this post was submitted on 05 Aug 2023
-6 points (28.6% liked)
Asklemmy
42520 readers
944 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- [email protected]: a community for finding communities
~Icon~ ~by~ ~@Double_[email protected]~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
There's a concept I call "rule zero of cybersecurity": "the user can and will exploit trust you place in them or anything they can touch."
You can make it more difficult to exploit the trust you put in the user by hiding it behind obfuscation, but ultimately the user can desolder your secure enclave, reverse engineer your anti-tampering measures, and falsify any check your program wants to do, if it happens on their computer.
Client-side anticheat on Windows doesn't "work" in the pure sense either, it's just enough of a pain to bypass that most people don't because you can't recompile the kernel to change how it behaves. On Linux, it's easier to take advantage of the fact that perfect client-side anticheat is fundamentally impossible.
Same with device attestation, DRM, and other client-side verification measures: they're doomed to be in an endless back-and-forth because what they're trying to do is fundamentally incompatible with reality.
The correct choice for anti-cheat is to detect cheaters like humans do: watch a player's actions as they are received by the server, and use your knowledge of typical player patterns to detect if the player is cheating. Your server's knowledge of the network messages coming from the user's computer is the only thing you can trust (because it exists on hardware you control), so you should make your decision by analyzing that.
alternative solution, one user account for every game that has a 'cheating credit score'. just food for thought
Some games use a "trust" system based on human reviews of your gameplay that affects how you are matched with other players, but there isn't a respectful way to force people to use just one account so that the trust score can follow the person. The best way I can think is to tie the purchase of the game to that account, which many services do, but that breaks the used games market...