One of the problems in subspace is user authentication. A server can very easily steal passwords. This is also one of the reasons for the exclusiveness of SSC. An other online game solves it as follows: When it comes to authentication there are 3 parties: Game Server, the zone Game Client, the player Authentication server There is only one authentication server, but there are many game servers and clients. Users can register at the authentication server by a web frontend and in-game. The authentication server should never perform banning or anything related, this is up to the zones / billing servers. Also no scores, cross zone chat, etc. Login procedure Client connects to authentication server. Sends its username and password. When successful the authentication server sends a random token back Client connects to the zone, sends its username + random token Zone connects to the authentication server, asks for verification with the username + random token. The authentication server removes the random token Client can now play in the zone The random token is only valid for a few minutes. Preferably the authentication server uses TLS for its connections. Passwords are stored using SHA-2 hash + salt This method allows every zone to use the same player database without the risks of password stealing.