Hacker News Reader

Comment by fletchowns | Hacker News Reader

I wish there was some well respected third party reputation service that I could prove my identity to (government id, utility statements, etc) and then all games just integrate with this third party reputation service. Sort of an Olympic committee for gaming. Give me the option to only play with other verified players. Getting caught cheating in one game then impacts your reputation in _all_ games. There's a gazillion details that would need to be hammered out to get this right (appeal process, account hijack recovery, etc) but I think the idea has merit. I feel something like this is the only way to end cheating once and for all. Would be so nice if developers never had to think about anti-cheat again, and we didn't have to run all this super invasive anti-cheat software on our machines.

View on HN

You want to open up yourself to risk for your identity being stolen and normalize handing out personally identifiable information just to maybe make it harder for cheaters to get in on some of your games?

I don't think the idea has merit. See how long it is taking the Real ID act to become enforced. People barely trust the government with this info, with the ability to get on a plane (among other things) at stake.

Thanks to the magic of cryptography, it's possible to prove your identity to someone else without enabling them to impersonate you.

For instance, the third party gives you a nonce, you sign it with your private key, and they verify it with your public key.

Then I can make one key per game.

Self-defeating, since part of the point is that your reputation is based on multiple games, so by only playing one game your account already looks suspicious.

What's suspicious about only playing one online game?

Nothing really, unless people are already suspicious that you're cheating, then having no other games on your account looks extra suspect. The system isn't meant for objective measurement, so if people think you're cheating and you don't have a reputation score to back up your claim that you aren't then you'll probably get banned pretty quickly.

Well, your public key is not exactly the same as your identity.

Presumably, there's a commonly-trusted authority that signed your public key, attesting that the key corresponds to some "identity".

If you're concerned about revealing your identity to the third party, there are other schemes. Check out https://datatracker.ietf.org/wg/privacypass/about/

This doesn't solve the issue of stolen accounts, or fraud.

Game companies won't accept a system that has a non-recoverable state like a deleted private key.

If you can assign a new key to your account, then the private keys don't improve trust, and remove the point in having them instead of just OAuth.

In games like Dota 2, there's already an industry for account selling.

It's pretty simple really,

Find some Boomer's ID, who barely does anything but browsers facebook (or better yet, buy an ID of one of the billion in the 3rd world).

Sign up to this service using their id, hire some poor kids in the 3rd world to level up the account without cheats to build rep, then sell the account to a hacker.

Private keys don't solve any of this.

If you get financing on purchasing a car you have to give financial institutions your personal information, I don't see this as being any worse. Even companies that I'd prefer not to do business with have all my personal details, because there isn't really any alternative. My identity was stolen as part of the Equifax breach. Certain organizations are more reputable than others, and I want this gaming reputation service to be well respected and trustworthy, since that's the only way something like this can work. It's hard to get right, but it can be done.

The alternative is having to run third party closed source anti-cheat software on my computer that is written by god knows who, that has the potential to do an enormous amount of damage if a bad actor were to sneak in a backdoor.

> You want to open up yourself to risk for your identity being stolen and normalize handing out personally identifiable information just to maybe make it harder for cheaters to get in on some of your games?

If you look at how much how much time and effort and money people put into these games, it doesn't seem so unreasonable. Another commenter pointed out that you have to give a similar amount of personal information to get a car loan, or, as you say, to get a plane ticket. I suspect a lot of people spend comparable amounts of money and effort on gaming, and probably see it as a bigger part of their lives.

> Getting caught cheating in one game then impacts your reputation in _all_ games.

This sounds pretty similar to Steam's VAC (Valve Anti Cheat) system aside from how widespread you want the system to be. IIRC, owners of Source-based game servers can set a flag to allow/deny users with a VAC ban. I don't think this is available to non-source games, which would be needed for your idea.

> How do VAC bans relate to phone numbers?

> VAC bans are applied to all accounts sharing a phone number at the time of the infraction.

> Can I move my items and games to a different Steam account?

> No.

https://help.steampowered.com/en/faqs/view/647C-5CC1-7EA9-3C...

This is probably the best solution I've seen around anti-cheat solutions. I also think this is the best approach to prevent abuse on social media.

I can't be the only one sick of what a sewer the internet, like multiplayer gaming and especially social media, has become.

Being able to play Call of Duty without people screaming the N word into my ears regularly would be amazing. Intolerance to hate speech could be something enforced by this hypothetical service as well.

Sure I can turn off the death mic, but there's been some really amazing interactions though it as well. For those not aware, the death mic in CoD is a feature where the instant you frag somebody in game, it turns their mic on, so you can hear their very candid reaction. Lots of times it's things like "no way what a shot how'd that guy get me!". Such a fun feature, if it wasn't for people that just utter the most offensive things imaginable on it.

Have you ever glanced at the Facebook comments under a news article? It did nothing at all to stop online toxicity when they tied your online persona to your identity, photograph, the identity of all your friends and family, etc. Plenty of pictures of smiling grandfathers holding babies next to N-word-laden rants out there

It's not just the tying of ones online identity to their real life identity that would mitigate this issue though. It's the fact that if a punishment is doled out (voice comms restricted for hate speech, or a ban issued for cheating), then you could be certain that the person isn't just going to register a new account and keep doing it, because the barrier of registering a new account would be so much higher (having to prove your identity to my theoretical reputation service).

OK, imagine this: A 13 year old makes an account, goes through your onerous KYC process, plays some game. Gets banned for saying something offensive under his breath when the game suddenly turns his mic on without him expecting it.

You're thinking "Great, problem solved, this kid will literally never be allowed to play another video game as long as he lives"

OK, in actuality, he's just going to use his mom's ID next time. And his dad's. And his grandparents' IDs. etc, etc

There'll be a whole gray market for IDs from all over the world to pair to your ridiculous Orwellian service, because thankfully it won't be backed up by penalty of death

I don't think a single infraction of hate speech would warrant any consequences, it would need to be a multiple offenses before punishment is doled out. This punishment could just be a temporary loss of voice communication privileges. Eventually if they are a habitual offender, it could lead to longer loss of voice comms, and then eventually a repeat ban.

Producing identity verification documents that many times over and over is not something a 13 year old will likely be able to do, relatives would certainly raise questions from those relatives as to why they need them.

I see the ridiculous Orwellian service is being the anti-cheat software we have to run already.

Right now you get muted and banned pretty quickly for mouthing off in any online game. Most games have some combination of costing $60+ up front, being pay-to-win, and/or being grind-to-win, so getting permanently banned from any of them is pretty catastrophic. Yet plenty of people get banned and re-buy the games regularly anyway

>You're thinking "Great, problem solved, this kid will literally never be allowed to play another video game as long as he lives"

And that is great, why? Is it okay to hold people accountable for their whole lives, for actions they did as literal children?

> it turns their mic on,

Well that's horrifying. I'm glad I don't use Windows, and I'm glad my computer physically does not have a microphone for malware to enable.

I'm not sure how the system works, but I think it's safe to assume that the user needs to have enabled their microphone first for this to work.

You can disable it if you'd like, but nearly everybody leaves it on because it's a pretty fun feature most of the time :)

So, like that black mirror episode?

yeah, no shit

You guys can just move to South Korea or China if you want to live with that authoritarian BS

China I understand, but what's up with pairing it with South Korea?

South Korea has government ids linked to game accounts and cheating is illegal in the go to jail sense.

Because SK also does it?

It would also be nice if people were able to use cheats in a game against other people with cheats. It would be very enjoyable to watch battle of the bots in games and have people pit their programming skills against each other like this.

I seem to recall a certain game that had a shadowban system that just put all the cheaters in the same lobbies together. Might be misremembering that though.

Titanfall: https://www.forbes.com/sites/danielnyegriffiths/2014/03/27/t...

I recall rumour that the relatively recent Fall Guys had such a system. A quick search seemingly shows confirmation from an official Twitter account.

Those exist. They're called HvH. You can search it on youtube, and for some games there are HvH servers you can spectate :)

CSGO cheaters actually do this it’s called HvH (hack vs hack)

Sending away all of your PII to be verified in games isn’t much better (in terms of intrusiveness) than running anti-cheat software in the first place.

Additionally, will it be any harder to get around a system like this than a traditional anti-cheat system? Theoretically - for the average player at least, it might make cheating worse - assuming the cheater runs their cheats in a realistic way, in your world, there is now no detection software pinpointing the cheaters!

> Sending away all of your PII to be verified in games isn’t much better (in terms of intrusiveness) than running anti-cheat software in the first place.

In my mind it's much better than running N number of different anti-cheat software on my machine, assuming that this reputation management entity is very well respected. Again, it'd be very hard to get a system like this right, but I think it is certainly possible.

As a casual player another way to alleviate cheating is good matchmaking, so cheaters all rank up to other cheaters. This doesn’t help higher-level players though.

Some cheats run outside the OS and are basically indistinguishable from regular players. So anti-cheat won’t work. Good matchmaking + still catching cheats for impossible stuff + real tournaments requiring in-person attendance or heavy monitoring, should still work pretty well.

In a world of free to play games, cheaters just keep making new accounts. I don't think it can be solved simply by matchmaking.

It doesn't work across multiple games but Counter-Strike: Global Offensive has a system where you enter your phone number to verify your account and then can queue only with other verified players.

The phone number is not much of a barrier. I'm a verified player and only queue with other verified players, and I encounter cheaters regularly in CSGO.

Cheaters already purchase verified accounts.

That sounds like a great way to get lots of non-cheating players to give up online gaming once it becomes mandatory for the majority of online play (which it would if it took off).

I'm not sure if you actually believe that. If the population I've observed is any way representative, we'd be more than happy to give full root level access if it means the cheaters actually vanish.

You might be severely underestimating how much comp gamers hate cheaters.

> I'm not sure if you actually believe that.

First of all, fuck you for assuming bad faith.

> we'd be more than happy to give full root level access if it means the cheaters actually vanish

Except it won’t - cheaters will move on to using other methods. There already exist external, undetectable methods for cheating that involve running the cheat software on other machines. Requiring this level of access is just pouring fuel on the fire of the arms race here, and the potential harm it will cause to non-cheaters is worse than whatever harm getting pwned by skriptkiddies in your bang bang shooty shoot live service Skinner box simulator can cause. This is an attempt at a technical solution to a social problem - you can’t patch meat and brain.

> You might be severely underestimating how much comp gamers hate cheaters.

Actually, I’m not. I’ve been on streams where competitive gamers meltdown and threaten to kill their opponents. But just like murdering people who beat you is morally wrong so is forcing everyone who wants to play a game to effectively give over control of their machines to the game makers through intrusive, kernel level anti-cheat.

I had someone invade the League of Legends account I used for almost a decade after me not using it for a year or so and cheat to their hearts content. That caused the account to get permanently banned with absolutely zero help from Riot Games' support on how to get it revised.

In your system I'd never be able to play an online game again, only because a single account of mine used an email / password combination that leaked god knows where. Needless to say I'm not a fan.

Yes this is a very real issue that would need to be solved by the service I proposed, I specifically called out the appeals process and account hijacking resolution in my original comment due to their importance. It needs to be centralized because it's an impossible task to ask every game studio to get all these things right.

this type of solution sounds good until you get hit by a false positive in a game.

happened to me on pugb and the only way I could get my account back was with a paypal charge back. It's very typical that game companies refuse to tell users what triggered it or how to avoid it in the future. For all I know, it could have been a scam from the devs.

I can live with a 40 - 60$ loss on a game, but losing the ability to play all games on protected servers forever would be really bad

Yup it's a valid point, that's why I made sure to call out in my original comment. So many little details that would need to be done right in order to make it work.

It's an impossible task for every game studio to get all those details right, that's why I think it needs to be centralized. That way game studios can just worry about making cool games, and not having to waste resources on this endless arms race of cheating.

Reply on news.ycombinator.com