5 ms·

Realistically what is the alternative? That is pretty much the only way to ensure the cheats don't run at kernel level. If the cheat runs at kernel level it is

by doikor 1y ago

Realistically what is the alternative? That is pretty much the only way to ensure the cheats don't run at kernel level. If the cheat runs at kernel level it is very hard (or impossible) to detect it from user land outside of behavior (which mostly happens on the server side). Only thing I can think of is Microsoft locking down Windows so hard that nothing outside of code written (well signed) by Microsoft can run with kernel level privileges but I think that is an even worse option. If you don't like it you can always just go and play any of the titles without kernel level anti-cheat and get a cheater in ~1/5th of your games (my experience in counter strike).

jjmarr 1y ago
Chess essentially has ID verification at a high level because the best players can go to real-life tournaments and get titles for the prestige, which grants them free premium accounts on major platforms. It's easier to analyze the subset of top-tier players that aren't verified. I'd rather just give Riot Games my driver's licence than full access to my computer. They already know my name and where I live from metadata. There should be a KYC solution for gaming where a company like Epic, Riot, or Valve verifies your identity and developers can gate competitive video games behind that. If you cheat, you're out for 5-10 years (so dumb teenagers aren't locked out forever). The big issue imo isn't banning cheaters, it's preventing them from creating a new account and cheating again. Such a system would be free money & low maintenance for whatever company develops it first.
- doikor 1y ago
  This is actually how cheating is "solved" to some degree in South Korea. Basically you can't play without logging in with your government provided id. Though they do also use it for stuff like under 16 year olds not being able to play online games between midnight and 6am. edit: Some extra details about this from a few months ago https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 > KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.
  - jimmydorry 1y ago
    This makes the stakes for getting caught cheating, much higher. It does nothing to "solve" cheating. If someone is using additional code to gain an un-fair advantage, knowing who they are does nothing to detect this.
    - doikor 1y ago
      But it does lower the amount of cheaters as the consequences are bigger. Also makes manual banning/moderation much more cost effective as the bans actually stick. At the end of the day the goal isn't 0 cheaters but having few enough that the chance of your match being ruined by one is 1 or 2% instead of 10 or 20%
    - jjmarr 1y ago
      It's relatively easy to catch cheaters. There's constant banwaves in Valorant, CS2, and Rainbow Six Siege. The challenge is that cheat authors fix their exploits to be undetectable, and the cheaters get a new account in a week or two. This means detecting cheats does not have a lasting impact on cheating's presence in a game. The prevalence of cheating is the problem a game developer is trying to solve.
- bob1029 1y ago
  I don't see why something like ChexSystems IDV wouldn't be viable here. Acquire my identity in the same way you would if I was seeking approval for a new checking account or loan. I'd be perfectly happy to see the bar raised a few inches off the ground. The current state of competitive video games is really bad.
- fc417fc802 1y ago
  The other obvious solution is to charge enough for accounts that it covers moderation costs plus some extra. That way with each ban wave either the number of cheaters goes down or the funding for moderation to catch them goes up. Maybe let people opt-in to photo ID verification if they want a one-time free account.
razemio 1y ago
It seriously isn't. Effectively you can not ban cheating. A cheater can just use virtual or modified hardware keyboards, displays and mice to cheat. How is a kernel extension going to prevent that? That is the logical next step, which is already being done by some (currently less than alpha). Once we reach this state as a default, nothing can prevent cheating, besides a real tournament with checked hardware. All the effort riot is currently putting into this will be for nothing. I do not understand, how they are missing that.
- doikor 1y ago
  That is what you use behavior detection for. If you don't give human like inputs from the cheat it is detectable and if you limit yourself to what a human can do then the cheat is not very desirable. > “You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” said Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.” But if you read the article they do have some way to detect (some) DMA based hacks too where the actual cheat runs on a different computer and use DMA through a pci-express card to read/write directly into memory. > “I think we detect the majority of it today, but it’s kind of iterative,” said Koskinas. Though most cheaters "rage cheating" after losing really badly and using cheats to "get back" and those are much easier to detects. This kind of "download random cheat from the internet" at the best only get you banned and at worst your computer is super duper hacked (you are effectively manually downloading a virus and manually giving it admin/kernel level access) > Thanks to all these techniques and strategies, most cheaters can now be roughly divided into two categories. The first, representing the majority of cheaters, is made up by those who are “rage cheating” by using cheap tools that are easy to detect. Riot employees sarcastically call these cheats “download-a-ban,” according to Koskinas. At the end of the day all I know from my own experience is that the difference in the amount of cheaters I run into between Counter Strike and Valorant is massive and the main claimed difference being kernel level stuff in Valorants anti cheat (or Valve is just really really bad at making anti cheats)
  - frosting1337 1y ago
    Valve is really bad at anti cheat. As in, their solution can barely be _called_ anti-cheat.
orbital-decay 1y ago
>Realistically what is the alternative? What even makes you think it's a solvable problem? Even with a totally cryptographically controlled end-to-end hardware chain that treats the player like an adversary/inmate (like in the consoles, maybe even more strict) there's always a possibility of ML-based cheats with a low-latency camera. Barely anyone does that now because there are easier methods, but trust me, it will get used if required, just like DMA is used now. People already throw crazy money into cheating. It's a race to the bottom where everybody eventually loses except the corporations. Players never get rid of the cheaters completely, unrelated people who don't play games get their hardware+software locked down because of a bunch of whiny gamers, and corpos obtain the ultimate vendor lock. The optimal amount of bad behavior is not zero.
- doikor 1y ago
  So just because lock picking lawyer can pick the locks at your home you should just get rid of the locks? (and maybe even the doors too) Making it hard enough is good enough. The difference in 1% of games having a cheater and 5 or 10% is massive in the player experience.
  - JadeNB 1y ago
    > So just because lock picking lawyer can pick the locks at your home you should just get rid of the locks? (and maybe even the doors too) If the locks treated me, the legitimate owner, as a criminal and required the kind of low-level access that software that runs at the kernel level gets, and still didn't work, then maybe.
  - dingnuts 1y ago
    it's more like, I'm not going to spend money on a smart lock that reports my movements to a third party just so a burglar can chuck a landscaping stone through my window and unlock the door
  - wiseowise 1y ago
    > So just because lock picking lawyer can pick the locks at your home you should just get rid of the locks? (and maybe even the doors too) The solution is not to make the lock so hard that it inconveniences you, the user, it is to shoot intruder on sight (aka better moderation).
candiddevmike 1y ago
Community servers that people can host and create hacker-free spaces.
squigz 1y ago
Is there any actual data on how prevalent cheating really is? In my experience, it's not remotely as big of an issue as some people make it out to be...
- doikor 1y ago
  In my personal experience with counter strike is around 20% of the games has at least one cheater (one that is very obvious. usually aimbot). There could be more careful with usage of wallhacks etc that are harder to detect for the other players. Here is some graphs for Valorant https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 basically reaching ~10% at its worst (when Riot devs are only xmas holidays) and around ~1% at its best (~now). And this is the number of caught cheaters so actual amount of cheaters is probably slightly higher. Here is someone doing a "study" in counter strike https://old.reddit.com/r/GlobalOffensive/comments/1bnhikf/the_state_of_the_game/ https://old.reddit.com/r/GlobalOffensive/comments/1bnhikf/th... > Out of 60 games, I had 28 games with spinbotters. 28 is an absolutely insane number. 17 games had the spinbotter on the enemy team, 11 games had the spinbotter on my team. Keep in mind though, some games had more than 1 spinbotter, bringing the total number to 36 spinners in 60 games. (spinbot is a form of aimbot that is very obvious)
dfxm12 1y ago
We can play online games on purpose made hardware, leaving more freedom over our PC's

by doikor 1y ago

jjmarr 1y ago

Chess essentially has ID verification at a high level because the best players can go to real-life tournaments and get titles for the prestige, which grants them free premium accounts on major platforms. It's easier to analyze the subset of top-tier players that aren't verified. I'd rather just give Riot Games my driver's licence than full access to my computer. They already know my name and where I live from metadata. There should be a KYC solution for gaming where a company like Epic, Riot, or Valve verifies your identity and developers can gate competitive video games behind that. If you cheat, you're out for 5-10 years (so dumb teenagers aren't locked out forever). The big issue imo isn't banning cheaters, it's preventing them from creating a new account and cheating again. Such a system would be free money & low maintenance for whatever company develops it first.

doikor 1y ago
This is actually how cheating is "solved" to some degree in South Korea. Basically you can't play without logging in with your government provided id. Though they do also use it for stuff like under 16 year olds not being able to play online games between midnight and 6am. edit: Some extra details about this from a few months ago https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 > KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.
- jimmydorry 1y ago
  This makes the stakes for getting caught cheating, much higher. It does nothing to "solve" cheating. If someone is using additional code to gain an un-fair advantage, knowing who they are does nothing to detect this.
  - doikor 1y ago
    But it does lower the amount of cheaters as the consequences are bigger. Also makes manual banning/moderation much more cost effective as the bans actually stick. At the end of the day the goal isn't 0 cheaters but having few enough that the chance of your match being ruined by one is 1 or 2% instead of 10 or 20%
  - jjmarr 1y ago
    It's relatively easy to catch cheaters. There's constant banwaves in Valorant, CS2, and Rainbow Six Siege. The challenge is that cheat authors fix their exploits to be undetectable, and the cheaters get a new account in a week or two. This means detecting cheats does not have a lasting impact on cheating's presence in a game. The prevalence of cheating is the problem a game developer is trying to solve.
bob1029 1y ago
I don't see why something like ChexSystems IDV wouldn't be viable here. Acquire my identity in the same way you would if I was seeking approval for a new checking account or loan. I'd be perfectly happy to see the bar raised a few inches off the ground. The current state of competitive video games is really bad.
fc417fc802 1y ago
The other obvious solution is to charge enough for accounts that it covers moderation costs plus some extra. That way with each ban wave either the number of cheaters goes down or the funding for moderation to catch them goes up. Maybe let people opt-in to photo ID verification if they want a one-time free account.

razemio 1y ago

It seriously isn't. Effectively you can not ban cheating. A cheater can just use virtual or modified hardware keyboards, displays and mice to cheat. How is a kernel extension going to prevent that? That is the logical next step, which is already being done by some (currently less than alpha). Once we reach this state as a default, nothing can prevent cheating, besides a real tournament with checked hardware. All the effort riot is currently putting into this will be for nothing. I do not understand, how they are missing that.

doikor 1y ago
That is what you use behavior detection for. If you don't give human like inputs from the cheat it is detectable and if you limit yourself to what a human can do then the cheat is not very desirable. > “You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” said Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.” But if you read the article they do have some way to detect (some) DMA based hacks too where the actual cheat runs on a different computer and use DMA through a pci-express card to read/write directly into memory. > “I think we detect the majority of it today, but it’s kind of iterative,” said Koskinas. Though most cheaters "rage cheating" after losing really badly and using cheats to "get back" and those are much easier to detects. This kind of "download random cheat from the internet" at the best only get you banned and at worst your computer is super duper hacked (you are effectively manually downloading a virus and manually giving it admin/kernel level access) > Thanks to all these techniques and strategies, most cheaters can now be roughly divided into two categories. The first, representing the majority of cheaters, is made up by those who are “rage cheating” by using cheap tools that are easy to detect. Riot employees sarcastically call these cheats “download-a-ban,” according to Koskinas. At the end of the day all I know from my own experience is that the difference in the amount of cheaters I run into between Counter Strike and Valorant is massive and the main claimed difference being kernel level stuff in Valorants anti cheat (or Valve is just really really bad at making anti cheats)
- frosting1337 1y ago
  Valve is really bad at anti cheat. As in, their solution can barely be _called_ anti-cheat.

orbital-decay 1y ago

>Realistically what is the alternative? What even makes you think it's a solvable problem? Even with a totally cryptographically controlled end-to-end hardware chain that treats the player like an adversary/inmate (like in the consoles, maybe even more strict) there's always a possibility of ML-based cheats with a low-latency camera. Barely anyone does that now because there are easier methods, but trust me, it will get used if required, just like DMA is used now. People already throw crazy money into cheating. It's a race to the bottom where everybody eventually loses except the corporations. Players never get rid of the cheaters completely, unrelated people who don't play games get their hardware+software locked down because of a bunch of whiny gamers, and corpos obtain the ultimate vendor lock. The optimal amount of bad behavior is not zero.

doikor 1y ago
So just because lock picking lawyer can pick the locks at your home you should just get rid of the locks? (and maybe even the doors too) Making it hard enough is good enough. The difference in 1% of games having a cheater and 5 or 10% is massive in the player experience.
- JadeNB 1y ago
  > So just because lock picking lawyer can pick the locks at your home you should just get rid of the locks? (and maybe even the doors too) If the locks treated me, the legitimate owner, as a criminal and required the kind of low-level access that software that runs at the kernel level gets, and still didn't work, then maybe.
- dingnuts 1y ago
  it's more like, I'm not going to spend money on a smart lock that reports my movements to a third party just so a burglar can chuck a landscaping stone through my window and unlock the door
- wiseowise 1y ago
  > So just because lock picking lawyer can pick the locks at your home you should just get rid of the locks? (and maybe even the doors too) The solution is not to make the lock so hard that it inconveniences you, the user, it is to shoot intruder on sight (aka better moderation).

candiddevmike 1y ago

Community servers that people can host and create hacker-free spaces.

squigz 1y ago

Is there any actual data on how prevalent cheating really is? In my experience, it's not remotely as big of an issue as some people make it out to be...

doikor 1y ago
In my personal experience with counter strike is around 20% of the games has at least one cheater (one that is very obvious. usually aimbot). There could be more careful with usage of wallhacks etc that are harder to detect for the other players. Here is some graphs for Valorant https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 basically reaching ~10% at its worst (when Riot devs are only xmas holidays) and around ~1% at its best (~now). And this is the number of caught cheaters so actual amount of cheaters is probably slightly higher. Here is someone doing a "study" in counter strike https://old.reddit.com/r/GlobalOffensive/comments/1bnhikf/the_state_of_the_game/ https://old.reddit.com/r/GlobalOffensive/comments/1bnhikf/th... > Out of 60 games, I had 28 games with spinbotters. 28 is an absolutely insane number. 17 games had the spinbotter on the enemy team, 11 games had the spinbotter on my team. Keep in mind though, some games had more than 1 spinbotter, bringing the total number to 36 spinners in 60 games. (spinbot is a form of aimbot that is very obvious)

dfxm12 1y ago

We can play online games on purpose made hardware, leaving more freedom over our PC's