Comment on For security reasons
kashifshah@lemmy.sdf.org 1 month agoLet’s talk about the security of using email to do anything in this day and age.
Comment on For security reasons
kashifshah@lemmy.sdf.org 1 month agoLet’s talk about the security of using email to do anything in this day and age.
neatchee@lemmy.world 1 month ago
You’re not wrong, but this isn’t really a security matter, it’s an “apparent uniqueness” matter. Their goal, I assume, is to satisfy critics enough that a given petition’s participants are sufficiently unique while keeping the barrier to filling out the form as low as possible. So they end up in a situation where neither of perfect, but they’re both “good enough” for what the business needs.
I dealt with this in the anti-cheat space: my goal was never to remove all cheating, because that’s too expensive (insanely so). My goal was to make the public believe they weren’t playing against cheaters too often. If the solution was forcing the cheaters to perform at a level that was just below the most skilled human players, that was actually a success, because if the players can’t differentiate between cheaters and pro players, then they can’t effectively determine how prevalent cheating actually is.
Part of me hated that we had to treat it that way, but another part of me understood that if I pushed too hard on “eliminating cheating” my department would become more costly than it was worth and they’d pivot away from gameplay that needed anti-cheat at all
kashifshah@lemmy.sdf.org 1 month ago
Risk management is the name of the game, as always, eh?
That’s a slick technique for anti-cheat, heh. What did you think of the Call of Duty “fake data” approach? That cracked me up - things in game that only cheaters can see, so they end up self-reporting themselces as cheaters lol
neatchee@lemmy.world 1 month ago
As it ever will be, much as it may pain our moral sensibilities.
Re: CoD - I loved it. Laughed my ass off. Absolutely a big fan of creative approaches to getting cheaters to tell on themselves. I proposed something similar to my team when we had a problem with players manipulating the position of objects in the world so they were directly in front of the player: add an object of the same type inside map geometry and attach a “kill volume” to it, so it was like a landmine. Move the object in front of the player and they instantly die :P Wish we’d done it but couldn’t get the level designers’ time to implement it unfortunately
One we did do though: back when the product I worked on was on PS3 one of the big problems was hacked consoles spoofing platform entitlements (the thing that tells the game what purchases they should have access to). So we added an entitlement that couldn’t be acquired in any legitimate way, and gave you a specific item in game. Then we just checked player inventories once a week for anyone with that item and banned their account, their console, and any account that played on that console for a meaningful amount of time. Did the same thing with an item you could only get to by clipping through geometry. Even put the word “intrusion” in the item’s name haha.
The cheats are so technically complicated at this juncture that the creative stuff is often the most effective. I mean, people are literally voluntarily installing hypervisor rootkits to run the cheats, so they can talk to their drivers below even the kernel. It’s so hard to come to with technical solutions to a problem like that that doesn’t wind up costing massive server processing power to validate every input.
kashifshah@lemmy.sdf.org 1 month ago
Haha that is a great idea! Give the landmine kill a special animation just to make sure that the cheaters get the message or let them figure it out in time lol?
Heh, did you share that inventory technique on news.ycombinator? I could have sworn that I read a story there a team doing that.
I know exactly what you are talking about - I was digging into the modding of this one game and happened upon a cheater’s forum. Blew my mind that the first step was to completely gut your computer’s security lol. But at the same time, was enlightening to see that. Seems like some of the work has been moved to the Anti-Cheat systems, but I’m guessing that there must be large gaps in what the AC can actually do for you at the application level?
kashifshah@lemmy.sdf.org 1 month ago
I spent about a decade in the enterprise software development space, so I totally get it. I couldn’t put it into words as well as you did, however.
After watching the FCC bigwigs debate robocalls several years ago, I’ve become a believer in a future where your internet access is always authenticated to your real life ID, dark web excepted of course.
In their case, it was posited as a best-in-class solution to the problem of spam in the telephony space. Same logic applies to email. I mean, look at what Twixxer did with the verified checkmark requiring a credit card. The trend is already there.
I get the fear of being de-anonymized on the internet, but it may be the case of something we hate being something we need, when you start to throw deepfakes into the mix.
neatchee@lemmy.world 1 month ago
Funny you mention the robocall thing… I’m literally leaving a company that works on that problem (though not as their primary business) Wednesday. It was a short stint - mostly because they are resistant to solving massive technical debt problems and I’m not trying to doom my future self - but what I witnessed was…depressing. Getting anything done was like pulling teeth, and that’s with the recent FTC pivot to taking this stuff more seriously. STIR/SHAKEN is a reasonable start but it still has almost no teeth behind it.
I’m with you on the identity issue. I mean, if we’re being really honest, the only people losing out by not implementing strong personal identification verification are the legitimate end users because the threat actors have gotten so unbelievably good at fingerprinting user behavior. And it’s only going to continue getting worse. With ML growth as unfettered as it is, there is nothing we can do. So I’d much rather take the reigns and make identity verification a robust feature instead of a bug we can’t squash.
kashifshah@lemmy.sdf.org 1 month ago
Kudos for looking out first your future self - I had to leave the field entirely after it got to the point where I couldn’t stand to look at a computer anymore. Still can’t for more than an hour, two years later.
I intend to reply more later, because this does deserve a longer reply, but I am short on steam.
In the meantime, have you heard of login.gov? Check that out. The day that .com gets a hook into that is the day that identity problems are (mostly) solved.