[quote]If anyone comes up with a neat solution to the hiscores problem I’d be especially interested as we’re going to run a Million Points Prize promotion for Alien Flux when it’s launched, and we need to make sure no-one’s cheating because the prize is going to be pretty nice, like an Inspiron or something.
I toyed with the idea of recording the whole game but apart from being detrimental to performance it might also be rather bloody large.
[/quote]
IME, you can get an awful lot of mileage out of “record each game”, but in most cases there is absolutely no need to record a large amount of data. I’ve lots of suggestions - but it all depends on your threat model and sec policy.
It REALLY depends what cheating you want to prevent!
I was writing a different reply to this topic, but I might as well use this as a case study. First thing you must do is create a security policy and a threat-model; without those, no-one can help you.
Threat-model is a list of all the different ways you think someone might want to cheat, try to cheat, be capable of cheating, etc. It’s rather like a requirements document in Software Engineering.
Security Policy describes stuff like the precise invariants you wish to maintain (“no player may ever submit an unrealistically high score”). Preferably it should state which security breaches are tolerable, and which are intolerable. A little similar to a specification document.
…then I can offer suggestions on ways to achieve the policy, in the presence of all the threats. Otherwise, we’re all shooting in the dark / pissing into the wind / whatever pointless and slightly dangerous activity you care to choose :).
PS: Although I agree with leknor’s statement in general (in general, it is impossible to prevent cheating, unless you TRUST [control is never necessary - only trust is] the client environment), there are several successful solutions that work by redefining the problem. JohnMunsch has already talked about one solution to a particular set of problems - Leknor, you should really think about the bit that says “Works for two people; doesn’t work for more”, and John should really not make statements like “this doesn’t work for more than two, but other things solve that” - it’s too much handwaving to help.
For another example, I saw some guys @ GDC2003 with a system that let you run a game without the server-bandwidth, and at the end if you SUSPECTED someone was cheating (you didn’t need to bother otherwise), you could get a check on their die-rolls. I wasn’t much excited by it, because it was pretty simple - but if you had the right kind of game, it works brilliantly.
I actually skipped a question on my finals paper on this topic, because I knew of several cases which show that there is NOTHING you can do if you want to completely prevent cheating without any server logic on a large scale. My answer would have said something like the following:
Anyone can write a program that peeks at the memory locations and identifies the point where you have a decrypted copy of the score, in order for you to add points to it (or whatever you want to cheat on). They pause the program (using a live debugger) every time that memory changes, and edit it to suit their fancy. Voila.
Note: this has been done before for at least one commercial game; IIRC, it was what brought Diablo to its knees, security-wise, in the end.
This kind of threat is valid for most situations where you have any data that the client is going to alter, and then act upon.
)