Hacker News new | past | comments | ask | show | jobs | submit login
Respawn will deal with Apex Legends cheaters by making them fight each other (gamasutra.com)
68 points by yrochat 39 days ago | hide | past | web | favorite | 81 comments

I hope they are also keeping separate rankings for cheaters, that would be pretty cool.

"I'm currently the #5 player in the cheater zone of Apex."

Heck, embrace it: don't call it the cheater rankings, call it the tool-assisted rankings, by analogy with "tool-assisted speedruns". Tag people at the end of the game with which particular cheats you detected. Pop up a polite notice that "We have noticed that you seem to be using external tools to help you play better; we will now be matching you up with other cyborg players to keep things fair. Good luck, and may the best man-machine win!"

Many moons ago I made a "chatroulette" application for the reddit community. It was surprisingly popular, but was plagued by your typical penis flasher.

I added a simple "report" button. After a user had been reported a few times they were silently sandboxed with other penis flashers so they could flash their penii at each other.

I love this way of dealing with bad actors - but I think that its a bad idea to let them know whats happening, as then they can try to circumvent. Keep them in the dark, just let them cheat against other cheaters and wonder why they suddenly suck - dont glamorize entering the cheater zone.

Not telling the user is also problematic. If your false positive rate isnt 0% you are seriously messing with some people. The same issue exist with shadowbanning, you can make an argument to shadowban trolls who dont follow the rules of a given environment on purpose, but shadowbanning a random user is just really ugly. Wasting someones lifetime like that for no reason is just wrong.

In my case, it matched them with me for verification. Not the most pleasant job in the world :D But yeah, you shouldn't just do it at random - it must be justified.

That would be really interesting! Although it'd be like offering a gym for cheaters, heh. A place for them to hone cheating tools and techniques that would end up back in the regular game.

But could avoid that if a game embraced it holistically, where the default is tool-assisted and anything goes.

Isn't one of the hardest parts of making these tools evading detection? An aimbot isn't that tremendously difficult to create, the hard part is creating an aimbot that is hard to differentiate from a skilled player.

If the competition is all using assists, then the sneaky aimbot that simulates slower human reflexes will lose to the bot that positions the sights directly on the opponent in <0.1ms. I like this idea, I don't see why it would make it any easier to develop the types of cheating systems that affect human players, and it might be fun for the types of players that enjoy things like tool-assisted speed running; where the ultimate aim is more about studying the underlying game mechanics to determine the algorithmically-optimal way to play. If the default is tool-assisted, then all the human players will be excluded by default.

Even in the very old days it was more of a balancing act: It's not super difficult to make it undetectable, but it will be slower. Slower means that you will always lose to the more detectable variants that somehow still manage to evade the technical filter (but not the people filter). The second segment will of course eventually get banned, but in the meantime you will keep losing to them.

There's an interesting argument to be made that by embracing the cheating market wholesale, it divides the cheating community into separate units. Those that are happy to exploit games publicly and share code, versus those that would prefer to hide and benefit from it financially or otherwise.

In that sense, encouraging people to come forward with hacking tools means that you'll have a stronger awareness of how they're used. Then if you were to leave the less destructive methods of hacking alone, you could design your detection methods to explicitly examine those avenues of exploitation and maintain a clean separation of people who use outside tools and those who do not.

It's an attempt to combat the constant arms race of hacking by deflating it a bit.

The downside to making this visible in-game is people will then iterate their cheating tools until the game doesn't detect them.

I haven't kept up with it, but back in the day of Counter Strike there were VAC-disabled servers specifically configured for cheaters and it was very interesting to see all of the various aimbots, wallhacks, etc going at it. Some of the cheats were specifically designed for these servers.

As someone mentioned elsewhere in this thread, this was called HvH. Great stuff.

It still exists apparently.

Unfortunately that would be really hard to do without creating a "did we detect cheats" oracle. If they did that, the only thing a person creating a cheating tool needs to do is play a few games to make sure the tool is not detected anymore.

But is that not exactly what cheaters are doing right now? I reckon it would make less sense to implement this kind of system in games which aren't free. The price of the game disincentivizes cheating and makes consecutive iterations of the cheat harder. However, Apex Legends is free. Every time a cheat is detected nothing withholds its developer of creating a new account for the next iteration.

Sometimes... VAC can kick you mid-game for very obvious things. But in other cases you may be able to play for hours until a report goes through and gets verified. That delay (as a side-effect) guarantees that you can't quickly iterate and get immediate feedback on whether you're detected or not.

Often in console land, bans come in "waves" at pre-scheduled times, so you have a hard time matching the cause with the ban

the idea is that cheaters would find it more fun to play in the tool-assisted mode. obviously there will still be some black-hats who try to hack the main mode.

The problem is that it this ends up boiling down to your tools, so it's...programming. Competitive programming can be fun! But cheaters are looking to cheat, not compete, which is why they aren't playing something like Screeps.

Actually in CS:GO there's a pretty big Hack vs Hack scene where both teams cheat. It's interesting because on one hand there are some novel cheats, on the other you still have to obey the game's mechanics, just in a different way.

Note: Please do not cheat in video games unless everyone involved is okay with it (such as dedicated HvH servers)

A cyber hamsterdam of sorts

I think RuneScape (or old school runescape) used to do this as well, if your account was flagged for botting you'd be silently placed in a hidden world (and unable to join other worlds) with other botters so they could better keep an eye on you.

Yes. It also navigates around the problem of "I payed this much money for this game and now I can't play it ever because I possibly broke some rule. Maybe not, maybe autobanning tool was just overzealous with me. Now what?"

I'm not sure being accidentally placed in a Colosseum of cyborgs as an average player would be any fun

You can expect to be able to play. Whether it'll be fun for you or not depends on many factors and you can't expect to be ensured that you'll have fun just because you paid for it.

Basically suddenly you'll feel like people that murder you are cheaters and for the first time you'll most likely be right.

That sounds sort of like the Olympics but for steroid-users.

There's a SNL sketch about that: https://youtu.be/jAdG-iTilWU

Also - a separate MLB where you can 'roid your testicles to kingdom come. Let everyone have a 1.1 slugging average and the pitchers all throw 110

They have this for significant weight lifting competitions. Where known steroid users are allowed to participate.

Counter strike has a similar system, based on a hidden score called trust factor. Matchmaking system does some optimization and tries to pair similarly skilled people with similar trust factors.

They also have a neural network setup that constantly scans match logs for cheaters. If I remember correctly it is responsible for > 50% of all cheater reports (the rest comes from players). Final conviction comes from a crowd sources system called Overwatch, where experienced players rewatch anonymous demos and convict cheaters. Conviction itself may require even 40 or more individual player convictions, and is Bayes-based.

> They also have a neural network setup that constantly scans match logs for cheaters

For those wondering what this is referring to, it's a system called VACNet[0] presented at GDC last year.

[0] https://www.youtube.com/watch?v=ObhK8lUfIlc [1] https://www.youtube.com/watch?v=SnRgW54EWwA

While VACNet is amazing, and completely eliminated pretty much all "exploits" that cheaters could come up with to dodge the Overwatch system, Trust Factor on the other hand has been a bit of a mess. The assigned trust values seem really random in my experience (you can't see the exact values, but if you queue with someone who has a slightly or significantly lower Trust Factor than you do, you'll get a message), tend to fluctuate wildly from one week to the next or even just between single games for some people, and there are so many players complaining about it that they had to auto filter every thread that even just contains the words Trust Factor on the CS:GO subreddit.

I HATE trust factor. It's TERRIBLE for me, personally. I don't cheat but get reported a lot and my trust factor is very low. I end up playing with/against cheaters constantly.

It also doesn't seem to have any affect on casual game modes, which is really irritating.

So the matchmaking equivalent to hellbanning

I wonder if anyone has actually put any real thought into effectiveness of such concepts? Creating a parallel universe to stick your undesirables; 4chan and reddit do something similar (though the user self-influcts it) with their containment boards, so the history definitely exists

DoTA 2 has been doing this for years now with toxic players. I don't recall reading anything about how effective it ended up being, but it seemed like a good idea at the time.

I recently started playing DoTA again after stopping for about 2 years and I have run into a handful of toxic players, but it doesn't seem to be as frequent or as bad as it used to be. For example, when I stopped playing two years ago it was basically a 50/50 chance you would be in a game where someone would say really terrible things about Brazilian or Chinese players for the entire match.

It worked and continues to work beautifully.

There was a video recently by Dota Alchemy about how the system applies to high a penalty if you have an accidental abandon or just raged way too hard for a few consecutive games, but you can grind up the behavior score quickly through 10 turbo games.

Quickly? A turbo game is half an hour. That would be a whole evening to get 10. Not to mention that a lot of things could go wrong in that many games.

Quickly in scale of weeks.

Coming from Pokemon GO, where the anti-cheat policy is "we will do nothing to actually disincentive toxic user (as they spend good money) but still we will impose arbitrary and artificial limitations to make it worse for everyone" some grinding look like a good solution.

Abandon is ruining a match for 9 other players. So 10 looks like about right.

This assumes that the game is not already ruined.

Out of 10 games, how many of them are already ruined because 1 or 2 people left, or players are just insulting one another with the most awful thing they can think of. I'd consider quitting to be fair in both cases.

in LoL, the system didn't penalize you for a game that already had a quitter; As for the latter issue, you would avoid the penalty by flagging the other players on exit (and it being accepted). I'd assume Dota has something similar in place

Just as DOTA2 does it according to a sibling comment of this, CSGO has a system called "Trust Factor".

Anecdotally: I am a nice guy and a good teammate, I don't abandon, I don't team-kill, etc.. I saw quite a few cheaters when I first started playing the game, but now they are quite a lot more rare and especially more subtle, to the point where I am usually not certain even when I suspect someone.

There's some pretty damning stats about how many people cheat in CSGO as well, so it's seemingly quite strong in my opinion. Of course, other's summaries will beg to differ as they see a lot of cheating and hold themselves in equally high esteem, so ymmv

>containment boards

What are the containment boards? I assume you aren't talking about /r/thedonald.

On 4chan at least, containment boards are a subforum created for people who are talking about generally unliked subjects. /mlp/ is an example, it was created to discuss my little pony Fandom to stop it being discussed elsewhere on the site.

Sounds a lot like Brockian Ultra-Cricket.

I'm surprised that Respawn has had so much trouble controlling cheaters in Apex considering they handled security in Titanfall 1/2 amazingly well. The f2p barrier probably contributes a lot to the problem.

This isn't a new strategy for them btw. There were similar strategies in place for Titanfall 1. https://www.eurogamer.net/articles/2014-03-27-respawn-locks-...

Can someone explain how these strategies aren't standard across online games by now? They've been around for years, but it's always a big deal when a game adds them.

Because it's a non-trivial feature to develop, test and maintain. Simply using a flag (banned = true or false) is lot easier / less complex / fewer potential side effects.

To go further, automated ban systems often result in a ton of customer support, and depending on the game's monetization model they can heavily affect the bottom line if too many of a certain type of player are removed from the game.

Also this problem is exasperated in Apex Legends because it is a free game that is also popular in Asia.

I would disagree with that. When you ban someone, they know. They make a new account and come back.

When you move them to a cheater queue, they don't know. They keep playing, none the wiser. It's infinitely better for everyone. The cheater still gets to play, and the non-cheaters aren't affected as much because the cheater doesn't just keep coming back.

The complexity in your app is that you need to have multiple matchmaking queues, which you probably already support due to skill tiers. So is it really that difficult to add more matchmaking queues for the cheaters?

But it is more complex in the sense that you need a lot of fine tuning. If you just match cheaters with cheaters then it is easy to see too.

You need some kind of dynamic ranking of "toxicity" (in this case cheating) match user with other of similar toxicity.

>When you move them to a cheater queue, they don't know. They keep playing, none the wiser.

When 99.9% of the people you get matched with are cheaters (many of which might be quite obvious), it's not that hard to figure out that your account was probably shadow banned. Some cheaters might not care, but it's certainly not hard to figure out.

They've been used a lot in the past--most notably, for me, in Diablo II back in the early 2000's. I remember writing a bunch of D2JSP code back in the day and getting my account "flagged"--basically stuck forever to play against pickit users and autolockers.

Friends were able to join my game, but not I theirs, and the "available games" list was way smaller.

They are. Basically every online multiplayer game does this when they get big enough. I'm not sure why it's news.

Not necessarily about cheating, but a good Riot Games post in the past dealt with their attitude toward creating a "Prisoner's Island" for toxic players:


Three-factor authentication? What's the third factor? Something you know, something you own, and... maybe something you are (biometrics)?

It's a mistake/misunderstanding in the article. They're using two factor authentication: https://old.reddit.com/r/apexlegends/comments/cciyx6/712_res...

Something you know, something you're pretty sure you wrote down somewhere around here, something you aspire to be.

Fourth factor, something you believe in

It seems like three-factor is a mistake in the article, but what you suggest is very close to the three factors that will be involved in SCA (Strong Customer Authentication), an upcoming European regulatory requirement to reduce fraud in payments:


(Although only two of the three will be required.)

Something you know, something you have, something you love

Typically two factor authentication just means this account and one other account. Incidentally sometimes is a gadget or a phone number.

Adding two secondary accounts (both an SMS and an email) could warrant the name

Why can't it be: Something you know, something you have, something else you have?

Because if I can steal one widget from you, stealing two probably isn't significantly more difficult unless you actually care about physical security and keep those two objects far apart from each other.

Now, it's likely that you do the right thing given the chance, but I know for a fact that my dad keeps the keys to his safe in his filing cabinet, and the keys to his filing cabinet in another filing cabinet. It's not really an extra layer of security.

The reddit post the article references has some more information: https://www.reddit.com/r/apexlegends/comments/cciyx6/712_res...

Meh. It's one of those cases in which people will praise the decision and be like "haha stupid cheaters will cheat on each other". But the reality is, if you can tell someone is a cheater, you could have banned them. If you make decisions like this, then you are admitting that your cheat detection code isn't perfect. As a result, some people with obvious cheats will have this experience, but many people will have their cheats undetected and nothing will change.

No cheat detection code is perfect. Banning cheaters encourages the creation of new cheats (or just new accounts, since it doesn't cost anything to start playing Apex). Allowing cheaters to continue playing is a win for two reasons:

1. They don't know they've been quarantined, so cheat makers will get less feedback about which cheats have been detected. 2. Cheaters are more likely to try new cheats, so it gives a sandbox of users that can be used to find other cheats as they arise.

Reminds me a lot of hacking servers in cs 1.6 back in the day. I was a regular in some of them. People in these servers would pretty much brag about how much better their hack was compared to everyone else's(often also claiming that they programmed it themselves, could be true sometimes but id say most not). I thought it was fun. Everyone has an aimbot, but the faster, better coded one will win.

> requiring three-factor authentication in certain regions

I hope obligatory two-factor authentication is not becoming a trend.

So they are admiting defeat :^)

This will not stop the subtle cheaters though, in a game like Apex you could even drop the aimbot and only use the information advantage of a wallhack. Good times to sell cheats

Could be a fun revival of the counterstrike "hvh" scene

Someone should tell them about adversarial networks. Fighting each other... helps.

That is a good idea. Keeps player engagement up.

They need to add players with XIM on PS4 to this

I wish all games allowed botting and just pushed you onto a unique server so you can't hurt the economy. Such a great playground for developing early coding skills.

i would have liked this for pokemon go. i started scripting the week it came out and then was banned in the 2nd or 3rd ban wave. but i would have liked to continue playing against other scripters

A significant part of Niantic's servers were overloaded with bot requests at that time, which caused massive lag for everyone. Banning was their only option.

They came with a shadowban technique later though : https://www.theverge.com/2017/5/24/15686428/pokemon-go-niant...

Thanks for owning up to making the world a slightly shittier place.

Sadly the nature of the game doesn't allow for this, you cannot just spin up more matches in PoGO.

But on this I am very critical of how Niantic is handling both Pokemon GO and wizard Unite

What is your issue with WU? I can’t see scripting really impacting the play of others (at least not yet).

the energy system, it is almost impossible not to periodically end energy and have to grind at inns to continue playing as everything needs energy in the game.

In comparison in PoGO if you finish one category of scarce items you still have many part of the game you can play in (e.g. with no pokéball you can still fight in gym and raids)

Cysports / Cylympics (Cylym?) / Cygma / Cygames

Obligatory XKCD - https://xkcd.com/350/

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | Legal | Apply to YC | Contact