Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message About Vanguard From Our Security and Privacy Teams

riotgames.com

Post reply on HN
Print view View original

71–80 of 103 posts

Re: A Message About Vanguard From Our Security and Privacy Teams

#71

Post by enitihas »

smoyer wrote: post #36
devit wrote: post #26

Earlier quoted context omitted.

All software that you install on the main desktop operating systems is given the "keys to their computer kingdom": there is no privilege separation or sandboxing, except for the "user vs root" division, which can be trivially bypassed in countless ways (and anyway, most installers require root privileges). And yes, obviously you need to have a dedicated gaming PC and certainly not install any games or any software th…

To some degree that's true. I keep an eye out for programs that insist on running as root. And if someone breaches my account, they've still got to put the work in to escalate their privilege through one of these programs. I've also been installing more and more software into ~/bin rather than the more traditional /opt and /usr/local/bin. I think that the trend towards usermode software will take over in the next fiv…

Usermode software might be far more dangerous though. Any software you run on your machine can change the files in ~/bin, and you won't know the difference.

Re: A Message About Vanguard From Our Security and Privacy Teams

#72

Post by hellcow »

sbarre wrote: post #67
hellcow wrote: post #44

Earlier quoted context omitted.

This is being downvoted, but this is an important point. The Chinese government has repeatedly shown they'll work with Chinese companies to carry out the government's agenda. Do you really think that after 100M people install this kernel driver that the Chinese government won't lean on Tencent to gain access, or use it beyond its original purpose?

So let me ask you a question then.. Do you feel the same way about Microsoft and Apple, and every other company that provides a hardware driver for a modern computer, and whether state governments (USA included) put pressure on them to let them advance their agenda by using back doors in their drivers or software? Why is Riot special in all this? What, in your view, makes them more likely to be so secretly and so dee…

Your argument boils down to, "If one country has access, then every country should have access."

I don't agree with that.

It's clear the US has backdoors. That doesn't mean it's wise to invite China to add backdoors as well.

Re: A Message About Vanguard From Our Security and Privacy Teams

#73

Post by [deleted] »

blattimwind wrote: post #58
dharmab wrote: post #17

Earlier quoted context omitted.

My next gaming PC will run a Linux hypervisors and use PCI passthru to run Windows as a full-performance guest. Then if I need to use a web browser, I can switch to a Linux guest without interrupting the game.

Most anti-cheats and some "DRM solutions" do not allow you to run inside a VM, trying to mask the fact you do might be enough to get banned. Even with PCI passthru you can't expect full performance (CPU is also still virtualized). It's much simpler to just have a second PC/laptop or dual-boot (less secure).

[deleted]

Re: A Message About Vanguard From Our Security and Privacy Teams

#74

Post by cesarb »

youerbt wrote: post #43
smoyer wrote: post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

Your though experiment involves targeted government attack. And they in theory can order any game company to install any virus on some computer during update. That's hardly an argument against this thing. What are realistic security issues with ring0 access on personal computer? I bet most interesting stuff on personal computers is easily accessible with normal user privileges that every game client has.

> I bet most interesting stuff on personal computers is easily accessible with normal user privileges that every game client has.

Which is why the current tendency is towards more sandboxing, not less; things like flatpak on Linux, the app stores on Windows and Mac, the heavy sandboxing on phones, and so on. Running an in-kernel component for an application goes against that.

Re: A Message About Vanguard From Our Security and Privacy Teams

#75

Post by SpaceManNabs »

Draiken wrote: post #59
SpaceManNabs wrote: post #24

Earlier quoted context omitted.

rampant years ago. It took a long time to get where it is now. There are still cheaters here and there, but that is to be expected, and relatively rare in my experience.

It is absolutely still rampant. I could count at least 5 cheater encounters in the last 30 days (blatant cheaters, btw). They try their best to isolate cheaters with a "trust factor" system but the reality is, unless you pay an external service with their own anti-cheat software (that's probably as bad as Valorant's) you will get a high amount of cheaters. Given they have zero transparency on the trust factor system,…

I agree that it could be more transparent. I haven't faced a single suspicious player in quite some time (and similar with my friends that I talked to about this since this came up). Sorry that your experience is worse. Player "toxicity" should not be involved in this since it might be used as a proxy.

Re: A Message About Vanguard From Our Security and Privacy Teams

#76

Post by emagdnim2100 »

Potentially dumb question: how do cheats even work in a game like LOL? I understand aimbots in a FPS and how they can give a pure mechanical advantage, but the LOL equivalent isn’t obvious to me. Does the client have access to data that’s not supposed to be exposed to the player?

Re: A Message About Vanguard From Our Security and Privacy Teams

#77

Post by x0x0 »

m463 wrote: post #25
smoyer wrote: post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

> Vanguard does not collect or process any personal information beyond what the current League of Legends anti-cheat solution does. They are tiptoeing quite carefully there. I wonder if a lot of "collect or process" can be blocked by users, but with a kernel module actually prevents opt-out attempts and identifies everyone.

this sounds like language (and, presumably, implementation choices) made to comply with their privacy policy and GDPR.

Re: A Message About Vanguard From Our Security and Privacy Teams

#78

Post by belltaco »

gpderetta wrote: post #68
ruialmeida wrote: post #38

Earlier quoted context omitted.

In order for your game to render other players you have to know their position, so the game server has to send them to all players. As an example, for CSGO in the past, the server always sent all player positions from anywhere, so it was possible to create cheats to draw players anywhere in the map. They changed the way it's done, coordinates are only sent when other players are nearly visible, although distant, or c…

>In order for your game to render other players you have to know their position, so the game server has to send them to all players I know nothing about game engines, but I have always wondered why is that the case. The server could compute visibility and only send the opponent position if there is a chance the player might see it. Computing visibility server side is not cheap, but it would still be significantly che…

Riot's Fog of War for Valorant does exactly what you describe.

https://technology.riotgames.com/news/demolishing-wallhacks-...

Re: A Message About Vanguard From Our Security and Privacy Teams

#79

Post by XMPPwocky »

hellcow wrote: post #72
sbarre wrote: post #67

Earlier quoted context omitted.

So let me ask you a question then.. Do you feel the same way about Microsoft and Apple, and every other company that provides a hardware driver for a modern computer, and whether state governments (USA included) put pressure on them to let them advance their agenda by using back doors in their drivers or software? Why is Riot special in all this? What, in your view, makes them more likely to be so secretly and so dee…

Your argument boils down to, "If one country has access, then every country should have access." I don't agree with that. It's clear the US has backdoors. That doesn't mean it's wise to invite China to add backdoors as well.

Where do you think drivers for your hardware come from? You know, the ones that already silently update through Windows Update?

Re: A Message About Vanguard From Our Security and Privacy Teams

#80

Post by kleinsch »

emagdnim2100 wrote: post #76

Potentially dumb question: how do cheats even work in a game like LOL? I understand aimbots in a FPS and how they can give a pure mechanical advantage, but the LOL equivalent isn’t obvious to me. Does the client have access to data that’s not supposed to be exposed to the player?

Aimbots work in LoL too, there are champs that are balanced around lots of skill shots (Xerath) who you’d see hitting every single shot all game. There’s also a lot of scripting, both for account leveling or just to automate boring parts of the game. You’d see people afk playing their lane for 20 mins and not responding to anything happening in the game, then suddenly running into the other team for a big fight.
Post reply on HN