Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never trust the client

gafferongames.com

Post reply on HN
Print view View original

141–150 of 155 posts

Re: Never trust the client

#141

Post by kuschku »

iLoch wrote: post #17
MBCook wrote: post #7

Since this is a multi-player game this is obviously a big problem but I've always wondered how you'd handle this in a single player game with a leaderboard. Let's say you have a Bejeweled clone/match-3 game and a global high score board. What can you do to prevent fake scores? You can obviously obfuscate things, sign requests, etc but at some point the client needs to sign the score it's sending up so the client has…

This is actually impossible without hardware encryption. Apple should have no problem with this since they have control over their hardware, but they don't do anything to prevent fake scores from showing up in their leaderboards. Xbox is a great example of being able to trust the client. The console tells the server that it has unlocked an achievement by using a signed request which was signed by the secure chip. The…

Not even such a secure chip is secure. People can take apart hardware security modules in credit card scanners and scam the credit card networks over millions (a "how to" on how to do this was shown on 32C3).

Your Xbox hardware is even less secure.

Re: Never trust the client

#142

Post by swombat »

ultramancool wrote: post #119
smelendez wrote: post #114

Earlier quoted context omitted.

> Yep, gamers are literally accepting rootkits that allow arbitrary remote code execution on their machines. That's certainly risky and rather horrible, but what's the alternative? Multiplayer games are a huge business and a huge culture, and all that goes down the drain if people cheat. Game companies have millions of people around the world competing for prestige and money. They're running game software on their ow…

The solution is simple: do everything server side. Look at World of Tanks for a great example of this. They pretty much let people run free with mods in multiplayer and even the worst of those mods can barely provide an advantage in online play. They do this by managing absolutely everything server side. Ammo, direction of aim, position, enemy players appearing and disappearing etc. Basically your server should be bu…

An even better solution: let the competitive advantages be given only by doing things the computer is bad at and human beings enjoy doing.

If you get a competitive advantage from doing something like grinding, which computers can do better and more tirelessly than humans, and humans tend to dislike, then inevitably you will have cheating. (e.g. WoW)

If on the other hand the competitive advantage is from working out a strategy of in what order to play your cards to maximise your chances of building up your strength while attacking the opponent and yet keeping something in store for surprises the opponent may spring on you - a really complex strategic task - then that's something people enjoy doing and the computer sucks at. (Hearthstone)

People may be addicted to the first kind of games, but is that something that should be protected? It's kind of similar to people addicted to slot machines... sad, a reality we have to accept, but not something we should expend vast amounts of intelligence trying to sustain.

Of course, there are people who will do it for the money, and don't stop them, but realise that they are basically just a few steps short of people refining formulae for meth to make it more addictive - the fact there's a business case that exploits a human weakness doesn't mean it's a productive use of intelligent people's time.

Re: Never trust the client

#144

Post by ultramancool »

exDM69 wrote: post #139
ultramancool wrote: post #119

Earlier quoted context omitted.

The solution is simple: do everything server side. Look at World of Tanks for a great example of this. They pretty much let people run free with mods in multiplayer and even the worst of those mods can barely provide an advantage in online play. They do this by managing absolutely everything server side. Ammo, direction of aim, position, enemy players appearing and disappearing etc. Basically your server should be bu…

Doing everything server-side is not enough to prevent cheating. There are plenty of client-side tricks that can give the player an advantage, starting from simple visual cheats. E.g. turn the opponent's textures bright purple so you can see them better. Make the walls transparent. Aimbots that spoof mouse input. The server must be authoritative or all bets are off, but you still do need client side anti-cheat counter…

You're right - you can never prevent that. Which means your client needs to offer it to keep it from becoming an advantage. If the players are already bright, recognizable colours you're basically already there. Transparent walls don't help when the server doesn't send you the enemies hiding behind them until the very instant they pop out. And if you're only spoofing mouse movement, well, that is getting pretty high risk, you may have a slight advantage, but human players will still be able to kill you without too much to effort. And I think that's the main thing anticheat should be preventing.

Re: Never trust the client

#145

Post by notacoward »

majewsky wrote: post #143
notacoward wrote: post #102

I'll bet there was at least one developer who saw they were doing it wrong, and told them, and was overruled. I'd love to hear his/her account.

That type of story grows old after the 100th time you hear it.

Also, get off my lawn.

Re: Never trust the client

#146

Post by jmnicolas »

746F7475 wrote: post #121
djsumdog wrote: post #54

Earlier quoted context omitted.

I saw a talk where a guy was showing how to cheat at some games. A lot of games will detect and crash you out if they detect a debugger attached to them. Things like Punk Buster, et. al. are more like anti-virus software: they try to find the signatures of known chat clients. So it's best to write you own...and rename your debugging process to "Google Chrome." He got pretty far with his auto-walker in some MMOs. He h…

I would love to play around with "botting" in some games, but I just don't even know where to begin. I tried to create super naive autoplayer years ago in C# by trying to just send keyboard keys into games, but most games didn't even receive the inputs.

If you're ready to throw a bit of money at it (and you're playing on Windows) I'd recommend having a look at Innerspace from Lavishsoftware.

I used that to bot on WOW back in the day, this tool was fabulous and can be adapted to probably any game. Knowledge of C++ is required to create an extension, after that you can code your bot in C# or Lavishcript (their own script language, quite powerful).

Re: Never trust the client

#147

Post by mentos »

floodyberry- wrote: post #109
mentos wrote: post #98

Earlier quoted context omitted.

Yea and I'll go out on a limb and say it was the correct one. The shelf life of a popular game like this is probably shorter than most people think so it makes sense to offer an amazing experience that you couldn't necessarily achieve with an authoritative server model and then by the time hackers have defeated the game players have probably moved on to the next.

Guaranteeing your multiplayer blockbuster game designed to have "infinite gameplay" will be dead in the water the instant hackers discover its highly flawed networking model doesn't sound like a "correct business decision".

It was marketed to have infinite gameplay. What game do you know that honestly has achieved that?

Re: Never trust the client

#148

Post by daemin »

MustardTiger wrote: post #87
throwaway13337 wrote: post #62

Earlier quoted context omitted.

UO had rubberbanding rampant - that is, you'd move on the client, then warp back to an old position after the server said you actually didnt move there. It was terrible. Most all MMOs with WSDA movement trust the client to set the player's position and it mostly works. Cheating through warping or speed is easily detectable through other means of post-verification and banning players that fail that verification. It ma…

>UO had rubberbanding rampant Only if you had high latency and tried to move somewhere you couldn't actually move. >If speed/warp hacks are a problem, it's not because the developers that use client-set-movement aren't able to fix it, it's because they don't care. That's precisely what I said. Obviously they can fix it, since it was fixed before they started development. They did it wrong and don't care.

Yep, I was playing it from Australia on dialup, had about a 200+ms ping. What ended up happening is my character would be running in the wilderness, then after a few seconds it would snap back because I hit the side of a house/castle.

Re: Never trust the client

#149

Post by cataflam »

ultramancool wrote: post #144
exDM69 wrote: post #139

Earlier quoted context omitted.

Doing everything server-side is not enough to prevent cheating. There are plenty of client-side tricks that can give the player an advantage, starting from simple visual cheats. E.g. turn the opponent's textures bright purple so you can see them better. Make the walls transparent. Aimbots that spoof mouse input. The server must be authoritative or all bets are off, but you still do need client side anti-cheat counter…

You're right - you can never prevent that. Which means your client needs to offer it to keep it from becoming an advantage. If the players are already bright, recognizable colours you're basically already there. Transparent walls don't help when the server doesn't send you the enemies hiding behind them until the very instant they pop out. And if you're only spoofing mouse movement, well, that is getting pretty high…

Even all that still doesn't stop a very old type of cheats: aim bots. Even if the server only sends you information about enemies the instant they pop out, a computer will be faster and more precise to aim and shoot at this enemy than any human player could be. Add in some randomization and delays so the server can't easily differentiate the movements from a human player, and you're a mechanically world-class player. Doing everything server-side is not enough to prevent cheating.

Re: Never trust the client

#150

Post by cataflam »

swombat wrote: post #142
ultramancool wrote: post #119

Earlier quoted context omitted.

The solution is simple: do everything server side. Look at World of Tanks for a great example of this. They pretty much let people run free with mods in multiplayer and even the worst of those mods can barely provide an advantage in online play. They do this by managing absolutely everything server side. Ammo, direction of aim, position, enemy players appearing and disappearing etc. Basically your server should be bu…

An even better solution: let the competitive advantages be given only by doing things the computer is bad at and human beings enjoy doing. If you get a competitive advantage from doing something like grinding, which computers can do better and more tirelessly than humans, and humans tend to dislike, then inevitably you will have cheating. (e.g. WoW) If on the other hand the competitive advantage is from working out a…

There are some things computers are really good at and that human beings also enjoy doing. Computers are insanely fast, yet plenty of reflex-based games exist. A lot of high-level competitive games have a dexterity dimension. FPS games for example are a mix of strategy and dexterity, with a big emphasis on dexterity. RTS games like Starcraft put a bigger emphasis on strategy but still require insane finger dexterity at the highest levels. The dexterity part of the game could be done far better by a simple AI. Aim bots in FPS or inhumanly micro-management in RTS have been demonstrated, yet those games are still played, and interesting.

One of the examples you gave, Hearthstone, actually had many bots running on the ladder for a time. Their goal was grinding, but even so, a number of them was better than a significant portion of the human playerbase. With the recent advances in artificial intelligence, computers are not that bad at this kind of task.

Overall, I don't disagree with your main point though. I have no qualms automating boring and repetitive tasks in non-competitive games. And if a competitive game has those parts, I'd probably avoid playing it. I'd rather spend my time coding than wasting it grinding because it's part of some game I otherwise enjoy. I feel it is indeed a more productive use of my time. I wouldn't go as far as judging other people who like the grind though.

Post reply on HN