it remain constant for the duration of the connection or does it change after each request/response cycle?

A:

The nonce is at the transport layer level and not at the application layer. SSL would only prevent replay if the player captures the TCP packets and tries to replay then. But within the browser at the HTTP level the user can create a new request easily by simply refreshing the page...

