Hot answers tagged

59

You can't. Javascript is executed on the users machine. Whatever is executed on the client side can be manipulated by the client. All mainstream web browsers come with powerful debugging tools out-of-the-box which allow users to influence Javascript code even more than with the console. So the user doesn't even need any special software tools like they ...


16

Put spoilers for the new star Wars movie and or other movies/books/shows in the code to deter people from looking at the code.


14

Attack vector 1: The netcode As already pointed out by Mario, one important factor when designing the network protocol of a client/server application is to not blindly trust the client. You can't control the software which runs on the client machine. You can't even tell that it's your software and not something the user programmed themself. The same ...


10

Well, for me personally it depends fully on what type of javascript game that it is: In the case of a single player game... let them cheat! Lets say you rewrite the wheel, and put as many roadblocks in the way of a determined hacker as you want, at the end of the day, the player will only undermine the fun of the game for themselves if they cheat. If ...


10

One of the reasons why there are protections is that reading the game state could allow bots to know the state of the game and act accordingly. For instance, grinding in a MMO: if the "bot" knows what mob is around, it can send commands to the game clients to select the mob, hit it until its life is 0, pick up the loot, rinse and repeat. With this, even if ...


8

Whichever you do, it doesn't matter. If you rely on clientside calculation of anything you will get hacked. All the "anti-hacker" tooling has AFAIK been thoroughly penetrated, new versions often themselves being hacked in a matter of hours after release. Given that, browser games are a major PITA IMO (poor usability) though they do offer ease of installation....


6

Many MMO's are designed with client-side hit prediction. So if there is a hit on the client, it sends that result to the server that there was a hit. In this case the server is not truly authoritative, and thus cheating is possible. To be honest, if I were designing an MMO, I would make the server fully authoritative, with the client only sending clamped ...


4

Another interesting question where I can cite that awesome quote I've found on the internet a few years ago regarding the creation of multiplayer games: The client is in the hands of the enemy. Whereas the enemy is the player trying to cheat or "hack". Overall, there's no 100% perfect way to avoid hacking, cheating or botting. One of the easiest way to ...


3

One of the things you can do is work with it. Really, this depends on what you want to do, but Orteil made Cookie Clicker. The game is clear javascript/html. He took into account that the game was really open source and he added a "cheat" mode. The cheat mode allows you to cheat, but it also "records" it in your stats. This is not available to any kind ...


3

The major flaw is that you are adding random values between int.MinValue and int.MaxValue leaving no more space for your real value. Okay, the default in C# is to not perform range checks, but this can be changed. In order to keep the whole int value range open for your real values I would suggest to use an XOR operation instead. public int value { ...


3

As a first step to securing the game you can't allow any user to run the actual game logic on their computer. If they can do that then they can also reverse engineer it and hack it easily. What you need to do is have a secure server under your control which runs all the game logic. The client program on the users computer simply sends moves to the server ...


2

We don’t worry about unhackability in our games. It’s not worth it. We just worry about making sure it works in the simpler, more frequent cases of the user changing their device clock, restarting their device, etc. As long as you don’t worry about people decompiling your code, it gets really simple. You can put in checks to make sure your app isn’t a ...


2

Moving through walls also seems impossible to hide Let's look at a simple scenario: In this diagram, a player is running around this protruding wall. However, due to some connection issues, all packets along the red line are dropped and the server never receives them. The connection improves and the server starts receiving packets with the player now on ...


2

There are three types of "hacks" used for video games. Packet modification: Modifying the data sent to the server. Server hack: Gaining access to the server and performing unauthorized commands. Client modification: Modifying the client to perform something that only affects how you see the game. We can sort these into different categories for examples. ...


2

When a large scale attack reaches your machines, there's a limited amount of things that the code can do to mitigate the problem. For low volume attacks, you could attempt to recognize bogus requests early and rate-limit/ignore sources that do not appear to do anything useful to lessen the amount of computational resources your application wastes on them. ...


2

Ok, I can tell you that I had access to the opensource wow server code, and the worst thing for me was fixing the loop holes which gave some not "noon programmers" the ability to manipulate packets, the unofficial opensource servers have thousands backloops and they do not check the packets. On contrary I am sure that you wont do any harm to anyone, because ...


2

Anti cheat tools are software, just like the game client itself. Just like a hack is able to manipulate the game software, it can also manipulate the anti cheat software. Any software which runs on the users machine is under their control. For that reason it is physically impossible to create unhackable client-sided anti cheat tools. When you want your game ...


1

When you say "Javascript" you certainly mean "running in the web browser". In that case, peer-to-peer networking isn't possible because there is no browser-independent standard for this. But what you can do is having a server. One technology which is quite well-suited for real-time games are websockets. You can prevent most kinds of cheating by having an ...


Only top voted, non community-wiki answers of a minimum length are eligible