You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello Dota devs,
Since last ban wave and issues with overwolf and their aggresive approach to return to business, I just had a random taught how to make exploits in dota harder to execute.
My basic understanding is that client and server are exchanging the dynamic data about everything that is happening in the game apart from graphical environment. So, this should be a data stream between client and server.
From what I have seen in the screenshots all these cheating engines are standalone apps most probably doing some kind MiTM.
What if you guys implement something like HSTS (certificate pinning) between client and server and encrypt the stream this way? Client should be able to detect if there is MiTM based on private key hosted on Valve side and if it is detected it should just disallow queueing .
I am not a developer (I am in cybersec) so probably I am wrong regarding the Dota client /server communication (though I am aware it is not HTTP/S).
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
-
Hello Dota devs,
Since last ban wave and issues with overwolf and their aggresive approach to return to business, I just had a random taught how to make exploits in dota harder to execute.
My basic understanding is that client and server are exchanging the dynamic data about everything that is happening in the game apart from graphical environment. So, this should be a data stream between client and server.
From what I have seen in the screenshots all these cheating engines are standalone apps most probably doing some kind MiTM.
What if you guys implement something like HSTS (certificate pinning) between client and server and encrypt the stream this way? Client should be able to detect if there is MiTM based on private key hosted on Valve side and if it is detected it should just disallow queueing .
I am not a developer (I am in cybersec) so probably I am wrong regarding the Dota client /server communication (though I am aware it is not HTTP/S).
Beta Was this translation helpful? Give feedback.
All reactions