Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

I am developing a game that is running as a web application. The fact is that the game lose sense if one player creates several accounts. Imagine that is a turn-based strategy game, and if you play against yourself (with another account) you can earn tons of points easily.

At first, I thought about logging every single user action, and then comparing the users IP to detect if there is any clue of cheating. But then I noticed that different users could be running under the same IP, for example if they are in the school and all them share the same IP using a proxy. Using this way innocent people could result banned.

Is there any better approach that I'm missing?

share|improve this question
3  
Remember that the really good cheaters will have proxies so that their multiple accounts are actually on different IPs. Don't make "same IP" a required criterion when looking for people cheating in this manner. –  Ricket Jul 28 '10 at 17:19
3  
The way you described it, means that two ore more people can team up to get lots of points easily (like the arena battles in WoW). –  Hendrik Brummermann Jul 29 '10 at 21:32
    
@Matias, is your product focused on a country or is it meant to be world-wide ? if it is country limited you could try to use people's information like security number or something that can be used with no harm from them, it would not prevent 100% but it would cut down by a lot if you can verify weather the numbers are valid or not... –  Prix Aug 2 '10 at 4:37
1  
@Prix you can run into a Loooooooot of trouble collecting SSNs without adequate protection in the US. –  Noctrine Aug 2 '10 at 13:44
1  
Re-design your game so that two users can't abuse it, instead of trying to stop them from doing so. –  Lohoris Oct 24 '10 at 14:13
show 1 more comment

12 Answers

You really need to identify the specific behaviors that you want to prevent.

For example, if the real problem that you want to prevent is not "people making multiple accounts", but "individuals being targeted by multiple accounts controlled by the same person", that's an area where you can use similar traits between potentially clone accounts to allow the players themselves to police multiplaying. In other words, if they detect traits of multiplaying, they can act (via some interface) to check for similarities between the accounts, and if the accounts do have too many similarities, cause a punishment to occur. Player policing. The benefit of this is that multi-accounting matters the most to other, non-multiplaying individuals, so if they feel wronged, they have a recourse they can try to catch the multiplayer on the spot. It also allows things that in a flatly viewed account system would be false positives (like ip) to be much more real evidence of multiaccounting.

Similarly, as others have mentioned, if it's the gaining of rank by defeating their own dummy accounts, a system like the rep system here on stackexchange helps to turn taking ranking points from yourself into a zero-sum gain.

share|improve this answer
add comment

One option if you have multiple servers is to require that any accounts from the same IP must be created on alternate servers. So if you want to create 10 accounts, great, but you'll have to create them on servers that don't interact with each other. This prevents people at the same location from being able to play together, so there is that drawback. On the plus side it also interferes with the effectiveness of proxies in cheating.

You're going to end up with pros and cons to any solution you come up with, and you won't completely eliminate cheating. So decide how far you're willing to go and keep a close eye on how those changes effect the user base.

share|improve this answer
add comment

There's a very simple design solution that Blizzard took in Warcraft 3 and Starcraft 2: only let players earn points/score/experience when playing in games using the automatic matchmaking service. Players can still play against their friends, but won't get points from it.

If the player has no way of deciding who they are playing against, there's no reliable way to game it by playing against dummy accounts.

share|improve this answer
2  
Effective, but boring. I would much prefer to play a game against opponents that I have come to know (enemies, or friends, or casual acquaintances on chat) than against random unknowns, especially ones that may or may not be active opponents at any point. –  Kzqai Nov 18 '10 at 18:06
add comment

The simplest and most effective way to counter 'farming' of scores is to adjust the score received based on the disparity between the players. Bear in mind it's not just one player creating multiple accounts you need to worry about: imagine two friends, one deliberately losing so the others ranking is artificially boosted.

Chess and other games avoid this through forms of the Elo rating system. Basically the reward for beating someone of a higher rating than you is high, but the reward for beating someone of a much lower rating is very low. This very quickly makes deliberately losing to advantage another player ineffective. You can tune the rate at which winning against a poor player quickly results in little net gain. A player playing 'properly', i.e. winning against a wide range of similarly ranked opponents, will advance very quickly.

NB: it's not enough to just penalise players who lose so that winning against them gets you nothing, because then players can create an account, lose with it deliberately, then create another account. This isn't so much of an issue if there is a barrier to entry (e.g. entering credit card details to create a new account), but for free-to-play games that would work.

Also its worth noting that there is a danger if the ratings are used as a measure of actual ability, rather than just as a way to modify any rewards the player receives. If the rating itself is the measure, canny players will use the system to sabotage others. I.e. Player 1 gains a lot of skill/ability through practice, and then creates a new account. Player 2, who is about as good as Player 1, accepts a challenge from the newcomer. Losing to the newcomer will massively hurt their ranking, even though really the new player is of equivalent rank. However if the rating isn't actually used to measure the player, this is actually in Player 2's interest (having their rating pulled down will allow them to advance faster given their actual skill level).

share|improve this answer
1  
That is a lot of deep gameplay philosophy, right there, good read. –  Kzqai Oct 31 '11 at 5:31
add comment

The people over at https://panopticlick.eff.org/ did some testing on how somebody could be uniquely identified by several values that can be gathered from almost any browser. The results are astounding and you could use a similar approach (maybe combined with other measures) to identify and track your users.

share|improve this answer
1  
I don't think this is a fine approch to be used, specially if it is a browser game since you can create your own browser making it easy to become a unique person to create a new account. –  Prix Aug 2 '10 at 4:34
    
@Prix yes, i didn't meant this to be the solution that solves all issues. But I think it could be a good addition to IP logging. And of course you'll need other measures too. –  bummzack Aug 2 '10 at 8:26
    
Useful, even if it isn't a standalone method. –  Kzqai Nov 18 '10 at 18:32
add comment

You can use Flash local data storage, not everyone knows how to delete flash data.

share|improve this answer
add comment

i play on a game system called travian, and i really think the technology isnt good enough to catch cheats. Most cheats have 2-4 systems linked via KVM switch, each system runs different OS versions(windows xp, vista, win7, linux mint, Slitaz and so on) , and is run in via proxy servers (though the main account is not using proxy but standard)

This of course creates such an unfair advantage that most of the people that pay to play the game are leaving, with paying members down over 1000 in just a few months, and with the fewer players, its becoming increasing more obvious that accounts are suspicious, but with no evidence of cheating, the players that do cheat escape punishment, and those that pay fairly (whoops, meant to say play fairly) can see the suspicious activity, they get discouraged and quit the game - or they learn to cheat and hence inlies the problems.

Currently for travian, there is no player in the top of the game that can honestly say they dont cheat, or admitt they havnt hired people from countries like the phils and china to help them play the game for them while they sleep or are on holidays.

surely there must be better ways to catch multiple account cheats, or is this the future of games, where just a few actual people make up the entire game base and the winner is based on who can hire the most people in 3rd world countries to play the games for them.

would membership of $0.01 via credit card (and see who has identical credit card numbers) be a feasible way to detect multiple account cheats at time of registration?

share|improve this answer
2  
The issue with credit cards is that you can just buy a gift card and use that to open other accounts. –  Noctrine Jul 31 '10 at 13:12
    
@Noctrine You realize that you can edit posts here after you submit them, don't you? Some people prefer to annotate their changes rather than make an invisible edit. –  Casey Wagner Sep 4 '10 at 22:00
    
@Mike Yeah, but it seemed like it was a, hah! type thing. But re-reading it, it does seem like I didn't read the answer correctly probably the cause of me reading/commenting early in the morning :p Removed that bit. –  Noctrine Sep 5 '10 at 8:55
    
This seems like a weird description of the problem to me. What are players who get third parties to play the game getting out of it? Certainly that's gotta cut down a lot of their fun. I can see the fun of multi-accounting by yourself, but having someone else multi-account for you doesn't seem to add to the fun unless you get something back, like money for being at the top. –  Kzqai Nov 18 '10 at 18:10
add comment

I've found this is much easier to fix through game design than through enforcement/banning. Even if you permanently ban all of a player's accounts, sufficiently determined players can find a way around your ban (e.g. if you track IP, they can use dynamic IP or IP masking).

For example, if you award points to players for winning PvP contests, you give players incentives to make multiple accounts so they can lose to themselves. If instead you give bigger rewards for playing in groups with the same players over time (i.e. guild participation), you incentivize friendship and community over competition, which changes preferred behaviors. Having additional metagame characteristics tied to the player's account (such as a Reputation score and Friends list) further makes the maintenance of multiple accounts less appealing -- at the least, people would want one "primary" account with a good rep.

If your game is PvP by nature, a big way around the "I'll make several accounts and lose to myself on purpose" problem is to only offer automated matchmaking. So, the player requests to play a game, and the server automatically matches them against someone else who happens to be online at the time. If players can't choose their opponents, there's no way for them to guarantee they'll fight themselves (unless they happen to be the only one online at the time, but then you have bigger problems). See Microsoft Hearts/Spades, or most Facebook games that allow PvP, for examples of this. Note that in this case you'll definitely want some kind of intelligent matchmaking (either using some kind of ranking/rating system as part of the player account, or letting players self-select their preferred level of competitiveness).

If you're worried that players will want to play games with their friends, you can always offer that option as well, but only allow unrated/unranked/practice games when you choose your opponents.

share|improve this answer
add comment

Not really a solution, but a deterrent at least: Say that if people are discovered having multiple accounts, all accounts will be banned. This should keep many people from even trying it. Even if you don't actually ban all accounts, or don't have a way to detect it at all, most will be too afraid.

share|improve this answer
1  
The only way to make the threat effective is to follow through, which requires continuous monitoring and banning of your playerbase... ...which is just about the least desirable outcome, certainly first you should explore changing the system to minimize cheating potential. –  Kzqai Oct 31 '11 at 5:34
    
Furthermore, after you get some accounts banned, you still can create new ones to cheat again. That's total nonsense! –  Lohoris Feb 15 '12 at 8:54
add comment

There are a few different ways to handle this, and many solutions have their own merits. I will give my opinion of the ideal way to handle this.

First, it's important to understand that no matter how complicated your system is, someone who is sufficiently invested in gaming the system (with appropriate knowledge) will figure out a way to game it.

To seriously handle this issue, if it is really an issue for you, you need to handle this in both the design and technical implementation of your game.


On the technical end, you need to basically play a game of comparisons.

In general, I am pro-logging if you are running any type of game with user interaction then verbose logs would allow you to modify and tailor your game based on real quantitative measurements.

Using your logs, you can set up a system to compare data between accounts of any number of similarities.

For example, if two accounts are using the same IP address, or any other information that you deem an appropriate comparison measure, you would want to be able to look at overall interaction between the two (wins/losses, trading) in relation to the amount of interaction with others.

Using this data you can pass appropriate judgement on a case-by-case basis, or automatically. Depending on how widespread the issue has become, I would recommend an automatic option and handling any issues through a live moderator. It's important that you don't delete the account, just suspend it with a message along the lines of "This account has been suspected of violating this game's TOS agreement. If you disagree please go here" with a link to an arbitration panel or something.

It is important that such a thing is in place, because people could be sharing IP addresses at home, or at school. Also, for younger kids, they could be using their parent's email addresses, credit cards, or even names in their sign-up information depending on how protective they are.


The second phase is design side. While some benefit is to be expected, you need to sufficiently disincentivize this form of cheating with your gameplay. There are quite a few ways that you can go about this, there are the wholly annoying ones of very short timeouts (which may be necessary). But I feel the best way is by appropriately adjusting the benefits between two accounts.

For example, some MMOs have altered the benefit that high level players recieve when playing with players outside of a reasonable level range. This discourages players with access to multiple accounts from powerleveling themselves (atleast within a specific range)

You could even specifically target accounts that share data and directly decrease the benefit that they gain when interacting with each other. This would encourage interaction with other players, but it can be circumvented with proxy servers and it would be ill-advised depending on your target audience.

The other way that think would work is having gameplay so engaging that people can't really manage to play two separate accounts and still keep up with everyone else.


Of course with this system, you would need to spend a nice deal of effort tweaking to prevent false positives and what not.

tl;dr?

You want to collect appropriate data that allows you to automatically detect and handle potential threats and deal with false positives on a user-by-user basis. A good deal of babysitting would be necessary to make sure you don't have false-positives.

Also you want to reduce the benefit of cheating with multiple accounts on the gameplay end.

share|improve this answer
    
Deep Breath Long.. –  Noctrine Jul 28 '10 at 16:39
1  
With a decent amount of logging, an interesting item to check would be how often two accounts are logged in together. There is a chance for false positives here just as any other system check, which is why human interaction will always be needed for final decisions. –  ManiacZX Aug 1 '10 at 9:47
add comment

You could award points based on the difference between the opponents' point totals. Very good players would earn few points for defeating newbies, and newbies would earn many points for defeating experienced players. Likewise, losers would lose points proportional to the same scale.

This wouldn't completely solve your problem, but it would eliminate the simple case of someone creating and defeating a bunch of newbie alts, as well as making it harder to level two different accounts of equal power.

Really, though, there's not a foolproof way of stopping this; a sufficiently dedicated cheater will succeed. But if you flag accounts with suspicious activity for review, where "suspicious activity" includes multiple accounts with the same e-mail or IP address, then you'll be able to spot the most egregious offenders.

share|improve this answer
add comment

I think there is another aproach. Because there is another potential harm: Imaging two friends who both create two accounts: one looser and one winner account each. One day friend A uses his looser account to loose all games against friend B's winner account. The next day they change. Checking the IPs won't help here.

You should check the behaviour of the players (a strategy know from intrusion detections systems). If two player play each other often and one looses all the time, this is a clue. If games end very early, it is another clue.

You could score those clues, add the score up to a reputation (don't show the reputation to the users) and ban accounts if they reach a value you define. Maybe there should also be anti-clues that repairs the reputation.

Other clues depend very much on your game. But I think you get the idea.

share|improve this answer
2  
I worked on a project that tried to detect cheating like this. There ended up being so many edge cases that the system got it wrong as much as it got it right, both with false positives and false negatives. –  tenpn Jul 28 '10 at 16:53
1  
Having a reputation system would help with the case you describe (e.g. you can only get rep from others, so getting it from yourself just moves it back and forth uselessly). Also, if each friend has two accounts, isn't ip detection actually going to be useful at least some of the time? –  Kzqai Nov 18 '10 at 18:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.