Can we talk about IP blocks?

Quote:

---

Originally Posted by Chris121

I don't know about the coding side but when I found out (on returning to the game) about the current blocking I thought the person telling me had it wrong. He didn't. It's just that the system is very outdated. Free game, fair enough. But Chadde's points about growing the game as valid. Currently I'd be inclined to refuse to allow people in my KD to invite others who live/work with them to play in the same KD as it is too annoying to work around the IP block issue in war. That's not good for the game.

---

Exactly. I'm lucky enough to have an understanding king who values playing for fun with people you know. Still it makes us a burden on the kingdom, just like the other married couple we have and the two roommates.

If we want to grow this game we have to come up with a system that encourages people to invite friends and family. Not punish them for doing so.

I totally feel your pain. Back during the days of the white list, I had my whole family playing in my kingdom (family evidenced below). I don't think I can express in words how difficult it was to let them all go. To this day, my mother still doesn't talk to me.

http://i.imgur.com/8bH51jJ.jpg

I can confirm octobro is a small child.

(And before people want to report this for harassment, I'll begrudgingly point out that I am jesting)

Quote:

---

Originally Posted by octobrev

I totally feel your pain. Back during the days of the white list, I had my whole family playing in my kingdom (family evidenced below). I don't think I can express in words how difficult it was to let them all go. To this day, my mother still doesn't talk to me.

---

If you actually read the thread you'll find that nobody wants the whitelist system back and the main point is about attracting new players to the game. Something we should all care about.

There are a number of great data mining suites out there that would be sufficient to set up decent predictive algorithms. They're drag and drop at this point so any child with a tablet to chew on can do it. The problem is they need good data to train against with historical cheaters definitively noted. Otherwise they'll just learn to ban/delete people that were previously banned/deleted, including the false positives. :(

Such a tool would be great for picking out which players need to be monitored or looked into further though. I'll volunteer myself for the role of Chief Security Officer, providing the forum title is in a nice, royal purple color. Maybe Ben can do some To Catch A Predator podcasts based on the more interesting and high profile cases that occur.

Quote:

---

Originally Posted by chadde

Are you saying it's hard to dupe the current one? Anyone who wants to cheat can easily do so by using a proxy. And you're still thinking about this the wrong way.. We want to get a lot of new players, right? Hence the new guide, new art work etc. These new players can't be expected to come in knowing about the huge multi problem we had 15 years ago and how the game backend works. They just want to play a game - showing them error messages saying they're blocked is a good way to ensure they won't be coming back.

Instead of assuming everyone is a 1337 blackhat cheatorz we should want to build a game with good UI/UX that people can easily get in to. THEN we deal with cheaters. And this can be done by identifying login patterns and IPs rather than blanket blocking anyone who plays from someone else's IP once.

---

It's not a blanket block.

A lot of people try to cheat using proxies, but they are easy to detect.

Quote:

---

Originally Posted by chadde

1. Well that's hard to know.

2. What about making people prove it? Or use credit cards to verify like someone suggested. Also, it would be pretty easy to monitor the "multis" and see when they change IPs, go to work at separate locations. Most people have an easily recognizable pattern in their everyday life. It shouldn't be hard to figure out who's legit and who's not.

3. Yeah the device block was stupid, I take it back.

4. Should I, as an honest average player, have to put myself into the shoes of a cheater to be able to play with my friends and family?

---

Credit cards? What help would that be from deterring multies?

Quote:

---

Originally Posted by Bishop

Credit cards? What help would that be from deterring multies?

---

Don't really know.. wouldn't it? After all, that's what the other gamedev companies seem to be using, if I'm not mistaken? Obviously not an expert on this stuff myself, so that's genuine wondering, not trolling.

I just find it strange that a text-based game with 3k active users has stricter anti-cheating regulations than pretty much any other multi-player game out there.

One of many free credit card generators

Quote:

---

Originally Posted by octobrev

One of many free credit card generators

---

Would those pass the test of trying to charge $1? Also, I'm not sure about this statement:

Quote:

---

Originally Posted by Bishop

A lot of people try to cheat using proxies, but they are easy to detect.

---

Are we talking about free proxies? Then yea, sure. But is it also easy to check a paid one? Again, not a pro on web protocols or anything, but it seems to me an ssh tunnel with proper security settings should be pretty impossible to detect.

Nah the payment wouldn't go through unless the generated values happen to match a real card. They will pass any verification steps prior to that though.

Quote:

---

Originally Posted by Exxo

Are we talking about free proxies? Then yea, sure. But is it also easy to check a paid one? Again, not a pro on web protocols or anything, but it seems to me an ssh tunnel with proper security settings should be pretty impossible to detect.

---

If he answers this question he either:
1. Confirms that paid proxies are a way to cheat.
2. Tips his hand and people that would have been caught cheating will seek other means.

Tldr: no way he's answering that question lol

There are different types of proxies. "Invisible" is the variety that should mask what it is, along with a lot of the "elite" ones. Here's an example of a super bad one: http://whatismyipaddress.com/ip/85.17.24.76

Notice this area in particular: Services:Network sharing device or proxy server

Disclaimer: This is by no means to be perceived as supporting, enforcing, or teaching people to cheat. It is simply a statement of fact.

Quote:

---

Originally Posted by Palem

If he answers this question he either:
1. Confirms that paid proxies are a way to cheat.
2. Tips his hand and people that would have been caught cheating will seek other means.

Tldr: no way he's answering that question lol

---

*grins at Palem* Well put. But seriously, come on.. I'd estimate that we're mostly a bunch of old(ish) geezers here, who started playing this game in their teens and are now in their 30s. Am fairly sure that if someone wanted to cheat real bad, they'd be able to do it undetected, with minor financial expenses and huge expenses of time (which likely would be the limiting factor). The current system, at a guess, is sufficient to detect cases like when someone gets drunk and then does something stupid like creating another province. Is that worth all the hassle that it creates for people from the same household? Could, for example, instead go with that $1 charge to link a valid credit card to an account upon creation. One account for one CC. Or something along these lines..

Quote:

---

Originally Posted by Exxo

Don't really know.. wouldn't it? After all, that's what the other gamedev companies seem to be using, if I'm not mistaken? Obviously not an expert on this stuff myself, so that's genuine wondering, not trolling.

I just find it strange that a text-based game with 3k active users has stricter anti-cheating regulations than pretty much any other multi-player game out there.

---

What other games use a credit card as proof an account isn't being xlogged? Having a credit cards means that you have access to a credit card, that's it. I have 4, can I have 4 accounts?

We have strict anticheat rules because some players cheat a lot.

Quote:

---

Originally Posted by Bishop

What other games use a credit card as proof an account isn't being xlogged?

---

Mm, not really as a proof of not being xlogged, more like the general "we link an account to its owner through a credit card". World of Warcraft, World of Tanks maybe? Or maybe not. Yeah, I do agree that the circumstances are very different. But it does make me sad that I can't play with my gf in the same kingdom without a host of restrictions or setting up something that violates the ToS.

Well to be fair, you could play in separate kingdoms and face basically no restrictions except in the odd case where the two of you try to target the same province within 24 hours from different kingdoms.

Yes, that's much less alluring and I understand why some people wouldn't want to do so, but it's always an option

Quote:

---

Originally Posted by Exxo

Mm, not really as a proof of not being xlogged, more like the general "we link an account to its owner through a credit card". World of Warcraft, World of Tanks maybe? Or maybe not. Yeah, I do agree that the circumstances are very different. But it does make me sad that I can't play with my gf in the same kingdom without a host of restrictions or setting up something that violates the ToS.

---

It makes me sad when every single change we make to the game has to be ran through 'how can someone cheat or abuse this' but it is what it is.

Quote:

---

Originally Posted by Bishop

It makes me sad when every single change we make to the game has to be ran through 'how can someone cheat or abuse this' but it is what it is.

---

*sighs* yeah, I can understand that. Well, to be fair, the line between "strategy" and "abuse" is quite blurred.

Quote:

---

Originally Posted by chadde

No, sorry that wasn't a very clear statement.

She actually lives on the same street as us, and in our efforts in trying to help her learn the game she's been coming over to our place so we can show her how to calculate attacks and what all the different numbers do. And the second she entered our house with her laptop she is on our IP, and that **** stays with you. So even when she goes home and wants to attack she's still blocked from doing so.

---

Never saw this replied to specifically. My coworker had the same issue. We e-mailed utopia support and was informed blocks in regards to aid and attacking same targets will clear if he/she stops using the same IP for a 24 hour period. It's not a permanent block.

Quote:

---

Originally Posted by Exxo

*grins at Palem* Well put. But seriously, come on.. I'd estimate that we're mostly a bunch of old(ish) geezers here, who started playing this game in their teens and are now in their 30s.

---

I'll have you know i was in my 30's when i started playing in age 3!!! Whippersnappers ;)

Had a different board name back then. Not that i ever posted much to begin with.

Quote:

---

Originally Posted by JokesOnMe

Never saw this replied to specifically. My coworker had the same issue. We e-mailed utopia support and was informed blocks in regards to aid and attacking same targets will clear if he/she stops using the same IP for a 24 hour period. It's not a permanent block.

---

No it's not. But the whole point of her joining was that she wanted to play with us an we could teach her how it works. It makes it harder when we can't have two computers in the same house at the same time.

Also, like most people I have the utopia app as well. All it would take is for me to walk by her house for my phone to connect to her router. Boom, my account is blocked from hitting the chain target for another 24 hours. I mean c'mon.

Quote:

---

Originally Posted by Bishop

It's not a blanket block.

A lot of people try to cheat using proxies, but they are easy to detect.

---

It is a blanket block as it targets all users from that IP instead of just an offending account. If that IP belongs to a university or large workplace the damage is even greater.

I would also like a response to my earlier post:

With the IPv4 pools getting depleted ISPs have started putting more and more clients behind large NAT pools and only if you ask for it will they give you a private IP. My point here is that IP block is no longer a realistic, reliable way to ban users. It hasn't been for some years now.

Quote:

---

Originally Posted by chadde

It is a blanket block as it targets all users from that IP instead of just an offending account. If that IP belongs to a university or large workplace the damage is even greater.

I would also like a response to my earlier post:

With the IPv4 pools getting depleted ISPs have started putting more and more clients behind large NAT pools and only if you ask for it will they give you a private IP. My point here is that IP block is no longer a realistic, reliable way to ban users. It hasn't been for some years now.

---

It targets only provs with that IP interaction, so it's not a blanket block.

ISPs have been using ipv6 addresses for some time now.

Quote:

---

Originally Posted by Bishop

It targets only provs with that IP interaction, so it's not a blanket block.

ISPs have been using ipv6 addresses for some time now.

---

It doesn't target one account, it targets anyone who happens to be in the virtual vicinity. Blanket.

Are you saving ISPs exclusively use ipv6 and never put unsuspecting customers in IP pools? Then you are wrong.

Quote:

---

Originally Posted by chadde

It doesn't target one account, it targets anyone who happens to be in the virtual vicinity. Blanket.

Are you saving ISPs exclusively use ipv6 and never put unsuspecting customers in IP pools? Then you are wrong.

---

i didn't say anything of the sort.

Anyway, whats your solution?

Could just allow people to multi and police the specific negative behaviors! If 3 people want to log their entire KD, more power to them. It doesn't make them good.

Quote:

---

Originally Posted by Bishop

i didn't say anything of the sort.

Anyway, whats your solution?

---

I have previously talked about other ways of policing cheaters. The current mindset is wrong, instead of preventing me from playing in the same kd with a friend from work, why not let us play and instead block accounts who actually break the rules. I haven't broken the rules, neither have my coworker. Why are we being punished?

What needs to happen instead is intelligently watching user behaviour and punish people who actually cheat. Check login patterns, aid patterns and IP patterns and make an intelligent decision about whether or not the account is cheating. Chances are if two accounts share the same IP for 8-9 hours every monday to friday and log on from different ones on weekends and weeknights - they are not multis, they just happen to work together.

If the reverse is true and two accounts share an IP every monday to friday after 6PM and on weekends, but are on different IPs during work hours, then guess what? They live together in some form but are clearly not the same person.

Add to this login patterns, start tracking what a normal user does and you'll learn to identify anomalies.

And before you say "a malicious user could learn these patterns and create a massive botnet that has one million accounts and plays them all within the rules", let me say that
1. of course these rules wouldn't be made official
2. that guy is way too dedicated and doesn't exist
3. most of us aren't here to cheat. In fact I'd say almost none of us are.
4. please trust your players just a little bit, won't you?

3. most of us aren't here to cheat. In fact I'd say almost none of us are.

4. please trust your players just a little bit, won't you?

sorry but that made me laugh more than anything ive read today,thanks.

You are so naive Chadde.

Y'all are right, there are at least 30 people that would go out of their way to cheat to win at an online game at all cost.
Then there are (staying on the safe side) 2000 players that just want to play the game, with possibly more to come.

so they can either punish the players that just want to play the game, which is what is currently happening.
or they can just punish the 30 that cheat.(yes i know there are a few more sadly)

everyone knows who they are, shouldnt be too hard really. Half of them openly admit and even brag about it.

And I love when Goodwitch starts pulling numbers of out of her arse and presents them as facts. :)


Id love to see that list of yours

The credit card verification charges a dollar, but also checks DBs of names, among other things.

Quote:

---

Originally Posted by Goodwitch

Y'all are right, there are at least 30 people that would go out of their way to cheat to win at an online game at all cost.
Then there are (staying on the safe side) 2000 players that just want to play the game, with possibly more to come.

so they can either punish the players that just want to play the game, which is what is currently happening.
or they can just punish the 30 that cheat.(yes i know there are a few more sadly)

everyone knows who they are, shouldnt be too hard really. Half of them openly admit and even brag about it.

---

If I remember right less than 4% of players were affected when we brought in the IP block, and an even smaller amount of their actions were affected.

Also I delete 30 accounts a day easy. You under estimate the cheating :)

Quote:

---

Originally Posted by chadde

I have previously talked about other ways of policing cheaters. The current mindset is wrong, instead of preventing me from playing in the same kd with a friend from work, why not let us play and instead block accounts who actually break the rules. I haven't broken the rules, neither have my coworker. Why are we being punished?

What needs to happen instead is intelligently watching user behaviour and punish people who actually cheat. Check login patterns, aid patterns and IP patterns and make an intelligent decision about whether or not the account is cheating. Chances are if two accounts share the same IP for 8-9 hours every monday to friday and log on from different ones on weekends and weeknights - they are not multis, they just happen to work together.

If the reverse is true and two accounts share an IP every monday to friday after 6PM and on weekends, but are on different IPs during work hours, then guess what? They live together in some form but are clearly not the same person.

Add to this login patterns, start tracking what a normal user does and you'll learn to identify anomalies.

And before you say "a malicious user could learn these patterns and create a massive botnet that has one million accounts and plays them all within the rules", let me say that
1. of course these rules wouldn't be made official
2. that guy is way too dedicated and doesn't exist
3. most of us aren't here to cheat. In fact I'd say almost none of us are.
4. please trust your players just a little bit, won't you?

---

We use heuristics to detect cheating already but what you are describing is basically a neural network to detect cheating. That's huge overkill and would probably affect genuine players not even on the same network. An IP block is low effort and have proved hugely successful.

Quote:

---

Originally Posted by Panthira

The credit card verification charges a dollar, but also checks DBs of names, among other things.

---

I have 4 cards, can I have 4 accounts? Proving a person exists in no way provs the accounts aren't being xlogged to assist each other. An IP block removes that advantage.

Quote:

---

Originally Posted by Korp

You are so naive Chadde.

---

You think more than 50% of the players of this nostalgia game are looking to cheat? Because if it's less than 50% the system ain't right.

Quote:

---

Originally Posted by chadde

You think more than 50% of the players of this nostalgia game are looking to cheat? Because if it's less than 50% the system ain't right.

---

Point 3 and 4 is a emotional argument that holds no bearing to reality. Hence you are naive cause you don't have the experience and knowledge.

Quote:

---

Originally Posted by Goodwitch

Y'all are right, there are at least 30 people that would go out of their way to cheat to win at an online game at all cost.
Then there are (staying on the safe side) 2000 players that just want to play the game, with possibly more to come.

so they can either punish the players that just want to play the game, which is what is currently happening.
or they can just punish the 30 that cheat.(yes i know there are a few more sadly)

everyone knows who they are, shouldnt be too hard really. Half of them openly admit and even brag about it.

---

Yep, instead of targeting the 140 cheaters (according to Bishop's 4% estimation) we're all getting punished.

Quote:

---

Originally Posted by Bishop

I have 4 cards, can I have 4 accounts? Proving a person exists in no way provs the accounts aren't being xlogged to assist each other. An IP block removes that advantage.

---

Do they all have different names on them?