Better authentication would be very nice.

However, if you want to force SSL, you can do so using...
http://www.stunnel.org/

And a firewall. Setup stunnel to route all traffic to TWGS,
then firewall the regular twgs port to the outside world.
Then only ppl coming in via SSH could get in. You can
also use stunnel in reverse to get twxproxy and swath
access to ssh as needed.

There's no way you can know with 100% certainty that
someone is who they say they are, but you can add layers
of complication to the process. An email address and a
phone number, along with a call to that number, for
each person, would make it a lot more difficult to dupe
and stuff.

The problem with dual-key encryption is the need to
authenticate both parties via some previous trust factor.

I digress, but technically, you *could* verify identity by requiring (and logging) a webcam feed of the user and their keyboard

On a less outrageous note, a great tool to add to twgs would be IP address to geolocation mapping. I wrote a basic tool to do this when I was sysoping one of SG's tourneys. and had plans to polish it and release it for other sysops to use, but haven't yet. The idea though is that a sysop could be alerted if a user's physical location changes by, say 150 miles. You could even show all of a user's logon locations on a map. IP to location mapping is prolly 90% accurate, but that would provide great insight for sysops.

Yeh but you have no way of knowing if that feed is accurate.



Yeh, some ISPs have blocks all over the place.

Everything so far can be counteracted by Tor, Software as a Service, or free Shell accounts. In the age of cloud services, proxies and free Vpn's its next to impossible to prevent cheating. Even video streams can be faked on the cheap.

I'd argue the more secure you try to make it the more exclusive and effective cheats will become. Certainly you will prevent the majority of unmotivated cheats but for the few that make it a mission, they will flourish.

All a player would have to do is get couple of his real life friends and video tape them acting like they are playing TradeWars. Even video them getting up to get drinks, food, etc... and then play this back in a loop as a video feed, there are at least 3 free software packages that will do this.

I have been thinking a lot about DUPES lately, and there isn't really any way I can validate a user. Email validation is a moot point, because gmail and yahoo, etc. give away free email addresses. Even if I eliminate all the free email providers, anyone can purchase a domain name for $7 - $15 and create all the email addresses they want. EIS forum validation has been suggested, but anyone can create DUPES on the forum. Phone validation is even mute, because I could be talking to one of your friends that doesn't even play TradeWars, and I'm sure that friend wouldn't mind you loading TWProxy on his desktop, and now your DUPE has his own IP address. Hell, he even has a birth certificate and a social security number.

Guess I should just remove rule #1 from my serer, because there is no way in hell I can enforce it.

The honor system is still a somewhat reliable means of enforcement...

For tournaments, you could do phone validation and ask the person on the other end a few questions about the game. I doubt many people would learn all about some weird old game to help their friend cheat at it.

All they have to do is say they are a newb, along with a little coaching from their friend, they would pass the phone validation.

or, they could go buy a $45 go phone from Walmart and alter their voice slightly. They don't even need the friend.

I can't seem to find the quote, but I remember Warf saying something along the lines of "In war, there is nothing more honorable than winning". The beauty of Klingon honor, and Vulcan logic is that both can be used to make whatever point of view you need at that moment.

That quote is full of win, back on topic I think the most effective counter short of having none is single Ip validation(One Unique IP per connection). I don't buy the family playing excuses, I guess I don't know enough people who play I guess.

It can be countered with a billion different services but would still stand to help prevent the "I just lost a game, lemme dupe to piss people off cheats" and the "No-one will corp with me let me join just to harass people cheats".

I have two cable modems in my house, and I have a 3 friends that don't play Tradewars, but will let me install twproy and mombot on his computer. Now I have 5 IP addresses I can dupe with.
There are also hundreds of free proxy servers that players can use to get fake IP addresses, so the IP address is meaningless.

Sure but people are lazy, it's much easier to dupe from a single IP address then it is to pay for a secondary cable modem w/ service. Or call up friends at 2am in the morning/convince them to leave open VPN's for us.

Sure we could tor proxy through putty or otherwise but that's allot of work and by the time someone is done do they still want to dupe 10-50 characters into your level 5-6? Maybe but would single IP per connection help slow it down and finger out obvious cheats?

If you dupe from a single IP, the GameOp can see that in the logs.

At the risk of further derailing the thread, that's true or you could just block it and prevent it from happening in the first place. Which in the end was my point, not whether a sysop could retroactively see what happened.

Either way as this is scripts and helpers, I'll self flag to see if we can get this moved to open discussion or somewhere more appropriate.

JP's the one that derailed it

Anyway, if A helper supported SSH it wouldn't help prevent Dupes.


Really? Are we trying to make it imposiable for anyone to play the game?

Here's my idea.

Client Side Helper -> Server Side Helper -> TWGS

The helper would provide a secure connection, but the player wouldn't really need to know about it.

The helper could have it's own interface, and provide a proxy for other helpers, or just be a proxy.

If you want to write that client side helper, go right ahead. Just make sure it supports everything that Swath and TWX proxy already do.

It would provide proxy support so you can still use your other helpers.