Submitted 3 weeks ago by Pro@programming.dev to technology@lemmy.world
https://andrewmoore.ca/blog/post/anticheat-secure-boot-tpm/
cross-posted from: programming.dev/post/35893414
Comments
- Hackernews.
Anti-cheat engines are now requiring users to have Secure Boot and a fTPM enabled in order to play online multiplayer games. Will this decrease the amount of cheating, or is it a futile attempt at curbing an ever-growing problem?
I’ve basically told my friends I wont play games that require secure boot and kernel anti cheat. I don’t use windows anymore, and I dont want to support these studios anyways.
Interesting article on how secure boot functions. Thanks!
Agreed, a good article and I learned a lot from it. One thing I learned is that while secure boot and tpm are neat, I’m more confident than ever that they are just overkill and unnecessary for an average user.
Whether intentional or not - they DO get in the way of using other OSs or bootable flash drives like ventoy. Either by by malicious intent, accidental non signing or delayed signing, or just general complexity of coordinating signing everything with all the manufacturers.
It’s just a lot of hoopla for…. What?
Anti cheating? There’s been cheaters in online gaming forever and that will never change. Give me the option to make friends and play private games with them and I don’t care who cheats.
Security? I mean I guess…. but “don’t boot shady crap and make sure you’re downloading the right stuff” goes pretty far.
I dunno - secure boot and tpm are the first things I turn off and I’m not interested in using software that insists I turn them on. The juice ain’t worth the squeeze.
It does seem a bit overkill especially for home desktop use. I think with laptops an argument could be made that there may be some benefit even for home users.
But for gaming anti-cheat specifically, it’s definitely overkill.
This just came up for me yesterday. League would not start without ftpm enabled.
None of this is actually about cheating. All of these companies want control over as many people as they can get their grubby fat fingers around.
Great article.
Probably a dumb question, but my mobo has an option in the setup utility to “enroll hash” and it seems to let me pick an .efi executable.
Can I just use that to sign any bootloader (or efi executable for that matter) I want, e.g. HackBGRT, GRUB2, and if so, would that allow me to play Battlefield 6, or would the other features like TPM attestated logs indicate the chain loading and flag me for a ban (or simply not let me launch the game) ?
No, Windows anti-cheats will check specifically for Microsoft’s keys in use.
Shame. Someone needs to steal these.
if that function is for signing custom efi binaries, you can still only sign it using your own keys. that would work to attest that you trust it and approved running that thing with secure boot enabled, but anticheats are looking specifically for the approval of microsoft, for which microsoft would need to sign it with their own key.
you probably wouldn’t get banned, the game just won’t launch. but be sure that you are not runnig the “process hacker” task manager along with the game, neither similar tools inname because formerly garbage anticheat was triggered to the “hacker” name in the process name. I don’t know if that would trigger a ban though, or they just wouldn’t allow connecting, but since this is niche software and they won’t have any recourse for false positives maybe I wouldn’t try my chances unless I wanted help in stopping playing that game forever.
I never got interested how anti cheat software works but article claims kernel level anti cheat relies on hardware fingerprint. They say people can buy new game and cheat again, I think it’s cheaper now for people to buy new hard drive and change fingerprint and don’t even bother with this shit. This is stupid.
Question. What is wrong with ip ban? Is it because a vpn can get around it? Isn’t a vpn slow to game on?
You can often change your IP by rebooting your router. So the only way an IP ban can really work is when you start banning blocks of IPs, but that can hit other people who have no reason to be banned.
VPNs also aren’t always slower, though they often are. They change the route your packets take, which could have fewer hops to get to their destination, or could have faster connections in some places compared to your standard route.
Also users behind large NAT gateways (colleges/dorms, apartment complexes with IOS contracts) or CGNAT (most mobile users including 5G hotspots which could be a primary internet connection for a household) will often appear to be behind one or a handful of IPs, and not only does blocking one block them all, but blocking a gateway IP that is part of a pool might not necessarily block the intended user at all. Also as was stated, it’s trivial to get a new IP either via VPN or, sometimes, resetting your modem.
IP bans are often not effective.
I figured it wasn’t feasible now. Darn. It sucks there’s no better option theyre offering other than kernel anti cheat which means gaming on linux will be dead again in 4 years
All those kernel level protections go out of the window, if the motherboard itself is compromised
JohnWorks@sh.itjust.works 3 weeks ago
Interesting so they’re using secure boot to hardware ban but I could see used hardware being an issue now :/
arararagi@ani.social 3 weeks ago
It’s a combination of hardware, not a single motherboard ban. Unless you buy a whole used PC, there’s no issue