The irony is that EAC doesnt stop cheaters at all. (2024)

It won't stop anyone who has the skill to author cheats themselves (i.e. someone with basic reversing and programming experience) but it does do a good job of detecting and banning players who are using widely distributed "commercial" cheats.

I look at EAC as being very analogous to a virus scanner, very easy to bypass if you know what you're doing, but good at catching the common and soon-to-be common threats. It also puts up enough roadblocks to make some novice attempts at cheating inconvenient at least.

Source: I deal with all the anti-cheat stuff (including EAC) on a semi-popular multi-player game. I can verify that it does make a very tangible difference to our player base in terms of the number of cheaters they are exposed to on a per match or per session basis.

Many major titles are using EAC currently, Fortnite, Apex Legends, PUBG, etc. There's a pretty large market for cheats in any of those titles. Just dropping "<game> aimbot" or "<game> cheats" into google is likely to turn up a multitude of commercial cheat developers, many of which are legitimate and will bypass the current anti-cheat.

Generally the legitimate commercial cheat developers offer status pages detailing any of their cheats that are currently detected and offer additional tools to do things like bypass hardware ID detection if you did get banned in the past.

> bypass the current anti-cheat

Maybe I'm clueless but as I understand it some of these shooters (e.g. PUBG) are games that you pay for. If one of these commercial cheats gets detected by EAC isn't the result a permaban of your paid for account? And then you have to buy the game again and make a new one, if that's possible at all? Seems like that would be a serious deterrent, although obviously it won't stop everyone. (Encountering a cheater once out of every ten matches is probably acceptable. Encountering one in every other match probably isn't.)

AFAIK, some of the top cheats are SaaS products and require a lot of money (e.g. > $50/month for a game like Escape from Tarkov).

So yes, that's a deterrent but not for those willing to pay a price equal to the game for monthly access.

Do these anti cheat systems detect popular products of popular dev tools to create cheats typically? Or is the cheat world way beyond that phase and everyone just codes to the native OS APIs directly, making that hard to detect?

Is there still cheating in console players? Maybe with jail broken devices? Do these companies really have to think about cheating with consoles? Do you think the eventual future of these kind of games is some sort of locked down console-like system, which is what apple seems to slowly be going to with their hardware?

The list of games protected by EAC is basically a list of games with terrible cheating problems.

Fortnite, Rust, and Fallguys being the most obvious.

There's people selling subscription cheats with money back guarantees against detection.

In the end, games need to be built better by sending the least information needed to clients, ie. zero-trust. This is a big part of things like CS:GO, Valorant, and RTS games like starcraft/League/Dota since they can implement a 'fog of war' and only network information if their client actually needs it[0].

The only cheats that still plague Dota are scripts that perform tasks automatically, such as disabling an opponent as soon as they're visible (beyond human ability), and those are taken care of by heuristics[1] and a community-voting-based 'overwatch' system in CS:GO and Dota 2[2].

0: https://technology.riotgames.com/news/demolishing-wallhacks-...

1: https://youtu.be/hI7V60r7Jco

2: https://www.dota2.com/newsentry/3025824821114909461

>games need to be built better by sending the least information needed to clients, ie. zero-trust

That isn't possible in real world for every type of competitive gameplay; trade-offs need to be made. Even games you list are not "zero trust" - things like looking direction are left to the client because of the latency.

Moreover, it's not enough. What's also needed is a hardware chain of trust for input devices. On-device cryptographic signing of mouse events would be sufficient and would guarantee that input comes from a fair play-compliant device.

> On-device cryptographic signing of mouse events would be sufficient and would guarantee that input comes from a fair play-compliant device.

SGX for human inputs. What can go wrong?

SGX is a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything. Signed mouse input is much more benign. But sure, I see your point - this is DRM, and it can be used to control the access to your own mouse, even outside of online gaming.

Still, it's the most logical step, and it would probably happen in several years, after Microsoft started demanding TPM 2.0. Valorant already requires TPM to be enabled on Windows 11 to run.

By the way, A4Tech has on-device DRM for more than a decade, they are using it to stop people pirating their software. Which is, ironically, designed for cheating.

> SGX is a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything.

My position is s/"a super-privileged, encrypted, and isolated enclave in the main CPU memory that can be used for anything"/"a failed experiment in computer pseudoscience".

And the nightmare scenario I imagine is a more lubricated path to framing political dissidents by forging attestations that they were searching for child abuse imagery or some similar scenario.