6 ms·

The irony is that EAC doesnt stop cheaters at all.

dkersten 5y ago
No anti-cheat will ever completely stop cheaters. There are plenty of cheat tools that are basically impossible to prevent. The question is whether EAC is good enough? I don't know, I play very little multiplayer these days.
- mastax 5y ago
  In my experience any popular free to play multiplayer game is eventually inundated with cheaters no matter what anti cheat is used.
  - judge2020 5y ago
    In the end, games need to be built better by sending the least information needed to clients, ie. zero-trust. This is a big part of things like CS:GO, Valorant, and RTS games like starcraft/League/Dota since they can implement a 'fog of war' and only network information if their client actually needs it[0]. The only cheats that still plague Dota are scripts that perform tasks automatically, such as disabling an opponent as soon as they're visible (beyond human ability), and those are taken care of by heuristics[1] and a community-voting-based 'overwatch' system in CS:GO and Dota 2[2]. 0: https://technology.riotgames.com/news/demolishing-wallhacks-valorants-fog-war https://technology.riotgames.com/news/demolishing-wallhacks-... 1: https://youtu.be/hI7V60r7Jco https://youtu.be/hI7V60r7Jco 2: https://www.dota2.com/newsentry/3025824821114909461 https://www.dota2.com/newsentry/3025824821114909461
    - orbital-decay 5y ago
      >games need to be built better by sending the least information needed to clients, ie. zero-trust That isn't possible in real world for every type of competitive gameplay; trade-offs need to be made. Even games you list are not "zero trust" - things like looking direction are left to the client because of the latency. Moreover, it's not enough. What's also needed is a hardware chain of trust for input devices. On-device cryptographic signing of mouse events would be sufficient and would guarantee that input comes from a fair play-compliant device.
      - jMyles 5y ago
        > On-device cryptographic signing of mouse events would be sufficient and would guarantee that input comes from a fair play-compliant device. SGX for human inputs. What can go wrong?
        orbital-decay 5y ago
        SGX is a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything. Signed mouse input is much more benign. But sure, I see your point - this is DRM, and it can be used to control the access to your own mouse, even outside of online gaming. Still, it's the most logical step, and it would probably happen in several years, after Microsoft started demanding TPM 2.0. Valorant already requires TPM to be enabled on Windows 11 to run. By the way, A4Tech has on-device DRM for more than a decade, they are using it to stop people pirating their software. Which is, ironically, designed for cheating.
        jMyles 5y ago
        > SGX is a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything. My position is s/"a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything"/"a failed experiment in computer pseudoscience". And the nightmare scenario I imagine is a more lubricated path to framing political dissidents by forging attestations that they were searching for child abuse imagery or some similar scenario.
    - dkersten 5y ago
      The problem with zero trust and only sending what the player can actually see is lag. For example, sure, you could eliminate wall hacks by only sending positions of players that you have line of sight of, but that essentially eliminates any client-side movement prediction or other lag compensation and means you have to send each frames data quickly enough. This may work for some games that are less lag sensitive and as internet speeds improve, but its not currently a solution for most players.
      - PUSH_AX 5y ago
        Also most fps games use the sound of a player to indicate generally where a player is. You'd need the player xyz on the client regardless of line of sight of they are in aural proximity.
        dkersten 5y ago
        Good point, I forgot about this but its very true.
    - episteme 5y ago
      Heuristics are great in theory but if they could be used reliably then you wouldn't need an overwatch system. Also the overwatch system depends on people being accurate judges of whether people are cheating which we know from pro players going undetected for so long (KQLY) and from pro players being accused for so long and being clean (flusha) that they are not.
dafelst 5y ago
It won't stop anyone who has the skill to author cheats themselves (i.e. someone with basic reversing and programming experience) but it does do a good job of detecting and banning players who are using widely distributed "commercial" cheats. I look at EAC as being very analogous to a virus scanner, very easy to bypass if you know what you're doing, but good at catching the common and soon-to-be common threats. It also puts up enough roadblocks to make some novice attempts at cheating inconvenient at least. Source: I deal with all the anti-cheat stuff (including EAC) on a semi-popular multi-player game. I can verify that it does make a very tangible difference to our player base in terms of the number of cheaters they are exposed to on a per match or per session basis.
- arsome 5y ago
  EAC is actually pretty terrible against commercial cheats, it's only use is against free cheats pretty much. If you're willing to pay, you'll find many for EAC games.
  - ziml77 5y ago
    That still reduces the number of cheaters. Having to get out a credit card even to pay a penny is a barrier to people cheating.
  - zorked 5y ago
    Interesting. I am not a gamer at all: so there is a market for cheating tools? How "legit" is it? Where do players go to buy cheats?
    - arsome 5y ago
      Many major titles are using EAC currently, Fortnite, Apex Legends, PUBG, etc. There's a pretty large market for cheats in any of those titles. Just dropping "<game> aimbot" or "<game> cheats" into google is likely to turn up a multitude of commercial cheat developers, many of which are legitimate and will bypass the current anti-cheat. Generally the legitimate commercial cheat developers offer status pages detailing any of their cheats that are currently detected and offer additional tools to do things like bypass hardware ID detection if you did get banned in the past.

No anti-cheat will ever completely stop cheaters. There are plenty of cheat tools that are basically impossible to prevent. The question is whether EAC is good enough? I don't know, I play very little multiplayer these days.

mastax 5y ago
In my experience any popular free to play multiplayer game is eventually inundated with cheaters no matter what anti cheat is used.
- judge2020 5y ago
  In the end, games need to be built better by sending the least information needed to clients, ie. zero-trust. This is a big part of things like CS:GO, Valorant, and RTS games like starcraft/League/Dota since they can implement a 'fog of war' and only network information if their client actually needs it[0]. The only cheats that still plague Dota are scripts that perform tasks automatically, such as disabling an opponent as soon as they're visible (beyond human ability), and those are taken care of by heuristics[1] and a community-voting-based 'overwatch' system in CS:GO and Dota 2[2]. 0: https://technology.riotgames.com/news/demolishing-wallhacks-valorants-fog-war https://technology.riotgames.com/news/demolishing-wallhacks-... 1: https://youtu.be/hI7V60r7Jco https://youtu.be/hI7V60r7Jco 2: https://www.dota2.com/newsentry/3025824821114909461 https://www.dota2.com/newsentry/3025824821114909461
  - orbital-decay 5y ago
    >games need to be built better by sending the least information needed to clients, ie. zero-trust That isn't possible in real world for every type of competitive gameplay; trade-offs need to be made. Even games you list are not "zero trust" - things like looking direction are left to the client because of the latency. Moreover, it's not enough. What's also needed is a hardware chain of trust for input devices. On-device cryptographic signing of mouse events would be sufficient and would guarantee that input comes from a fair play-compliant device.
    - jMyles 5y ago
      > On-device cryptographic signing of mouse events would be sufficient and would guarantee that input comes from a fair play-compliant device. SGX for human inputs. What can go wrong?
      - orbital-decay 5y ago
        SGX is a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything. Signed mouse input is much more benign. But sure, I see your point - this is DRM, and it can be used to control the access to your own mouse, even outside of online gaming. Still, it's the most logical step, and it would probably happen in several years, after Microsoft started demanding TPM 2.0. Valorant already requires TPM to be enabled on Windows 11 to run. By the way, A4Tech has on-device DRM for more than a decade, they are using it to stop people pirating their software. Which is, ironically, designed for cheating.
        jMyles 5y ago
        > SGX is a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything. My position is s/"a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything"/"a failed experiment in computer pseudoscience". And the nightmare scenario I imagine is a more lubricated path to framing political dissidents by forging attestations that they were searching for child abuse imagery or some similar scenario.
  - dkersten 5y ago
    The problem with zero trust and only sending what the player can actually see is lag. For example, sure, you could eliminate wall hacks by only sending positions of players that you have line of sight of, but that essentially eliminates any client-side movement prediction or other lag compensation and means you have to send each frames data quickly enough. This may work for some games that are less lag sensitive and as internet speeds improve, but its not currently a solution for most players.
    - PUSH_AX 5y ago
      Also most fps games use the sound of a player to indicate generally where a player is. You'd need the player xyz on the client regardless of line of sight of they are in aural proximity.
      - dkersten 5y ago
        Good point, I forgot about this but its very true.
  - episteme 5y ago
    Heuristics are great in theory but if they could be used reliably then you wouldn't need an overwatch system. Also the overwatch system depends on people being accurate judges of whether people are cheating which we know from pro players going undetected for so long (KQLY) and from pro players being accused for so long and being clean (flusha) that they are not.

dafelst 5y ago

It won't stop anyone who has the skill to author cheats themselves (i.e. someone with basic reversing and programming experience) but it does do a good job of detecting and banning players who are using widely distributed "commercial" cheats. I look at EAC as being very analogous to a virus scanner, very easy to bypass if you know what you're doing, but good at catching the common and soon-to-be common threats. It also puts up enough roadblocks to make some novice attempts at cheating inconvenient at least. Source: I deal with all the anti-cheat stuff (including EAC) on a semi-popular multi-player game. I can verify that it does make a very tangible difference to our player base in terms of the number of cheaters they are exposed to on a per match or per session basis.

arsome 5y ago
EAC is actually pretty terrible against commercial cheats, it's only use is against free cheats pretty much. If you're willing to pay, you'll find many for EAC games.
- ziml77 5y ago
  That still reduces the number of cheaters. Having to get out a credit card even to pay a penny is a barrier to people cheating.
- zorked 5y ago
  Interesting. I am not a gamer at all: so there is a market for cheating tools? How "legit" is it? Where do players go to buy cheats?
  - arsome 5y ago
    Many major titles are using EAC currently, Fortnite, Apex Legends, PUBG, etc. There's a pretty large market for cheats in any of those titles. Just dropping "<game> aimbot" or "<game> cheats" into google is likely to turn up a multitude of commercial cheat developers, many of which are legitimate and will bypass the current anti-cheat. Generally the legitimate commercial cheat developers offer status pages detailing any of their cheats that are currently detected and offer additional tools to do things like bypass hardware ID detection if you did get banned in the past.