What harm would be done if a user were able to play the client side of a multiplayer game without logging in?

Question

I am currently developing a multiplayer game for a university project. The purpose of the assignment is to learn about the use of a cluster architecture, but I have a question concerning security.

The multiplayer role-playing game that I'm developing for class utilizes a client-server architecture. The client holds all of the game assets and a 2D game engine. The server provides authentication to log into a user account, provides access to characters and their progression, etc. The server also provides the positions of non-player characters and other players on the same server, and also provides their actions and movements.

My question is whether a tech savvy user that modified the source code of the client could "play the game" without authenticating, forcing a kind of single player version of my game? I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot. Maybe he/she would simply want to move around the game world freely.

1) Does this scenario seem possible?

2) Most importantly, what harm could this cause to a multiplayer game? Perhaps I have content that I don't want someone to be able to access without properly purchasing the game, or if they have been banned for some reason.

3) If this is a problem I should try to mitigate, how could I go about preventing this kind of thing from happening?

Answer 1

1.) This scenario seems possible, as there also exist private servers of some MMOs.

2.) I don't think that this could cause much harm. The important data for your game are on the Server. So they won't affect anything in the Online experience of other Players. Datamining will probably always exist in games. To prevent story leaks you could stream Texts from your Server. (Thanks Bálint for the idea)

Acessing areas they are not meant to go is a interesting point. For the MMO Guild wars 2 exists http://www.tyria3d.com/ There you can see the wohle World of the Game in your browser. If something like this would be a Problem you are not allowed to Store the Map on the Client. (that could be difficult)

You can't keep bannes players from playing offline, or on private Servers. So just ignore them.

3.) I don't think this is a Problem and i also don't think that you can avoid something like this as long as the Players have a local Client.

Answer 2

When you have a multiplayer game, then any calculations which happen on the client can be controlled by the client in order to cheat. So you should think carefully about which game mechanics should be client-sided and which mechanics should be server-sided.

I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot.

Enemy spawns should definitly be something which is server-controlled. If you let clients control mob spawns, players can cause all kinds of shenanigans. Like spawning a few hundred instances the rare one-every-day mob which drops the Ultrarare Unobtainium Sword of Awesomeness and farm it.

Also, when it is a multiplayer game, you certainly want mobs to be synchronized across clients. That will be a lot easier to accomplish when they are server-controlled.

When you move any mechanics worth manipulating to the server, then there aren't many fun things left the player could do without being connected to the server. Exploring the world on their own without being bothered by other players is one thing which would be quite easy to do. But any form of progression (gain exp, earn items and money...) should be impossible unless the client is connected to a server acknowledges that the player did something which makes them entitled to that progression.

---

But considering that this is an academic project and you have very likely drastically underestimated the amount of effort it takes to create an MMO (everyone does), I would recommend you to just pick the easy route and not worry about cheaters at all.

Answer 3

A notorious example would be the 2016 (?) Sim City. It was multiplayer only, which definitely made the game less accessible (due to server issues and EA being EA). Someone hacked the game to have a single player (offline) mode.

The harm there wasn't huge, the same content was accessible, but without having to be connected to the server.

If you have content you want to keep secret, you should stream it to the player instead of bundling with the game. That way you also stop any attempt at data mining and also people trying to crack it.