Comment by Jerrrry | Hacker News Reader

Comment by Jerrrry | Hacker News Reader

Parent Full thread

Back when my sole internet experience was playing (losing) every match on Chess.com as a "volunteer librarian", I'd often inject awkwardly escaped characters, closing tags, common quirky control strings, and even OLE objects into the live Chess.com games.

Eric (founder) had politely asked me for a more formal audit (to which I declined, not wanting to out myself as an 11 year old script kiddie) but I did explain the RegExp needed for the chat room censor and we tackled the ultimate problem; how to detect cheaters in asynchronous environments.

After consideration I informed him the only way to possibly detect cheaters is to compare every (game-significant/high-mu) move made against the known optimal moves from engines, and use statistical inference to discriminate good humans from cheaters.

Of course, at the time, this was laughably unfeasible - which was the answer we had concluded on. But for a barely out of elementary kid to discuss those kinda nuances with a legit webmaster (Hello Eric!), it is one of my more favorable internet memories.

> the only way to possibly detect cheaters

why would this be the only way? I can think of many different things you can do to detect cheaters

Any detection scheme based on extra information from the client could be defeated by running the chess engine on a separate computer. A human typing in their next move is indistinguishable from a human copying a move from an airgapped chess engine. Therefore, the only information that can be used to tag cheaters is the moves themselves.

> Any detection scheme based on extra information from the client could be defeated by running the chess engine on a separate computer

Response time and strength consistency could be detected regardless of having another computer.

If a person is always playing fast moves, or playing very consistently or very inconsistently good moves, they could be detected.

Comparing with results from an engine is exactly how you obtain the "strength" of moves that you speak of.

What are a few? I'm curious. Do they all involve monitoring the client itself?

That is all "synchronous" - the heuristics available in the meta-game itself.

Back then the document object in javascript were way to powerful because everyone was so naive.

Internet Explorer knew/could easily infer its absolute coordinates from the origin on the desktop, would gladly serve the majority of your C: drive to any website that asked nicely enough, and a plethora of now-incredulous things.

It was possible to know if you had moved the window by dragging or by Cascade windows, had another window (this was before tabs were invented) that was being referenced nearly every turn, or even if the user had referenced an application from the Start Menu.

That was all the stuff that "wasn't" supposed to be done. The obvious, yet cat-and-mouse tricks, such as mouse/keyboard jitter, fingerprinting profiles, style/chat stylelemoetry, behavior meta-game analysis, were in their relative infancy, but were making strides.

He didn't mention the methods not involving monitoring the client. Most of them would involve monitoring it, yes.

- Response time

- Strength consistency within current game

- Strength consistency across all of user's games

- Is user switching windows

I bet these are already integrated in current cheat detection.

These were discussed, and many more, seeing as IE5 had a few more....creatively-enabled permissions that were emergent after some familiarity.

Reply on news.ycombinator.com