Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We outsmarted CSGO cheaters with IdentityLogger

mobeigi.com

Post reply on HN
Print view View original

111–120 of 372 posts

Re: We outsmarted CSGO cheaters with IdentityLogger

#111

Post by phire »

Retr0id wrote: post #68
kemitche wrote: post #52

Earlier quoted context omitted.

GDPR isn't a blanket ban on cookies. You don't require a cookie notice for strictly necessary cookies, which you have a "grounds of legitimate interest" for: https://commission.europa.eu/law/law-topic/data-protection/r... Fraud prevention is listed as an example of a "legitimate interest." So no, by my layman's interpretation, they would not have been bound by GDPR to notify the user of cookies or other fingerprintin…

They're perhaps not required to gather explicit opt-in consent, but my understanding is that they'd be required to disclose what information they collect/store.

The same rules apply to the steam ID and IP address.

As far as I'm aware, you can get away with disclosing the fact that you are tracking "unique identifiers for the purpose of anti-cheating" in the terms and conditions, without explicitly explaining the technical details that it's a cookie.

Also, this is a server covering the Australia/New Zealand region, so it doesn't have to worry about GDPR compliance.

Re: We outsmarted CSGO cheaters with IdentityLogger

#112

Post by Ylpertnodi »

newZWhoDis wrote: post #88
kemitche wrote: post #52

Earlier quoted context omitted.

GDPR isn't a blanket ban on cookies. You don't require a cookie notice for strictly necessary cookies, which you have a "grounds of legitimate interest" for: https://commission.europa.eu/law/law-topic/data-protection/r... Fraud prevention is listed as an example of a "legitimate interest." So no, by my layman's interpretation, they would not have been bound by GDPR to notify the user of cookies or other fingerprintin…

GDPR is toothless eurotrash. I saw a consent form that had 72 optional, 21 “legitimate interest” cookies. GFB

That means gdpr is working.

Re: We outsmarted CSGO cheaters with IdentityLogger

#113

Post by snarfy »

project2501a wrote: post #106
snarfy wrote: post #25

For UT2004, you can ban by player GUID (a hash of the CD key) or IP. With the game abandoned by Epic, a number of key generators have cropped up, which makes GUID bans useless. IP bans only go so far with VPNs costing $2 these days. The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans th…

sorry for the not-so-smart question. the cheats are software, software has certain quirks, like the way it aims or the way it tracks. And I'm willing to bet it has enough distinctiveness from human aiming to be classified. Couldn't a classifier work on the behavior of the cheating software itself, rather than use IP bans?

It's more effort than it's worth. There are server aimbot scanners which do something like this. There are also aimbots written to thwart this type of detection, adding delays, random drift, etc. It's a cat and mouse game. We don't have a lot of players left so it's not that much of an issue.

Re: We outsmarted CSGO cheaters with IdentityLogger

#114

Post by ryandrake »

mouse_ wrote: post #77
ghxst wrote: post #60

Earlier quoted context omitted.

This still leaves you wide open to cheaters using mobile data tethering and proxies. Have you considered more advanced network analysis? It's one of the areas I have an interest in (professionally and personally) so if you want any suggestions let me know.

The tactic 4chan uses: Regular IPs can post freely VPN or mobile IPs (blacklisted) must pay for a key ($20/year) that allows posting from blacklisted IPs. Key is good for posting from one blacklisted IP, locked for 30 minutes, so users cannot share keys. That way, you can ban the user by their key, if their IP is public. It's not a perfect solution but it seems to be the best they've found for such a situation so far…

I mean, in this case it's 4chan so who cares, but I hope we are not very slowly moving towards a troubling world with lower classes of IPs and upper class IPs. IPs should be IPs should be IPs, it shouldn't matter whether it comes from an ISP, a mobile network, a VPN, or anything else, and we shouldn't attach some kind of IP caste to providers or countries. I think we really need Internet-wide IP randomization, where you can't just block a /24 or a /16 because they're in some icky ghetto. Yes, I know there is abuse, but if this is the alternative, it doesn't seem worth the cost in terms of innocent people losing access.

EDIT: Well, I guess the tribe has spoken. Pretty surprising. I think y'all are just assuming you'll always be the ones with the "good" IPs...

Re: We outsmarted CSGO cheaters with IdentityLogger

#115

Post by Systemmanic »

jjmarr wrote: post #105
kelnos wrote: post #70

Earlier quoted context omitted.

> This still leaves you wide open to cheaters using mobile data tethering and proxies Is latency going to be good enough on mobile data (especially if they're also using proxies) for a FPS, though? Sure, they're using cheating software, but I wouldn't be surprised if the software gets the information it needs to cheat too late often enough for it to be useful.

I regularly played CSGO in Europe because the North American ranking system were screwed up. I got to Supreme (2nd highest rank) with 150 ms ping. The people I queued with hit Global. It's possible to play legitimately with very high ping. The higher ping put us at a disadvantage, but the skill gap between regions made it worth it to arbitrage.

What was screwed up about the NA ranks?

Re: We outsmarted CSGO cheaters with IdentityLogger

#116

Post by jorvi »

willcipriano wrote: post #42
Night_Thastus wrote: post #13

Earlier quoted context omitted.

Only problem is, a lot of companies do NOT want to pay for it. It's 'treadmill work'. No matter how many people and how much money you throw at the problem, it still ends up just coming back. It's a losing battle because there are many, many more players than there are developers.

My idea: 1. Determine minimum human reaction times and limit movement to within those parameters on the client side. (For example a human can't swing their view around [in a fps] in a microsecond so make that impossible on the client) this will require a lot of user testing to get right, get pro players and push their limits. 2. Build a 'unified field theory' for your game world that is aware of the client side const…

> Now cheating has to at look like high level play instead of someone flying around spinbotting everyone from across the map. Players hopefully don't get as frustrated when playing against cheaters as they assume they are just great players. Great players should be competitive against cheaters as well.

No, those are still just as vehemently hated as “closet cheaters”, for example the whole XIM / Cronus infestation on any game that has controller AA.

It’s still possible to, on average, spot if it’s a closet cheater or an actual good player due to things like movement and gamesense, but for the average player it will be much less obvious, leading to a huge amount of rage towards good players because they are by default suspected as “just another closet cheater.”

Re: We outsmarted CSGO cheaters with IdentityLogger

#117

Post by o11c »

voytec wrote: post #7

Kudos to the author for using RFC5737[0] TEST-NET-2 address for: > An example of an IPv4 IP address is 198.51.100.1. [0] https://www.rfc-editor.org/rfc/rfc5737

Where it gets interesting is when documentation uses a typoed reserved address (e.g. 189.51.100.1 or 198.15.100.1). There are actually several RFCs that do this.

Re: We outsmarted CSGO cheaters with IdentityLogger

#118

Post by treyd »

project2501a wrote: post #106
snarfy wrote: post #25

For UT2004, you can ban by player GUID (a hash of the CD key) or IP. With the game abandoned by Epic, a number of key generators have cropped up, which makes GUID bans useless. IP bans only go so far with VPNs costing $2 these days. The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans th…

sorry for the not-so-smart question. the cheats are software, software has certain quirks, like the way it aims or the way it tracks. And I'm willing to bet it has enough distinctiveness from human aiming to be classified. Couldn't a classifier work on the behavior of the cheating software itself, rather than use IP bans?

This is part of what Valve does in CS. It works pretty well but it does have false positives so it requires user intervention for confirmation of bans.

Re: We outsmarted CSGO cheaters with IdentityLogger

#119

Post by Syntonicles »

snarfy wrote: post #108
IncreasePosts wrote: post #102

Earlier quoted context omitted.

How about just a whitelist? I can't imagine there are a ton of legit ut2k4 players left?

Yes, we have a whitelist ability also, but it is definitely a last resort. The game is mostly dead and difficult to discover for new players. We don't want that roadblock if we can avoid it.

TIL people still play UT2004.

I was going to mention how much I loved that game, until I realized I played UT99. Time sure does fly...

Re: We outsmarted CSGO cheaters with IdentityLogger

#120

Post by eqvinox »

beeboobaa3 wrote: post #101
ketkev wrote: post #53

Earlier quoted context omitted.

I'm not a lawyer, but I think this actually has some interesting things to think about. Not all cookies require consent under the ePrivacy directive, there is an exception for cookies that are "strictly necessary for the delivery of a service requested by the user". I think that'd fit in this case, since providing a cheater free experience is part of the "service" the players are looking for. At the same time, the eP…

No, that doesn't count. Companies have tried arguing that their ads' tracking cookies are strictly necessary otherwise they wouldn't be able to offer their services (ads pay the bills). And yet, they require consent. Preventing cheaters is similar. And this is blatantly a tracking cookie.

You aren't considering that ad cookies/tracking are used to enable a service to someone else (ad buyers), while this anti-cheat tracking cookie is used to enable a service to the user themselves (a cheat-free gaming experience.) I think that may make the difference.

Also, all of this was in 2017. Anyone doing it in 2024 should indeed run it past a lawyer.

Post reply on HN