6 ms·

Never forget the risks of trusting game companies with this sort of access to your machine. https://www.vice.com/en/article/fs-labs-flight-simulator-password-m

Never forget the risks of trusting game companies with this sort of access to your machine. https://www.vice.com/en/article/fs-labs-flight-simulator-password-malware-drm/ https://www.vice.com/en/article/fs-labs-flight-simulator-pas... Company decides to "catch pirates" as though it was police. Ships a browser stealer to consumers and exfiltrates data via unencrypted channels. https://old.reddit.com/r/Asmongold/comments/1cibw9r/valorant_now_takes_screenshots_of_your_pc/ https://old.reddit.com/r/Asmongold/comments/1cibw9r/valorant... https://www.unknowncheats.me/forum/anti-cheat-bypass/634974-vanguard-taking-screenshot-pc.html https://www.unknowncheats.me/forum/anti-cheat-bypass/634974-... Covertly screenshots your screen and sends the image to their servers. https://www.theregister.com/2016/09/23/capcom_street_fighter_v/ https://www.theregister.com/2016/09/23/capcom_street_fighter... https://twitter.com/TheWack0lian/status/779397840762245124 https://twitter.com/TheWack0lian/status/779397840762245124 https://fuzzysecurity.com/tutorials/28.html https://fuzzysecurity.com/tutorials/28.html https://github.com/FuzzySecurity/Capcom-Rootkit https://github.com/FuzzySecurity/Capcom-Rootkit Yes, a literal privilege escalation as a service "anticheat" driver. Trusting these companies is insane. Every video game you install is untrusted proprietary software that assumes you are a potential cheater and criminal. They are pretty much guaranteed to act adversarially to you. Video games should be sandboxed and virtualized to the fullest possible extent so that they can access nothing on the real system and ideally not even be able to touch each other. We really don't need kernel level anticheat complaining about virtualization.

invokestatic 8mo ago
The privacy points in general are valid, but what irritates me is using this rationale against kernel mode anti cheats specifically. You do not need kernel access to make spyware that takes screenshots. You do not need a privileged service to read the user’s browser history. You can do all of this, completely unprivileged on Windows. People always seem to conflate kernel access with privacy which is completely false. It would in fact be much harder to do any of these things from kernel mode.
- matheusmoreira 8mo ago
  There is no need for irritation. I condemn all sorts of anticheating software. As far as I'm concerned, if the player wants to cheat he's just exercising his god given rights as the owner of the machine. The computer is ours, we can damn well edit any of its memory if we really want to. Attempts to stop it from happening are unacceptable affronts to our freedom as users. Simply put, the game companies want to own our machines and tell us what we can or can't do. That's offensive. The machine is ours and we make the rules. I single out kernel level anticheats because they are trying to defeat the very mitigations we're putting in place to deal with the exact problems you mentioned. Can't isolate games inside a fancy VFIO setup if you have kernel anticheat taking issue with your hypervisor.
  - ryeguy 8mo ago
    This take sucks. The anticheat software in this context is for competitive games. No one cares about people cheating in isolation in single player games. The anticheat is to stop 1 guy from ruining it for the 9 others he's playing with online. You can argue about the methods used for anticheat, but your comment here is trying to defend the right to cheat in online games with other people. Just no.
    - matheusmoreira 8mo ago
      > The anticheat is to stop 1 guy from ruining it for the 9 others he's playing with online. Don't play with untrusted randoms. Play with people you know and trust. That's the true solution.
      - jack_pp 8mo ago
        That is not the solution if you want to play competitively of whenever you feel like it. Kernel level AC is a compromise for sure and it's the gamers job to assess if the game is worth the privacy risk but I'd say it's much more their right to take that risk than the cheaters right to ruin 9 other people's time for their own selfish amusement
Thaxll 8mo ago
Game compagny have to have those kernel anti cheat because MS never implemented proper isolation in the first place, if Windows was secured like an apple phone or a console there wouldn't be a need for it. Anti cheat don't run on modern console, game dev knoes that the latest firmware on a console is secure enough so that the console can't be tempered.
- matheusmoreira 8mo ago
  Consoles and phones are "secure" because you don't own them. They aren't yours. They belong to the corporations. They're just generously allowing you to use the devices. And only in the ways they prescribe. This is the exact sort of nonsense situation I want to prevent. We should own the computers, and the corporations should be forced to simply suck it up and deal with it. Cheating? It doesn't matter. Literal non-issue compared to the loss of our power and freedom. It's just sad watching people sacrifice it all for video games. We were the owners of the machine but we gave it all up to play games. This is just hilarious, in a sad way.
  - huthuthukhuo 8mo ago
    who are you to judge what gamers should care about?
    - matheusmoreira 8mo ago
      A fellow gamer.
- huthuthukhuo 8mo ago
  one of those secure consoles you talk about, Xbox, is running Windows as OS
- Cloudef 8mo ago
  Trusted computing isn't about security. Its about vendors not trusting you.
quotemstr 8mo ago
And if we embraced instead of feared remote attestation and secure enclaves, the days of game companies having this level of access would come to an end.
- matheusmoreira 8mo ago
  That's arguably even worse. Remote attestation means you get banned from everything if you "tamper" with "your" computer. Remote attestation is the ultimate surrender. It's not really your machine anymore. You don't have the keys to the machine. Even if you did, nobody would trust attestations made by those keys anyway. They would only trust Google's keys, Apple's keys. You? You need not apply.

invokestatic 8mo ago

The privacy points in general are valid, but what irritates me is using this rationale against kernel mode anti cheats specifically. You do not need kernel access to make spyware that takes screenshots. You do not need a privileged service to read the user’s browser history. You can do all of this, completely unprivileged on Windows. People always seem to conflate kernel access with privacy which is completely false. It would in fact be much harder to do any of these things from kernel mode.

matheusmoreira 8mo ago
There is no need for irritation. I condemn all sorts of anticheating software. As far as I'm concerned, if the player wants to cheat he's just exercising his god given rights as the owner of the machine. The computer is ours, we can damn well edit any of its memory if we really want to. Attempts to stop it from happening are unacceptable affronts to our freedom as users. Simply put, the game companies want to own our machines and tell us what we can or can't do. That's offensive. The machine is ours and we make the rules. I single out kernel level anticheats because they are trying to defeat the very mitigations we're putting in place to deal with the exact problems you mentioned. Can't isolate games inside a fancy VFIO setup if you have kernel anticheat taking issue with your hypervisor.
- ryeguy 8mo ago
  This take sucks. The anticheat software in this context is for competitive games. No one cares about people cheating in isolation in single player games. The anticheat is to stop 1 guy from ruining it for the 9 others he's playing with online. You can argue about the methods used for anticheat, but your comment here is trying to defend the right to cheat in online games with other people. Just no.
  - matheusmoreira 8mo ago
    > The anticheat is to stop 1 guy from ruining it for the 9 others he's playing with online. Don't play with untrusted randoms. Play with people you know and trust. That's the true solution.
    - jack_pp 8mo ago
      That is not the solution if you want to play competitively of whenever you feel like it. Kernel level AC is a compromise for sure and it's the gamers job to assess if the game is worth the privacy risk but I'd say it's much more their right to take that risk than the cheaters right to ruin 9 other people's time for their own selfish amusement

Thaxll 8mo ago

Game compagny have to have those kernel anti cheat because MS never implemented proper isolation in the first place, if Windows was secured like an apple phone or a console there wouldn't be a need for it. Anti cheat don't run on modern console, game dev knoes that the latest firmware on a console is secure enough so that the console can't be tempered.

matheusmoreira 8mo ago
Consoles and phones are "secure" because you don't own them. They aren't yours. They belong to the corporations. They're just generously allowing you to use the devices. And only in the ways they prescribe. This is the exact sort of nonsense situation I want to prevent. We should own the computers, and the corporations should be forced to simply suck it up and deal with it. Cheating? It doesn't matter. Literal non-issue compared to the loss of our power and freedom. It's just sad watching people sacrifice it all for video games. We were the owners of the machine but we gave it all up to play games. This is just hilarious, in a sad way.
- huthuthukhuo 8mo ago
  who are you to judge what gamers should care about?
  - matheusmoreira 8mo ago
    A fellow gamer.
huthuthukhuo 8mo ago
one of those secure consoles you talk about, Xbox, is running Windows as OS
Cloudef 8mo ago
Trusted computing isn't about security. Its about vendors not trusting you.

quotemstr 8mo ago

And if we embraced instead of feared remote attestation and secure enclaves, the days of game companies having this level of access would come to an end.

matheusmoreira 8mo ago
That's arguably even worse. Remote attestation means you get banned from everything if you "tamper" with "your" computer. Remote attestation is the ultimate surrender. It's not really your machine anymore. You don't have the keys to the machine. Even if you did, nobody would trust attestations made by those keys anyway. They would only trust Google's keys, Apple's keys. You? You need not apply.