9 ms·

I haven't seen anyone in these threads propose an alternative to Anti-Cheat. Just not using anti cheat makes popular games unplayable. Everyone has the choice t

I haven't seen anyone in these threads propose an alternative to Anti-Cheat. Just not using anti cheat makes popular games unplayable. Everyone has the choice to just not play them but plenty of people do, and accept the trade off of handing control of their PCs to a third party to do so.

II2II 4y ago
I seem to recall a game giving me the option to install anti-cheat, with the caveat that anti-cheat was required for multiplayer. While it only solves the problem for people who stick to single player, at least the option exists. Likewise, it would also be nice for the option to exist for private servers. If the server admin trusts their users or is okay with anything goes, there is no need for anti-cheat.
- Ntrails 4y ago
  Anti cheat is also necessary if you design your game around micropayments I assume, so not purely a multiplayer issue. I am ok with that market dying in a fire admittedly..
  - mpsprd 4y ago
    Not necessarily. Usually when micro-transactions are present everything is validated server side, Leading to always online games like diablo 3+. From my understanding kernel level anticheat is to detect things like aimbot, wallhack etc.
    - mehlmao 4y ago
      Off the top of my head, Genshin Impact is a mostly single-player game with some multiplayer functionality. It uses kernel level anti-cheat to make sure that microtransactions are protected. This driver had a known vulnerability that did not get patched for years and was used by malicious actors: https://www.bleepingcomputer.com/news/security/hackers-abuse-genshin-impact-anti-cheat-system-to-disable-antivirus/ https://www.bleepingcomputer.com/news/security/hackers-abuse... Street Fight 5 did the same thing; it was possible to unlock characters for local play using a trainer. They patched in a rootkit with known vulnerabilities in an attempt to prevent that.
  - rtpg 4y ago
    I don't really think that's true. the content is usually in assets and just behind some flag that gets activated via some callout to a store, but there's not active anti-cheat software making sure that you "actually bought the content" in general() () technically a lot of games have anti-piracy measures that are somewhat active, but they're rarely of the "phone home" variety
- TheRealDunkirk 4y ago
  > anti-cheat was required for multiplayer. This is what I can't wrap my head around. Every multiplayer game I ever played on PC had cheaters in it. The anti-cheat stuff seems like it just inconveniences the good guys, and does little to stop the bad guys, so what's the actual point? I play on consoles now, and the fact that there are no cheaters is probably half the reasons why. I've seen video of Battlefield 1 on PC these days. It's comical, as long as it's not happening to me.
  - MrJohz 4y ago
    I imagine it's similar to the logic behind locks on houses. Thieves still exist, but by making it harder for them, you reduce the chances of them targeting your house. You won't ever reduce that chance to zero, but you can reduce it significantly. Similarly, I imagine the more effort you have to put in to get through anti-cheat software, the more likely you are you give up and play a different game. There'll still be some people determined enough to bypass it, but that number will be smaller than it would be otherwise. Fwiw, I don't play these sorts of games, so I have no idea if this stuff is effective, but there's a comment somewhere in this thread saying that Valorant has fewer cheaters than other, similar games, in no small part due to their aggressive anti-cheating measures, so anecdotally it may well have an effect.
  - dbg31415 4y ago
    Bans come in waves. So they let cheaters cheat for a bit... but they are recording all the programs and processes that everyone is running. Then, once they see the issue as being big enough to warrant action, they ban the highest "80%" of people running the cheat, in the last "3 months" (or whatever time period). I'm sure there's some magic threshold where they say, "Eh, this kid only had it running for a week, and the account he was running it on was 8 years old, and gosh... we really don't want more customer support calls and complaints. Let's let a few slide." I'm sure there is some sort of "how serious is this offense" algorithm. Video games have so many cheaters, but it's rare for the accounts to stay active for more than 3-6 months. But you're right, they should ban faster, and they should do more to stomp out cheating. For people who play by the rules... it seems unjust that they don't ban faster. One theory is that they time ban waves to increase sales. "Oh sales are down this month, better ban some more folks so they'll re-buy the game with new accounts." Don't forget, in a lot of games, players buying in-game currency (or items) is what fuels bots / cheating. The game makers need this sort of behavior to keep some percentage of "legitimate" players (the indirect cheaters) happy and on the platform. I'm sure they have all the math worked out. They ban at exactly the pace needed to maximize profit.
usrusr 4y ago
A clear opt-in should do the trick. Maybe even with some percentage indicating how much you'll miss without? (e.g. not much at all if it's mostly single player, everything if it's a competitive persistent works like Eve and something in between if there are both "open" and "regular" instances) Valve is the only organization that could pull that off, and it would further deepen the entrenchment of their position as the meta gamemaster of all PC play.
iforgotpassword 4y ago
"anti cheat" is the lazy solution, you can just buy it and be done with it, and if it fails you can blame someone else until they stepped up their game in this cat and mouse game. Take that whole tarkov meltdown for example (YouTube g0at tarkov cheater). Everybody is screaming "needs moar Anti-Cheat" left and right when the first thing I wonder is "why is the server sending every client the position, health and inventory of every other player all the time?" - obviously the answer is because it's the simplest approach. But it's by far not impossible to continuously run hitscan between all players on the server and not update any player positions for players that can't see each other. But of course that takes time and effort to make work reliably, so let's just install a ducking rootkit on every player's computer and use the developer resources to instead add microtransactions or whatever.
- baby 4y ago
  Anti cheat is part of the cat and mouse game it seems. If you think there’s a way without anti cheat you should try to write a serious proposal. There’s a lot of money involve in solving this plague in competitive gaming.
  - iforgotpassword 4y ago
    Read my comment in it's entirety please. There's one very obvious improvement I suggest pretty much off the top of my head, I'm sure if you want to you'd come up with a dozen more. They aren't even trying.
    - deleted 4y ago
      [deleted]
    - smolder 4y ago
      I agree with you. There are several major games that transmit all player info at all times when it's really not necessary and makes "ESP" style hacks possible, which can be supremely unfair. Developers would rather tack on a rootkit than make engine changes to resist this kind of cheating.
    - 4y ago
2358452 4y ago
It's an important problem for fair interaction online in the future, I think. I believe the only real alternative would be something at the hardware level. Your hardware should be able to get into a mode where an executable has a protected memory address space, and maybe even a protected relationship with GPU memory and displays. Otherwise I think all anti-cheat tends to be (1) Fragile, relying on OS mechanisms that can be often bypassed; (2) Extremely intrusive from a security and privacy standpoint: they need to monitor your system, almost everything it's doing for any attempts to read or modify relevant memory or control input to give unfair advantage (or say bots) to some players. Finally, I guess we should remember there's always the famous 'analog hole' (a-hole) that defeats all mechanisms from simply capturing output and feeding it to another machine (that's very hard to plug). But because it really need dedicated hardware and significant effort, a hardware level anti-cheat would generally be a very significant solution to cheating without sacrificing users rights.
- wmf 4y ago
  Basically SGX.
josephcsible 4y ago
The alternative is doing cheat detection entirely server-side.
- unethical_ban 4y ago
  How do I detect you using an aim hack without seeing your machine?
  - josephcsible 4y ago
    Have you ever spectated another player and quickly realized whether they were using an aim hack? How did you know?
    - _piif 4y ago
      That only works if they are using blatant instant snap-on aimhacks - which I fully agree should be checked for since that's one obvious target. If the aimbot is a bit more sophisticated where it mimics mouse movement though I don't see how that would work.
  - the8472 4y ago
    Why do you think having access to the machine would help against computer vision and input emulators?
bombolo 4y ago
The alternative is reviewing the logs of people who constantly get kicked for cheating and ban them.
amiga-workbench 4y ago
One choice would be to price out cheaters. Have people pay a one-off fee for access to a premium tier of multiplayer servers. If you cheat, your access is pulled and you've got to go and spend more money to get back in. Something Awful did this with their forum and it does a pretty good job at keeping spammers and other irritants out.
- josephcsible 4y ago
  This creates a perverse incentive for the cheat detection system to have a lot of false positives.
- _piif 4y ago
  Didn't CSGO have something like that with their Prime account status? From what I've seen it wasn't very effective, people will gladly spend obscene amounts of money for an unfair advantage and/or to ruin other players' fun. It might cut down on people using blatant hacks in place of more subtle ones though.
barrysteve 4y ago
Community servers where the gamers are also the admins is the 'traditional' fix. Matchmaking killed off that option, so we're left with controlling technical solutions like kernel code and relinquishing the client-side benefits entirely in favour of cloud gaming. Honestly, I have no idea why people think Anti-cheat can work anymore than you can stop 0days or secure a bank account. Computers were fundamentally designed to be open machines that accept input on every possible level. We've locked ourselves into chasing a horse that's already bolted. Trying to secure the multi-headed hydra. The day anti-cheat is possible, is the same day you end piracy, kill the cybersecurity industry and shut down 'unauthorized' code of any kind. Do we really want that? Better to make cheater-policing the job of gamers themselves, with community servers and better tools.
the8472 4y ago
Botting can't be prevented anyway due to the analog hole. People are already making HDMI-capture + USB HID emulation devices for that purpose. Outright manipulation of game-state is a classic computer security issue. Just don't trust the client, calculate that on the server. I believe many games are doing this properly already but especially mobile games still suffer from it because they trust the client more to paper over intermittent connectivity problems. The information-disclosure kind of cheat, wallhacks and such, can be addressed by game design that minimizes the amount of information exposed to the client.

II2II 4y ago

I seem to recall a game giving me the option to install anti-cheat, with the caveat that anti-cheat was required for multiplayer. While it only solves the problem for people who stick to single player, at least the option exists. Likewise, it would also be nice for the option to exist for private servers. If the server admin trusts their users or is okay with anything goes, there is no need for anti-cheat.

Ntrails 4y ago
Anti cheat is also necessary if you design your game around micropayments I assume, so not purely a multiplayer issue. I am ok with that market dying in a fire admittedly..
- mpsprd 4y ago
  Not necessarily. Usually when micro-transactions are present everything is validated server side, Leading to always online games like diablo 3+. From my understanding kernel level anticheat is to detect things like aimbot, wallhack etc.
  - mehlmao 4y ago
    Off the top of my head, Genshin Impact is a mostly single-player game with some multiplayer functionality. It uses kernel level anti-cheat to make sure that microtransactions are protected. This driver had a known vulnerability that did not get patched for years and was used by malicious actors: https://www.bleepingcomputer.com/news/security/hackers-abuse-genshin-impact-anti-cheat-system-to-disable-antivirus/ https://www.bleepingcomputer.com/news/security/hackers-abuse... Street Fight 5 did the same thing; it was possible to unlock characters for local play using a trainer. They patched in a rootkit with known vulnerabilities in an attempt to prevent that.
- rtpg 4y ago
  I don't really think that's true. the content is usually in assets and just behind some flag that gets activated via some callout to a store, but there's not active anti-cheat software making sure that you "actually bought the content" in general() () technically a lot of games have anti-piracy measures that are somewhat active, but they're rarely of the "phone home" variety
TheRealDunkirk 4y ago
> anti-cheat was required for multiplayer. This is what I can't wrap my head around. Every multiplayer game I ever played on PC had cheaters in it. The anti-cheat stuff seems like it just inconveniences the good guys, and does little to stop the bad guys, so what's the actual point? I play on consoles now, and the fact that there are no cheaters is probably half the reasons why. I've seen video of Battlefield 1 on PC these days. It's comical, as long as it's not happening to me.
- MrJohz 4y ago
  I imagine it's similar to the logic behind locks on houses. Thieves still exist, but by making it harder for them, you reduce the chances of them targeting your house. You won't ever reduce that chance to zero, but you can reduce it significantly. Similarly, I imagine the more effort you have to put in to get through anti-cheat software, the more likely you are you give up and play a different game. There'll still be some people determined enough to bypass it, but that number will be smaller than it would be otherwise. Fwiw, I don't play these sorts of games, so I have no idea if this stuff is effective, but there's a comment somewhere in this thread saying that Valorant has fewer cheaters than other, similar games, in no small part due to their aggressive anti-cheating measures, so anecdotally it may well have an effect.
- dbg31415 4y ago
  Bans come in waves. So they let cheaters cheat for a bit... but they are recording all the programs and processes that everyone is running. Then, once they see the issue as being big enough to warrant action, they ban the highest "80%" of people running the cheat, in the last "3 months" (or whatever time period). I'm sure there's some magic threshold where they say, "Eh, this kid only had it running for a week, and the account he was running it on was 8 years old, and gosh... we really don't want more customer support calls and complaints. Let's let a few slide." I'm sure there is some sort of "how serious is this offense" algorithm. Video games have so many cheaters, but it's rare for the accounts to stay active for more than 3-6 months. But you're right, they should ban faster, and they should do more to stomp out cheating. For people who play by the rules... it seems unjust that they don't ban faster. One theory is that they time ban waves to increase sales. "Oh sales are down this month, better ban some more folks so they'll re-buy the game with new accounts." Don't forget, in a lot of games, players buying in-game currency (or items) is what fuels bots / cheating. The game makers need this sort of behavior to keep some percentage of "legitimate" players (the indirect cheaters) happy and on the platform. I'm sure they have all the math worked out. They ban at exactly the pace needed to maximize profit.

usrusr 4y ago

A clear opt-in should do the trick. Maybe even with some percentage indicating how much you'll miss without? (e.g. not much at all if it's mostly single player, everything if it's a competitive persistent works like Eve and something in between if there are both "open" and "regular" instances) Valve is the only organization that could pull that off, and it would further deepen the entrenchment of their position as the meta gamemaster of all PC play.

iforgotpassword 4y ago

"anti cheat" is the lazy solution, you can just buy it and be done with it, and if it fails you can blame someone else until they stepped up their game in this cat and mouse game. Take that whole tarkov meltdown for example (YouTube g0at tarkov cheater). Everybody is screaming "needs moar Anti-Cheat" left and right when the first thing I wonder is "why is the server sending every client the position, health and inventory of every other player all the time?" - obviously the answer is because it's the simplest approach. But it's by far not impossible to continuously run hitscan between all players on the server and not update any player positions for players that can't see each other. But of course that takes time and effort to make work reliably, so let's just install a ducking rootkit on every player's computer and use the developer resources to instead add microtransactions or whatever.

baby 4y ago
Anti cheat is part of the cat and mouse game it seems. If you think there’s a way without anti cheat you should try to write a serious proposal. There’s a lot of money involve in solving this plague in competitive gaming.
- iforgotpassword 4y ago
  Read my comment in it's entirety please. There's one very obvious improvement I suggest pretty much off the top of my head, I'm sure if you want to you'd come up with a dozen more. They aren't even trying.
  - deleted 4y ago
    [deleted]
  - smolder 4y ago
    I agree with you. There are several major games that transmit all player info at all times when it's really not necessary and makes "ESP" style hacks possible, which can be supremely unfair. Developers would rather tack on a rootkit than make engine changes to resist this kind of cheating.
  - 4y ago

2358452 4y ago

It's an important problem for fair interaction online in the future, I think. I believe the only real alternative would be something at the hardware level. Your hardware should be able to get into a mode where an executable has a protected memory address space, and maybe even a protected relationship with GPU memory and displays. Otherwise I think all anti-cheat tends to be (1) Fragile, relying on OS mechanisms that can be often bypassed; (2) Extremely intrusive from a security and privacy standpoint: they need to monitor your system, almost everything it's doing for any attempts to read or modify relevant memory or control input to give unfair advantage (or say bots) to some players. Finally, I guess we should remember there's always the famous 'analog hole' (a-hole) that defeats all mechanisms from simply capturing output and feeding it to another machine (that's very hard to plug). But because it really need dedicated hardware and significant effort, a hardware level anti-cheat would generally be a very significant solution to cheating without sacrificing users rights.

wmf 4y ago
Basically SGX.

josephcsible 4y ago

The alternative is doing cheat detection entirely server-side.

unethical_ban 4y ago
How do I detect you using an aim hack without seeing your machine?
- josephcsible 4y ago
  Have you ever spectated another player and quickly realized whether they were using an aim hack? How did you know?
  - _piif 4y ago
    That only works if they are using blatant instant snap-on aimhacks - which I fully agree should be checked for since that's one obvious target. If the aimbot is a bit more sophisticated where it mimics mouse movement though I don't see how that would work.
- the8472 4y ago
  Why do you think having access to the machine would help against computer vision and input emulators?

bombolo 4y ago

The alternative is reviewing the logs of people who constantly get kicked for cheating and ban them.

amiga-workbench 4y ago

One choice would be to price out cheaters. Have people pay a one-off fee for access to a premium tier of multiplayer servers. If you cheat, your access is pulled and you've got to go and spend more money to get back in. Something Awful did this with their forum and it does a pretty good job at keeping spammers and other irritants out.

josephcsible 4y ago
This creates a perverse incentive for the cheat detection system to have a lot of false positives.
_piif 4y ago
Didn't CSGO have something like that with their Prime account status? From what I've seen it wasn't very effective, people will gladly spend obscene amounts of money for an unfair advantage and/or to ruin other players' fun. It might cut down on people using blatant hacks in place of more subtle ones though.

barrysteve 4y ago

Community servers where the gamers are also the admins is the 'traditional' fix. Matchmaking killed off that option, so we're left with controlling technical solutions like kernel code and relinquishing the client-side benefits entirely in favour of cloud gaming. Honestly, I have no idea why people think Anti-cheat can work anymore than you can stop 0days or secure a bank account. Computers were fundamentally designed to be open machines that accept input on every possible level. We've locked ourselves into chasing a horse that's already bolted. Trying to secure the multi-headed hydra. The day anti-cheat is possible, is the same day you end piracy, kill the cybersecurity industry and shut down 'unauthorized' code of any kind. Do we really want that? Better to make cheater-policing the job of gamers themselves, with community servers and better tools.

the8472 4y ago

Botting can't be prevented anyway due to the analog hole. People are already making HDMI-capture + USB HID emulation devices for that purpose. Outright manipulation of game-state is a classic computer security issue. Just don't trust the client, calculate that on the server. I believe many games are doing this properly already but especially mobile games still suffer from it because they trust the client more to paper over intermittent connectivity problems. The information-disclosure kind of cheat, wallhacks and such, can be addressed by game design that minimizes the amount of information exposed to the client.