Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Riot Games Approach to Anti-Cheat

engineering.riotgames.com

Post reply on HN
Print view View original

401–410 of 412 posts

Re: Riot Games Approach to Anti-Cheat

#401

Post by dkersten »

reificator wrote: post #397
dkersten wrote: post #295

Earlier quoted context omitted.

> The item that marks you as a cheater might have been a drop in another invasion, I don't remember. I believe they can do it completely passively, so you’re kinda screwed if it happens to you :( This is sadly the nature of trusting what clients send you: a hacked client can send whatever it wants and the “anti cheat” in Dark Souls sadly seems to simply just check if an item should be possible, meaning a cheater can…

And of course, if it didn't punish non-cheaters, then cheaters could simply cheat the items in on one account, invade/summon another of their own accounts, (or passworded summon in the remaster) and then give the new account the items. There's no winning against cheaters as long as you trust the client. (And it's possible to do it on consoles too, just more rare as the tools are readily available on PC.)

> There's no winning against cheaters as long as you trust the client.

Indeed.

> And it’s possible to do it on consoles too

Sure, but the barrier to entry is higher, so its not done as often. I’ve never noticed someone who was obviously cheating (which doesn’t mean I’ve never encountered any, but if I have, they’ve never been so severe as to do the things mentioned here or for me to notice it)

Re: Riot Games Approach to Anti-Cheat

#402

Post by kiddico »

gnarcoregrizz wrote: post #396
kiddico wrote: post #79

Earlier quoted context omitted.

Those servers are still available in CSGO too. 3kliksphilip recently did a video[1] with someone who plays on one. Interesting insight into the kind of player who cheats. [1] https://www.youtube.com/watch?v=gniSF1M9g_o&

Neat. I used to love the hack vs hack servers. The cheats were a bit more primitive back then, so I imagine hvh isn't as fun nowadays since all cheats are very advanced... I remember when xqz2 first came out - the first opengl-based client cheat for the half-life engine. It was simply a wallhack at first, and evolved to a primitive aimbot I believe. Anyway, they started to get pretty sophisticated around cs 1.4 or 1.…

At this point it's less about the quality of the hacks, but how the players use them. Now that everyone can wallbang well map knowledge is extra important. You need to know where is and isn't safe to stand.

Wallhacks completely remove early game tactics too. Instead of having a game centered around information gathering each side is already completely aware of the game state. No being sneaky.

Sometimes people jokingly say that it would be cool if there was a second Olympics with steroid and genetically engineered participants. Concerns for player health and blah blah blah stops that from happening. Not in CS though! Crank the aimbots up to 11 and have em duke it out! I love it.

Re: Riot Games Approach to Anti-Cheat

#403

Post by reificator »

Buge wrote: post #400
reificator wrote: post #280

Earlier quoted context omitted.

Sure. Until you're playing Dark Souls for the first time, you get summoned to help someone with a boss, and then get invaded by someone with a 360 degree one-shot kill spell that breaks all your weapons and armor, gives you an egghead that you can't remove unless you know where to go, and gives you an item that marks you as a cheater so you now get constantly invaded by exclusively cheaters. The item that marks you a…

That seems to be a completely different type of cheat than described in the article. The article is just about cheats that automate certain moves that players would already be able to do, just would be very hard. It's not possible to stop this type of automation in the general case. If a cheater can make items appear out of nowhere, that's not an automation cheat, that's a security vulnerability in the server that sh…

My understanding is that the server is not for realtime. Realtime gameplay is peer to peer.

Re: Riot Games Approach to Anti-Cheat

#404

Post by gnarcoregrizz »

kiddico wrote: post #402
gnarcoregrizz wrote: post #396

Earlier quoted context omitted.

Neat. I used to love the hack vs hack servers. The cheats were a bit more primitive back then, so I imagine hvh isn't as fun nowadays since all cheats are very advanced... I remember when xqz2 first came out - the first opengl-based client cheat for the half-life engine. It was simply a wallhack at first, and evolved to a primitive aimbot I believe. Anyway, they started to get pretty sophisticated around cs 1.4 or 1.…

At this point it's less about the quality of the hacks, but how the players use them. Now that everyone can wallbang well map knowledge is extra important. You need to know where is and isn't safe to stand. Wallhacks completely remove early game tactics too. Instead of having a game centered around information gathering each side is already completely aware of the game state. No being sneaky. Sometimes people jokingl…

That makes sense. I haven't played in a hvh since 1.6 so I'm not up to date on the current scene. Back then, if you had the better cheats you basically outright won, it was an arms race rather than a competition. Good times!

Re: Riot Games Approach to Anti-Cheat

#405

Post by civilitty »

mynameisss wrote: post #363
lwansbrough wrote: post #347

Earlier quoted context omitted.

If you can identify a physical person with a unique identifier, it is PII according to GDPR, I believe.

You can apply a one way function to an IP to obtain an ID and then maintain a database of bad IDs. For example you could compute this ID by the SHA256(IP + secret salt). Since way one function don't allow you to recover the IP, the ID is not PII. If you detect an IP which has bad ID the connecting ban that IP from the game. I think this respect the GDPR, you don't maintain a list of IPs or any other PII.

The second you use this ID to tag data you're sending over to the servers, that ID could easily lose any claim to anonymity for the purpose of the GDPR because the anti-cheat system vacuums up a vast trove of information. All it takes is one email "Re: Claim for Your Local Psychiatrist Bob" or a document named "John Doe Jr - First Grade Book Report.docx" showing up in the titles of your open windows (that many anticheat systems send to a remote server) and boom, that ID and all of the data attached to it are now a radioactive liability.

Re: Riot Games Approach to Anti-Cheat

#406

Post by Buge »

reificator wrote: post #403
Buge wrote: post #400

Earlier quoted context omitted.

That seems to be a completely different type of cheat than described in the article. The article is just about cheats that automate certain moves that players would already be able to do, just would be very hard. It's not possible to stop this type of automation in the general case. If a cheater can make items appear out of nowhere, that's not an automation cheat, that's a security vulnerability in the server that sh…

My understanding is that the server is not for realtime. Realtime gameplay is peer to peer.

That sounds like a completely different system than League of Legends has. So hellbanning should work fine as suggested (it was suggested for League of Legends).

Other games that use (IMHO) broken protocols by trusting the client can't reliably use hellbanning, and I don't think they can reliably do anything.

Re: Riot Games Approach to Anti-Cheat

#407

Post by javaJake »

stcredzero wrote: post #243

Here's my project's approach to Anti-Cheat. 1, 2, 3) Everything on the server. Server's version always wins. Server is the authoritative source. Granted, I have a mathematical advantage in the game's particular movement mechanics which makes this easy to get away with. The other game mechanics are also designed with facilitating this in mind. Corollary: The client is almost nothing and trusted with nothing. It's pret…

#4 has introduced an interesting problem in the MMO space. By allowing scripting in WoW, players were penalized either because they couldn't keep up, or the general community would demand they run parsers to tell that they couldn't keep up. The vanilla experience was no longer good enough. FFXIV decided to ban any client customization in an attempt to avoid these kinds of toxic situations:

https://www.reddit.com/r/ffxiv/comments/5uxmx8/yoships_offic...

Re: Riot Games Approach to Anti-Cheat

#408

Post by limonkufu »

I wish to see how they dealt with the overhead because of all the encryption, checks etc. performance-wise? I know LOL is quite an old game so they mastered these points. I am especially curious because lately I play PUBG and when PUBG does something about cheat it effectively kills performance.

Re: Riot Games Approach to Anti-Cheat

#409

Post by madjam002 »

ShaneWilton wrote: post #351
madjam002 wrote: post #53

Earlier quoted context omitted.

Reminds me of my childhood playing ROBLOX on various Script Builder games where users on the server could script with Lua. It was basically a race to who could script admin commands and completely own the server.

I got my start with computers hacking ROBLOX as a kid! We probably met each other. I went by Shanethe13 / Aeacus back then. If that rings a bell, you should hit me up :) I actually work in cybersecurity now, directly as a result of ROBLOX. Shedletsky came across some of my work a few months ago, and we reconnected over dinner. It's a crazy small world sometimes.

That’s awesome! Name rings a bell actually, did you have any places? I made one of the build a raft games back in the day [0], was great fun to build games on there. I remember sometimes waiting around to get on Sword Fights on the Heights to get in the same server as Shedletsky hahah!

[0] https://www.roblox.com/games/7729765/BUILD-A-RAFT-AND-SURVIV...

Re: Riot Games Approach to Anti-Cheat

#410

Post by reificator »

Buge wrote: post #406
reificator wrote: post #403

Earlier quoted context omitted.

My understanding is that the server is not for realtime. Realtime gameplay is peer to peer.

That sounds like a completely different system than League of Legends has. So hellbanning should work fine as suggested (it was suggested for League of Legends). Other games that use (IMHO) broken protocols by trusting the client can't reliably use hellbanning, and I don't think they can reliably do anything.

But the realtime gameplay is where the cheaters are giving other clients items in order to mark innocent players as cheaters.

So everyone's getting hellbanned, at which point no one is hellbanned...

Post reply on HN