Page 2 of 3

Re: Server and security

Posted: Sun May 24, 2015 1:39 am
by I~=Spam
Robin wrote:
T-Bone wrote:Inny, your note about screenshots gave me an idea: The client could take a screenshot and send it to the server, which could then use image analysis tools to determine if it seems legit or not.
The image analysis tool would likely be harder to write than something breaking that same tool.
I agree. One could just hack the game source and put a fake high score in. Or they could use photoshop.

Re: Server and security

Posted: Sun May 24, 2015 7:02 pm
by cohadar
Not all problems with software should be solved with software.

Re: Server and security

Posted: Sun May 24, 2015 7:22 pm
by bobbyjones
There has to be a decent way to verify high scores.

Re: Server and security

Posted: Sun May 24, 2015 7:43 pm
by s-ol
bobbyjones wrote:There has to be a decent way to verify high scores.
There can't be, thats why every single Google play games highacore table shows the same global record (maximum number representable by int) and tools exist that allow you to unlock steam achievments at a button-press without any issues or banning.

Re: Server and security

Posted: Sun May 24, 2015 8:10 pm
by Inny
bobbyjones wrote:There has to be a decent way to verify high scores.
Online only mode is decent. Of course, you shift the problem into looking for a decent way to deal with latency and ping times.

Re: Server and security

Posted: Sun May 24, 2015 8:31 pm
by Robin
And you still have aim-bot like stuff messing up the scores.

Re: Server and security

Posted: Sun May 24, 2015 8:56 pm
by bobbyjones
Well I think setting up an a score verification system is better than doing nothing like most games. Like Flappy bird and Call of Duty

Re: Server and security

Posted: Sun May 24, 2015 11:07 pm
by I~=Spam
bobbyjones wrote:Well I think setting up an a score verification system is better than doing nothing like most games. Like Flappy bird and Call of Duty
Explain how you would do it. There isn't a way because you do not have full control over all clients. It is impossible to know if a connection is pretending to be real or not. The only way to "verify" the score is to send a replay of sorts to the server and have the server check that. But what is to stop this replay from being forged too? It might be time consuming but there are people who take great joy in doing that kind of thing...

Re: Server and security

Posted: Sun May 24, 2015 11:52 pm
by bobbyjones
I meant some sort of verification. Doing nothing is useless

Re: Server and security

Posted: Mon May 25, 2015 2:10 am
by I~=Spam
bobbyjones wrote:I meant some sort of verification. Doing nothing is useless
Ummmm have you read the previous posts? There isn't any verification that one can do verify certain that the data is not forged. The rogue player always can perfectly mimic a well behaving client. It doesn't matter if you think that it is useless, there isn't a way. The only thing that can be done is make it harder for a player to submit false scores.