Live data from Hacker News

A Message About Vanguard From Our Security and Privacy Teams

riotgames.com

41–50 of 103 posts

Re: A Message About Vanguard From Our Security and Privacy Teams

#41
post #33

League of legends is a real pain in the ass to play even when you’re doing everything right. Personally I don’t even like the game, it’s just popular so I played it to hang out with friends. The way their launcher handles updates is crazy inefficient and so it always takes hours to launch if it launches at all. It also runs terribly in wine.

They recently improved their updater: https://technology.riotgames.com/news/supercharging-data-del...

Re: A Message About Vanguard From Our Security and Privacy Teams

#42
post #18
post #11

Earlier quoted context omitted.

The future of anti-cheat is machine learning specific to the game. CS:GO already does this, where it used the Overwatch community review program to train it, and it can now automatically ban some cheaters. I don't think it's a viable model because players are willing to do it for free, as CS:GO's Overwatch shows.

Valve also put a significant amount of work into this system. Asking every game developer to build that system for their game seems like alot to ask- Especially when they can just drop in a few lines of code // third party software package and have cheating 'handled'. 'Not invented here' is a blessing and a curse.

[deleted]

Re: A Message About Vanguard From Our Security and Privacy Teams

#43
post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

Your though experiment involves targeted government attack. And they in theory can order any game company to install any virus on some computer during update. That's hardly an argument against this thing.

What are realistic security issues with ring0 access on personal computer? I bet most interesting stuff on personal computers is easily accessible with normal user privileges that every game client has.

Re: A Message About Vanguard From Our Security and Privacy Teams

#44
post #14

>we wouldn’t work here if we didn’t deeply care about player trust and privacy Bold message from a chinese company. People freak out about Huawei but Tencent is 1000% worse. And here they are installing a kernel driver on your PC.

This is being downvoted, but this is an important point. The Chinese government has repeatedly shown they'll work with Chinese companies to carry out the government's agenda.

Do you really think that after 100M people install this kernel driver that the Chinese government won't lean on Tencent to gain access, or use it beyond its original purpose?

Re: A Message About Vanguard From Our Security and Privacy Teams

#45

I skimmed, but it seems none of this addressed why the service (edit) runs at boot-time? Also, expecting a service to not not look at your data if they have access is not security. If Valve can mitigate hacking in CSGO without such an intrusive service, I am sure Riot can. I, myself, did a very, very, very poor job with an autoencoder to detect anomalous matches in Dota and caught a large amount of players abusing th…

It actually doesn't look like the service is always running (although the kernel driver is). I haven't played Valorant since I started my PC, so the `vgc` service for vanguard has no status (and is in "manual" mode).

Re: A Message About Vanguard From Our Security and Privacy Teams

#47
post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

Yes, Riot Games, which is owned by Tencent, which is an arm of the Chinese Communist Party. Hmmmm. Just the people we need to install rootkits on millions of computers.

Re: A Message About Vanguard From Our Security and Privacy Teams

#48

Earlier quoted context omitted.

The user vs root division does not need to be bypassed for a game. Riot does bypass it with their kernel-mode driver for the anti-cheat mechanism.

As parent comment noticed there is no need to bypass anything. Just ask the user for root permissions like any other installer and the user will accept.

That's how Riot installs their thing in the first place and that's how everybody can install their own thing.

Re: A Message About Vanguard From Our Security and Privacy Teams

#49
post #4

Whenever I hear/read lots of words about how secure something is and how strong their commitment to security I think “they don’t know what they don’t know”.

We should all admit that we don't know what we don't know. But the default behavior afterwards should be to assume that the software/system is insecure, fixing the defects we can find and surrounding in by rings of moats (defense-in-depth). When you don't know what you don't know and then declare it to be secure, there's an extra layer of indirection and perhaps a bit of hubris.

Re: A Message About Vanguard From Our Security and Privacy Teams

#50
post #34
post #27

Earlier quoted context omitted.

Public relations for a startup like this would be hard to manage. I can already see the front page Reddit post with 4,000 upvotes on the game's subreddit asking why they lost $400 worth of items because one of the outsourced employees being paid $3/hour illegitimately banned them. Easy target to blame a company like this. Cheater effort and quantity scales roughly with game revenue and popularity. So the first tier o…

To be fair, this happens regardless, every day. Nobody believes anyone suspected of cheating, ever. And I mean ever. Just go look at the steam forums and the thousands of "i was falsely banned posts". If what you are saying was true, we would have seen this already happen for steam on reddit every day, which it doesnt. Also, thats not to say you cant have a second and third tier of support to escalate your case to if…

This is because most of the cheating bans currently are not human reviewed, it's technical evidence. Closest to this issue I can remember is that some pro CS:GO player was banned by the Overwatch program a few years ago and a fuss was made until it got fixed.

Trying to review a replay to determine if a player is using wallhacks? This would take intimate knowledge of every game the SaaS reviews.

Maybe this can work out and I'll be like the one 2007 HN comment about Dropbox, but it takes an average of maybe 5-10 minutes per case to review if you're not being super thorough. It could be an open platform where players can sign up, but at that point I think game developers would just implement it in-house. The harder part of this technically is the replay functionality in the first place, which they'd have to do anyway.

Post reply on HN