@sheckley666 said in #8:
Timeseal cheating requires no more than a small app manipulating your device's clock. This app has been written decades ago.
Eh, no. You clearly don't get it. And you apparently weren't around and writing code back when timeseal was written and subsequently hacked. I was.
A separate app manipulating your system clock is not at all how it was done. That would be f'n difficult. You'd also need the chess client to communicate with that app telling it when to change your clock and by how much. And then your system clock would be all messed up for everything else that used it.
In the ICS/FICS days, timeseal was a separate program run on your PC (we didn't have smart phones then.) This was necessary because everyone used different third party clients to connect to chess servers. The exploit was a hack on the timeseal binary. Once it was hacked, cheaters only needed to install a hacked version rather than the real timeseal. There were at least a couple of those available. They all worked essentially the same way, by adding a randomized offset to the time in the timestamp calculation. Thus the encryption that timeseal used didn't matter because it was the altered values that were encrypted and sent to the server.
A timeseal like routine could simply be included in the lichess mobile app. For the iphone world, this would all but eliminate the danger of cheaters. Some determined devs might hack it for themselves, but distribution would be difficult. For the android world, distribution would be somewhat easier, but it would still take some dedication on the cheater's part. And there are other steps lichess could take to make it even more difficult.
As for the website, someone could potentially hack client side code with a browser extension... but lichess already disallows various browser extensions and their task would be no more difficult than it is to catch people using KB or one of the multiple premove extensions.
Whereas lag switchers can use an easy-to-write vpn connect/disconnect script and bind it to a keystroke... or, in a pinch, a loose ethernet cable will do the trick. Seriously.
Hope that helps you get it.
@sheckley666 said in #8:
> Timeseal cheating requires no more than a small app manipulating your device's clock. This app has been written decades ago.
Eh, no. You *clearly* don't get it. And you apparently weren't around and writing code back when timeseal was written and subsequently hacked. I was.
A separate app manipulating your system clock is not at all how it was done. That would be f'n difficult. You'd also need the chess client to communicate with that app telling it when to change your clock and by how much. And then your system clock would be all messed up for everything else that used it.
In the ICS/FICS days, timeseal was a separate program run on your PC (we didn't have smart phones then.) This was necessary because everyone used different third party clients to connect to chess servers. The exploit was a hack on the timeseal binary. Once it was hacked, cheaters only needed to install a hacked version rather than the real timeseal. There were at least a couple of those available. They all worked essentially the same way, by adding a randomized offset to the time in the timestamp calculation. Thus the encryption that timeseal used didn't matter because it was the altered values that were encrypted and sent to the server.
A timeseal like routine could simply be included in the lichess mobile app. For the iphone world, this would all but eliminate the danger of cheaters. Some determined devs might hack it for themselves, but distribution would be difficult. For the android world, distribution would be somewhat easier, but it would still take some dedication on the cheater's part. And there are other steps lichess could take to make it even more difficult.
As for the website, someone could potentially hack client side code with a browser extension... but lichess already disallows various browser extensions and their task would be no more difficult than it is to catch people using KB or one of the multiple premove extensions.
Whereas lag switchers can use an easy-to-write vpn connect/disconnect script and bind it to a keystroke... or, in a pinch, a loose ethernet cable will do the trick. Seriously.
Hope that helps you get it.