Join us on our TWC Discord channel
25-05-2012, 05:16 PM
I'll try to explain.
The problem with GUIDs is that it's just a cvar that you can set to whatever you like (with some malicious energy). So there is in fact no way for us to be sure that the GUID a player connects with is actually owned by that player (that's what GUID spoofing is about).
So if someone gets to know your GUID, which isn't that hard to find out, because it comes up in the logs of all servers you have played on, that person can basically steal your identity on our servers. That includes your level and your XP.
Right now the servers have no way of verifying the identity of a player, they simply have to trust the GUID supplied by the player.
So the idea is now, to have a trusted third party (also called authority) that is able to verify the identity a player claims to have. There are several ways of achieving that.
One would be allowing members in forum to upload their etkey. The forum would calculate the GUID from that and store it in its database. When that player connects to a server, the game will send a request to the forum server, sending all the information it has about the connecting player. The forum would see that it has the GUID stored in its database and associated with a forum account, so it will continue checking the IP of that player against the IP stored in the database. If the IP doesn't match it will tell the server not to allow that player to use any !commands.
So for our members, nothing would change basically. All they had to do would be logging in to the forum once before connecting to a server.
That way we can securely verify the identity of a player and we are more or less safe from GUID spoofing (at least safer than now).
I hope this was easier to understand than my technical blabla before :P
-- Ligustah
The problem with GUIDs is that it's just a cvar that you can set to whatever you like (with some malicious energy). So there is in fact no way for us to be sure that the GUID a player connects with is actually owned by that player (that's what GUID spoofing is about).
So if someone gets to know your GUID, which isn't that hard to find out, because it comes up in the logs of all servers you have played on, that person can basically steal your identity on our servers. That includes your level and your XP.
Right now the servers have no way of verifying the identity of a player, they simply have to trust the GUID supplied by the player.
So the idea is now, to have a trusted third party (also called authority) that is able to verify the identity a player claims to have. There are several ways of achieving that.
One would be allowing members in forum to upload their etkey. The forum would calculate the GUID from that and store it in its database. When that player connects to a server, the game will send a request to the forum server, sending all the information it has about the connecting player. The forum would see that it has the GUID stored in its database and associated with a forum account, so it will continue checking the IP of that player against the IP stored in the database. If the IP doesn't match it will tell the server not to allow that player to use any !commands.
So for our members, nothing would change basically. All they had to do would be logging in to the forum once before connecting to a server.
That way we can securely verify the identity of a player and we are more or less safe from GUID spoofing (at least safer than now).
I hope this was easier to understand than my technical blabla before :P
-- Ligustah
I'm quite busy, so unless it's a quick thing or really urgent I am unlikely to be able to answer PMs throughout the week, but I try to reach out to everyone who contacted me during the weekends. If it's urgent, you can also contact any of the supremes, they can do a lot of things or relay directly to me if necessary.