3 ms·

Using the Bejeweled example of a single-player game, and assuming it's properly deterministic, could a malicious actor not just falsify the steps taken as well

Using the Bejeweled example of a single-player game, and assuming it's properly deterministic, could a malicious actor not just falsify the steps taken as well as the score? It would be more difficult, but not that much more difficult considering the challenge is the time limit and lack of undo. Both would be removed if you were simulating steps.

lobotryas 11y ago
They could, but they can't falsify the game seed - the server determined order for what gems spawn when. This way I can send actions (whether real or hacked) that would be executed in the server against the "real game". If the client's move did not result in a score then no score is recorded, even if the client thinks it should.
- hinkley 11y ago
  But it would mean a bot could get the highest possible score for that seed by going back in time and trying again.
vvanders 11y ago
Yeah, that's assuming you know what the RNG algo is. There's a sibling comment below that mentions this. Most RTS games checksum the game state and send an out of sync when the checksums fail. If you generated different random values you'd definitely hit this. Always sucked when it happens about 1 hour into a game of Homeworld.
Impossible 11y ago
This is entirely possible and its why things like Punk Buster, etc. exist. For a lot of single player games it'd be hard to verify that an actual human physically executed the plays vs. a bot. I'm ok with accepting a high score from someone that went through that level of effort to falsify replays to get on a leader board. If a puzzle game is truly interesting that kind of cheating isn't necessarily optimal anyway.
xg15 11y ago
If you don't care about overkill, you could employ machine learning and anormaly detection: send the input sequences, timing and other difficult to fake data (e.g. gyroscope state) to the server and learn the "typical" distribution of those values. A perfect game played by a robot will likely be an outlier in a lot of the values. (Note that some legit games will also look suspicious, so you'd want to use this to find out which players you should keep an eye on, not as a tool for auto-banning.)
- flashman 11y ago
  If I was a game developer and a person developed a bot to play my game perfectly, I'd let them have the high score.
  - Matheus28 11y ago
    But that doesn't happen, that person distributes that bot and suddenly you have a huge issue where all the high scores are bots which frustrates real users.

lobotryas 11y ago

They could, but they can't falsify the game seed - the server determined order for what gems spawn when. This way I can send actions (whether real or hacked) that would be executed in the server against the "real game". If the client's move did not result in a score then no score is recorded, even if the client thinks it should.

hinkley 11y ago
But it would mean a bot could get the highest possible score for that seed by going back in time and trying again.

vvanders 11y ago

Yeah, that's assuming you know what the RNG algo is. There's a sibling comment below that mentions this. Most RTS games checksum the game state and send an out of sync when the checksums fail. If you generated different random values you'd definitely hit this. Always sucked when it happens about 1 hour into a game of Homeworld.

Impossible 11y ago

This is entirely possible and its why things like Punk Buster, etc. exist. For a lot of single player games it'd be hard to verify that an actual human physically executed the plays vs. a bot. I'm ok with accepting a high score from someone that went through that level of effort to falsify replays to get on a leader board. If a puzzle game is truly interesting that kind of cheating isn't necessarily optimal anyway.

xg15 11y ago

If you don't care about overkill, you could employ machine learning and anormaly detection: send the input sequences, timing and other difficult to fake data (e.g. gyroscope state) to the server and learn the "typical" distribution of those values. A perfect game played by a robot will likely be an outlier in a lot of the values. (Note that some legit games will also look suspicious, so you'd want to use this to find out which players you should keep an eye on, not as a tool for auto-banning.)

flashman 11y ago
If I was a game developer and a person developed a bot to play my game perfectly, I'd let them have the high score.
- Matheus28 11y ago
  But that doesn't happen, that person distributes that bot and suddenly you have a huge issue where all the high scores are bots which frustrates real users.