9
\$\begingroup\$

The answer to this question may be "NO" but it's quite important so I think I might as well ask.

This should be a problem for all client-server location-aware games where player locations in the world are central to the gameplay. Is there any way we can make sure that the location data that's coming from the client is real (i.e. the player is actually there)?

Working on client-server games, we all know that we should never trust any information coming from the client and therefore all important game logic should be done server-side. However with location information, we MUST receive this from the client. Is there a way to double check this to prevent cheating?

\$\endgroup\$

4 Answers 4

Reset to default
10
\$\begingroup\$

You can use an IP geolocation service to obtain an approximate location from where the user is connecting. Compare this with the GPS data received and you can weed out some extreme cases (players connecting though proxy, etc). You can even calculate distances between user logins and if they are too high (say, the location moved 1000 kms between two login attemps in 5 or 10 minutes) notify the user.

However this isn't foolproof and you will cause more than one inconvenience to legitimate players.

\$\endgroup\$
2
  • \$\begingroup\$ Thank you, I think I'll look into the IP check as well as the location delta between logins/check-ins with the server. It's definitely going to cause problems for legitimate players if we rely on automatic detection and bans... I think I'll just flag it for admin review and give some generous limits; we'll probably deal with each flag on a case by case basis (hoping the numbers are low enough for that to be practical.) \$\endgroup\$
    – Jamornh
    Commented Aug 7, 2012 at 20:35
  • \$\begingroup\$ GeoLocation is pretty accurate; you shouldn't have any problems... depending on the granularity you want. \$\endgroup\$
    – Vaughan Hilts
    Commented Aug 8, 2012 at 5:36
10
\$\begingroup\$

There is nothing on the client side which can not be faked, everything somebody has physical access to can be manipulated.

The IP contains routing information and thus hints on the location. But the player just needs a proxy and whoops... the IP hints at a completely different location than the player actually is.

Trust your players, don't give them a reason to try to trick the system in the first place.

\$\endgroup\$
1
  • \$\begingroup\$ I agree with trusting the player and giving them no reason to trick the system. It should be more convenient to follow the system to achieve something than take the time to trick it to do the same thing. But some players will always find a reason to do things they're not meant to do, ah well, I hope that number is extremely low if the system is designed well. \$\endgroup\$
    – Jamornh
    Commented Aug 7, 2012 at 20:32
3
\$\begingroup\$

You cannot truly verify this information any more than you can truly verify any information created by an external source. So what you want is theoretically impossible. But you can probably make it a bit harder to fake.

For example, on Android phones you have various location providers, such as locating a user by the nearby cellphone masts, Wi-Fi position system, etc. You could require that at least two location providers return similar values in order to trust the more precise of the two.

I would not recommend using IP geolocation; here in the UK it is hopelessly inaccurate since most of us use national ISPs. On a good day geo-targetted ads refer to locations about 20 miles away, and on a bad day they think I am 100 miles away. But you can probably use it to verify the user is in the right country!

\$\endgroup\$
2
  • \$\begingroup\$ Thanks for this answer. When you refer to "location providers" I assume you're talking android's location API and which hardware it's using to calculate location. It would make it slightly harder for the person trying to fake the location (having to provide 2-3 values instead of 1) but since they're providing fake values anyways, this shouldn't pose much additional work for them to bypass (provide additional fake values.) Totally agree with your point on IP geolocation, not granular enough but good for rough verification :) Thanks for the help! \$\endgroup\$
    – Jamornh
    Commented Aug 8, 2012 at 11:18
  • \$\begingroup\$ Yes, there is absolutely no way to stop the reporting of fake values from a client - all you can do is hope to make it difficult. \$\endgroup\$
    – Kylotan
    Commented Aug 8, 2012 at 18:02
1
\$\begingroup\$

No. No way. Not even in theory.

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .