Hacker News Reader

Comment by josephcsible | Hacker News Reader

It's another case of where "security" means keeping your computer secure from you. And the password stealer argument is just stupid: by the time EAC kicks in, your password is already stolen.

View on HN

This is only partially true. Once the knowledge that unofficial clients won’t work gets out people won’t go looking for them.

Unofficial malicious clients will still work, only the safe open source ones won't. Dodgy EAC bypasses seem to be easy to find, and will likely put people who try to use them at real risk.

It's actually really hard to distribute a cheat to a lot of people without it getting flagged.

Yeah, let me clarify my argument there. Open source, safe, well-known clients, mods or modding systems can easily be monitored for workarounds and flagged, and become unviable. Malicious actors with second intentions however can keep finding new exploits and releasing small, obscure, harmful software that has way less exposure because the vast majority of people are not interested in harming anyone, they just want their mods to do something minor like displaying screenshots in the loading screen or adding support for eye tracking. They will not seek these out. These will be sold (financial incentive) or used by people with too much time on their hands and an axe to grind.

How so?

They are saying if you download an application (e.g. vrchat.exe) from the internet than it can steal your passwords as soon as you launch it.

That's not what VRchat's blog post say at all, though.

"Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes as well as other information. These users – often without even realizing it! – run the risk of losing their account, or having their computers become part of a larger botnet."

People running a backdoor client and getting their passwords stolen? That doesn't sound... wrong?

The wrong part is that somehow EAC will help prevent that. It won't.

It would prevent it in a way that you know that the mod you are downloading is not likely to work and you wouldn't download it in the first place.

Not really, some mods will still work

The chance of some application downloaded for free on the internet will bypass EAC is minuscule

You can do whatever you want with your computer, just don't try to connect to their proprietary servers.

But now you're into the Service-as-a-Software-Substitute problem. I can't usefully use the VRChat client without doing that.

I agree but I was replying to your initial point about locking down our computers. I think the downvoters don't get this.

I think there's a case to be made that VRChat allowing mods in a safe way is possible, if they wanted to do it. But they clearly don't see value in that. I hope they're proven wrong soon.

Reply on news.ycombinator.com