TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

A Message About Vanguard From Our Security and Privacy Teams

64 点作者 houzi大约 5 年前

16 条评论

smoyer大约 5 年前
Explaining your rationale doesn&#x27;t change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you&#x27;re running a dedicated PC for gaming, I wouldn&#x27;t install this software.<p>As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected terrorist&#x27;s computer. No need for privilege escalation when you can just ask the user to install it at ring-0.
评论 #22907686 未加载
评论 #22907770 未加载
评论 #22907782 未加载
评论 #22907894 未加载
评论 #22908335 未加载
评论 #22907914 未加载
haunter大约 5 年前
&gt;we wouldn’t work here if we didn’t deeply care about player trust and privacy<p>Bold message from a chinese company. People freak out about Huawei but Tencent is 1000% worse. And here they are installing a kernel driver on your PC.
评论 #22907904 未加载
评论 #22920525 未加载
TrueDuality大约 5 年前
&gt; ...some of you want to know more about the tech behind Vanguard. We can’t get too deep into the technical specifics without potentially compromising Vanguard...<p>That in itself tells me enough about the efficacy of the system. Security through obscurity is only a hand wave of security. Making the trade off of all the security architecture put in place over the past decades for something that needs to be hidden to remain secure is a really poor value statement.<p>I understand why they want this in place, it does raise the level of effort on cheating but there are other ways this can be accomplished without compromising a user&#x27;s security.
ds大约 5 年前
The inherent issue with anti cheats as compared to anti-virus software is user intention.<p>A user who installs a anti virus program wants that program to do its job and find bad actors. The virus on the other hand is completely unwanted by both the user and the software- Its existence is threatened by all fronts.<p>However, a anti-cheat lives in a extremely adversarial environment. The cheater (and the cheat) wants the cheat on its computer. As such, the user will be willing to do extra steps to assist the cheat. This makes the anti-cheat software in this case, the &#x27;un-wanted&#x27; virus, so it has to exist in the most hostile of environments and somehow detect programs which have higher privileges than itself.<p>That said, Cheating is something that will not go away. Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. It involved a second computer, which man-in-the-middled all network data to the client computer. This second computer then would display a &#x27;radar&#x27; of where enemies were. As the anti cheat would have no possible way of knowing the existence of this second computer, there was not much they could do.<p>If you wanted to get more aggressive with the system above, you could have that second computer modify outbound requests as well. So if you shoot your gun and it would have hit the ground, it will now instead shoot a enemy in the head- as such even something like a aimbot is entirely possible with this setup.<p>However, there is indeed a anti cheat which can detect all known cheats and its basically what Valve did&#x2F;does for CS:GO - Allow users to report suspected cheaters and then have the community analyze the reports. This catches all blatant cheats, but unfortunately will never get rid of radar&#x2F;esp cheaters, only aimbots and the like.<p>Honestly, it sounds to me like there is a business model in the above. Years ago we had companies like evenbalance&#x2F;punkbuster, easy anticheat, etc.. which provided software based anti-cheat systems. As you would expect, most would by bypassed and a daily cat and mouse game would ensue. The solution imo is to create a SaaS where you essentially provide a reporting + monitoring tool. Users of your game can report suspected cheaters (which includes the demo file &#x2F; vod &#x2F; replay &#x2F; whatever) and your trained wet-ware staff would review all reports and take action where necessary. No invasive software necessary. Actually, no software on the end users computer at all would be necessary- It is all done on another users PC.<p>In fact, if someone is interested in doing the above, hit me up. Sounds like a easy win.
评论 #22907710 未加载
评论 #22907722 未加载
评论 #22907724 未加载
SpaceManNabs大约 5 年前
I skimmed, but it seems none of this addressed why the service (edit) runs at boot-time? Also, expecting a service to not not look at your data if they have access is not security.<p>If Valve can mitigate hacking in CSGO without such an intrusive service, I am sure Riot can. I, myself, did a very, very, very poor job with an autoencoder to detect anomalous matches in Dota and caught a large amount of players abusing the system. As far as I know, CSGO anti cheat does involve an ML component.<p>My point is that a non-intrusive anti cheat, advanced analytics, and tracking of user feedback goes a long way.<p>Ofc, none of this matters. If the playerbase actually cared, they&#x27;d boycott or stay away. And I cannot remember the last time gamers ran a successful boycott campaign.<p>edit: Also read that uninstalling the game will not always uninstall the ring 0 anti cheat. I can&#x27;t verify since I would never install this on my system, but for what it is worth: That is terrible IF true.
评论 #22907732 未加载
评论 #22907905 未加载
评论 #22907728 未加载
swiley大约 5 年前
League of legends is a real pain in the ass to play even when you’re doing everything right. Personally I don’t even like the game, it’s just popular so I played it to hang out with friends. The way their launcher handles updates is crazy inefficient and so it always takes <i>hours</i> to launch if it launches at all. It also runs terribly in wine.
评论 #22907876 未加载
评论 #22911656 未加载
quezzle大约 5 年前
Whenever I hear&#x2F;read lots of words about how secure something is and how strong their commitment to security I think “they don’t know what they don’t know”.
评论 #22907937 未加载
davidw大约 5 年前
I was concerned about the index funds for a moment...
ruialmeida大约 5 年前
This will always be a cat and mouse game. There are some anti-cheat software more intrusive than others. Even Valve Anti-Cheat (VAC) which is considered by many to not be very intrusive, used to intercept DNS queries to detect communication with paid cheats DRM.<p>Most anti-cheats also scan all processeses memory and even files to detect know cheat signatures. They tend to run with high privileges and some take in-game screenshots for analysis. Basically they have permissions to do anything and receive silent updates.<p>I wonder if statistical methods to detect cheaters result in too many false positives.
评论 #22908257 未加载
dsr_大约 5 年前
If people want to play games in anti-cheat environments, the only sensible solution I can see involves the reinvention of the cartridge.<p>In this case, make the cartridge a bootable SSD which entirely avoids touching any other disk in the system (perhaps with the exception of an SD card or USB storage stick for saves.)<p>The downsides include:<p>- the game company now has to ship a complete OS and do hardware support. They nearly have to do that anyway, so whatever.<p>- you&#x27;ll need to reboot your computer for each game.<p>The upsides, I think, are obvious.
评论 #22908482 未加载
评论 #22914879 未加载
maallooc大约 5 年前
yeah, a chinese company will gain root of your pc to stop you from tampering with memory but it&#x27;s totally fine guys don&#x27;t worry
emagdnim2100大约 5 年前
Potentially dumb question: how do cheats even work in a game like LOL? I understand aimbots in a FPS and how they can give a pure mechanical advantage, but the LOL equivalent isn’t obvious to me. Does the client have access to data that’s not supposed to be exposed to the player?
评论 #22909322 未加载
评论 #22909335 未加载
Youden大约 5 年前
As someone who mainly deals with web services, this all seems really weird to me. I was told from very early on &quot;never trust the client&quot;. There was a lot of emphasis on server-side validation; client-side validation was only ever for UX, e.g. highlighting the field in red instead of making the user submit the form first.<p>Reading through this, it seems the game development world is doing the exact opposite and pushing all the &quot;security&quot; measures to the client. Is that incorrect? If it&#x27;s correct, does anybody have any idea why?
评论 #22909931 未加载
kerng大约 5 年前
Also worth highlighting, Riot Games belongs to Tencent.
butz大约 5 年前
Considering that client will always find a way to cheat, isn&#x27;t it more logical to do all anti-cheat detection on server side? Gather data from trusted players during closed beta test and after launch just look for abnormalities on data coming from clients.
lidHanteyk大约 5 年前
Folks should build alternative clients for Riot&#x27;s games. Riot has demonstrated that they should not be trusted to write clients.
评论 #22907671 未加载
评论 #22907669 未加载
评论 #22907759 未加载