0
\$\begingroup\$

I'm making a game where the user can sell items he finds during the the "single player" adventure on an online, I was looking at ways to prevent any malicious user to create rare and expensive items from scratch to sell them on the net.

I tried obfuscation but soon or later someone will successfully break into my code and I can't afford that, for obvious reasons.

Items are stored in files, so I thought about making client add a digital signature to generated files but I have to keep the key on the client machine, so same problem: if someone finds his key he can apply digital signature algorithm to generate the valid key for any file he creates.

So I ended up think the only secure option was to make the single player adventure interact with the server (everyone around here tends to say this is the way to go, like this subject, in my opinion the accepted answer explains it well).

But what about the user-friendly aspect?

My game is divided in two parts. Firstly the "real" single player adventure, where you can cheat all you want because everything is stored on your pc and server won't ever use it (~24h), then you beat the final boss and you're notified you're able to go online to battle against other players with the stuff you acquired on the single player map. At this point of the adventure, my idea was to record everything the player is doing in singleplayer mode onto the server, so whenever he plays a tournament, his stuff is verified.

I can't verify stuff just before a tournament begins because overpowered items can be obtained but are very rare, I want to systematically know if it was hardly-obtained or cheated.

Do you think it would be acceptable for a player to play "single player mode using internet" if he was told this will allow him later to rank up online and be

The single player map will be kind of mixed with the multi player area, but maybe I can think about a feature to play totally offline but then you won't be able to use your "online items" during this time.

EDIT: My app might outputs txt file (representing an item) with its corresponding digital signature, so I just need a way to be sure that it's my app (and not a modified copy) that has created a given file. That's why I'm reading about Trusted computing and Memory curtaining right now, but maybe I should head to security.stackexchange?

\$\endgroup\$
  • \$\begingroup\$ Related: Always-online DRM. Googling "always online single player games" gives plenty of discussion on this topic. \$\endgroup\$ – Dukeling May 15 at 8:27
  • \$\begingroup\$ Exactly what I was looking for thank you! \$\endgroup\$ – Axel Carré May 15 at 8:33
  • \$\begingroup\$ The user experience will always be worse if you're making playing more of a hassle for what users perceive as no reason. Whether the upside is worth it is something you'll need to figure out yourself - how fundamental to your game is the ability to sell single player items or take part in tournaments (using single player characters and items)? Would it make the game much worse if you could only use items for that which were obtained when playing in a multiplayer mode? \$\endgroup\$ – Dukeling May 15 at 8:34
  • \$\begingroup\$ @Dukeling This is the main purpose of my game: farm solo to battle vs stronger and stronger opponents as you grind the ladder in the ranked mode, because of the skills you increase because you train but also thanks to items you'd find while exploring solo adventure (big map). The more you grind the ladder, the more you'll need both skills and good stuffs since it gets harder to win because people get better. Do you think I could also look towards Trusted computing? It says that trusted computing "is [...] secured against its owner". \$\endgroup\$ – Axel Carré May 15 at 8:59
  • \$\begingroup\$ There's also a section called "Preventing cheating in online games". \$\endgroup\$ – Axel Carré May 15 at 9:16
0
\$\begingroup\$

Any client-sided anti cheat solution is not going ot work. If it is executed on the client hardware, it's under the control of the player. There is no way around that. If you really want to prevent cheating, then the critical computations must run on hardware you control.

Several big name studios have created games which forced the player to be online at all times for no other reason than to prevent piracy. Consumers grumbled a bit about this, but accepted it eventually. You actually have a legitimate reason for always-online play, so you shouldn't have to worry much about backlash.

However, think carefully if this is really worth it from a cost/benefit point of view. Running one server is affordable, but running a server network across the world to ensure everyone has low latency can quickly become a considerable investment in both hosting cost and administrative work.

Adding a replay feature might be an interesting approach, though. It has benefit for the player because it could easily be enhanced to allow players to retroactively take videos of their greatest accomlishments. But you might want to make sure that recording all player activity is allowed according to applicable data protection laws. Please consult a lawyer for details about this. Anonymous wisecrackers on the internet like me are not a reliable source for legal questions like this.

Anyway, I am looking forward to playing your game.

\$\endgroup\$
  • \$\begingroup\$ But how would a replay feature help me to prevent from cheaters? Anyways I think I will try to drag players attention mainly on things as "meteo/time" \$\endgroup\$ – Axel Carré May 15 at 11:07
  • \$\begingroup\$ @AxelCarré A replay feature would require that players put a lot more work into cheating. When someone claims "I started playing yesterday and I got a +99 Sword of Awesomeness", a mod can look up the replay of how they found it. If it just magically appeared after restarting the game, you know they cheated. Sure, replays can also be faked if someone invests a lot of energy into it, but that's a lot harder to pull off. \$\endgroup\$ – Philipp May 15 at 14:06
  • 1
    \$\begingroup\$ I think the "accepted it eventually" part is not 100% true. Some will accept it, many people (like me) will avoid games with drm. I think the best way to avoid cheaters and piracy is to ignore the problem. Sure some people will do it but most people will just play the game and enjoy. Even triple A games like dark souls are full of cheaters, but 99% of people that play dark souls are legit player. After all it's just a game. \$\endgroup\$ – LiefLayer May 16 at 12:54
  • \$\begingroup\$ Yes Fortnite is a just game with a 100M cashprize. \$\endgroup\$ – Axel Carré May 16 at 13:51
  • \$\begingroup\$ @Philipp I understand what you mean by "a lot of energy", once I tried to reproduce a game animation, it was a pain in the a**, even if it was a pixel art game, maybe I could make a difference between weapons' ranks to use thistechnique only on some featured ones, but I would have loved to be able to verify every item. \$\endgroup\$ – Axel Carré May 16 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.