Rule violations discussions

Quote from Dusk

They won't do anything about cheaters. The game has been this way for years. As long as the cheaters buy gold, TK doesn't care. I have seen enough forum posts by TK admins and they are not in the direction of fixing the game. The player base has to take a hard step and leave this game until it's fixed. I'm going to be leaving for sure. Been playing Travian for 10 years and it really is sad to see the state of the game.

The concerns you have on the forum are sent to HQ so they are aware of the opinions of the players, they do care about what you think and are looking for solutions for these issues.

Quote from Bellatora

The concerns you have on the forum are sent to HQ so they are aware of the opinions of the players, they do care about what you think and are looking for solutions for these issues.

After hearing "they do care" for long enough time with nothing happening the only reasonable conclusion is that they don't really care.

If you can think of solutions for friendly farming that think could work ill be more than happy to forward them to the game center, they are aware of this issue and are also looking for solutions

Quote from Bellatora

If you can think of solutions for friendly farming that think could work ill be more than happy to forward them to the game center, they are aware of this issue and are also looking for solutions

A two-authentication factor for logging in…

Reduce the amount of ress you can steal from fellow kingdom members and Allied/NAP kingdom members… (keep the option to collect treasures there in order for treasure distribution).

Plenty of solutions. To be honest, after all those years game center hasn’t been able to find a solution, maybe they should be fired and replaced for competent people who are actually able to do something about it?

Quote from Mycro#EN

A two-authentication factor for logging in…

Reduce the amount of ress you can steal from fellow kingdom members and Allied/NAP kingdom members… (keep the option to collect treasures there in order for treasure distribution).

Plenty of solutions. To be honest, after all those years game center hasn’t been able to find a solution, maybe they should be fired and replaced for competent people who are actually able to do something about it?

I think the two factor is interesting but the amount reduced from Nap/allied/kingdom, that can be circumvented by not having any ties to the account but just farming it.

Quote from Bellatora

I think the two factor is interesting but the amount reduced from Nap/allied/kingdom, that can be circumvented by not having any ties to the account but just farming it.

What about “no-rule” servers once/twice a year. Allow cheaters to go nuts, observe those servers and learn how they bend the rules and avoid the current system.

With knowledge comes power. Once TK has a better vieuw on the mechenics the cheaters/abusers use you can specifically target those issues and fix them.

Quote from Mycro#EN

What about “no-rule” servers once/twice a year. Allow cheaters to go nuts, observe those servers and learn how they bend the rules and avoid the current system.

With knowledge comes power. Once TK has a better vieuw on the mechenics the cheaters/abusers use you can specifically target those issues and fix them.

They would still find it difficult to find anyone to ban

Quote from Luke Coolhand

They would still find it difficult to find anyone to ban

Haha most likely 😂

There is only one real solution, and that is for the game owners to open a dialogue with the players, not through this sham of a forum, but between THE OWNERS and the players that really love this game, use the knowledge that some of these players have to point out the flaws and shortcomings of the current policing of the game. The fact that time and time again it comes down to us the players having to constantly report any blatant cheating of any sort, only to be met with the usual bleating that you "don't tell us" at the end of another server that suddenly had a waft of bans that meant nothing at all that altered the result. Just once there was a glimmer of light when WST and several other KIngdoms brought about a result that I thought the people that run this game would look at, admire, seize and build on, but poor management reaction has allowed the whole thing to deteriorate even more. That sadly we are more likely to lose real gamers with great knowledge to pass on to people that want to learn and grow to play honestly is the biggest crime here, the cheaters don't love this game, we do, they will move on bored and find some other game to ruin, leaving this a sad husk of what should've been.

To choose a gamers/players panel would be pretty easy, just look at who are talking here about improving the game experience,not just ridiculing people with silly mindless cries of sore losers. The real players here accept wins and losses that happen on a level playing field, that is what gaming is about, sharing the love of a game . The biggest (and really only) question is.....do the owners care/worry/give a shit!

Have you ever tried looking at how other browser games increase the difficulty of cheating?
While multis might be hard to fight, I took a quick look at open-source Travian kingdom bots on GitHub and detecting those should be child's play...

I recommend looking at how some other browser-games fight against cheaters.
Have you thought about the following client-side (to make cheating harder) and server-side (to detect cheating) changes:
- Encrypting data based on a dynamic key negotiated at the initial initialization of the game (hence requiring the need for packet bots to reverse and copy this procedure -> Higher entry-level requirements for cheat developers). Change your stuff up every now and then, you will know who runs cheats by who still tries to communicate the old way.
- Integrity checks on request. The server should request integrity checks from time to time, the client calculates a hash from the current game source code (js), as well as several dynamic (!) game objects that are frozen in the current state (village names, account id, kingdom id, etc.) and sends the hash to the server who verifies the correctness.
- Captchas on high activity. People won't mind solving a captcha once per day, but it will catch bots/cheats (or they will need to pay for a manual solver service + integrate the handling). Make it appear and required to be solved in the next 10-20 minutes or something (to not fuck with people sending ops/timed attacks/etc). This is by far the easiest way to kill 95% of the current bots.
- Hidden elements to verify stuff is clicked per mouse,
- Packet order verification (bots send attack packets without ever sending the packet to verify if one can send to that target...I reported that before). An extensive version of this would keep track of the actual game state locally (what windows are open, etc.) to verify, but a simple version could be fine and easy to implement.
- The login/session system is a big fuckup. Often when logged into the game, when you open the lobby in a different tab you get logged out from the game tab. This is due to it using different sessions to make the dual/sitter system work (at least I assume that is the reason). On an actual anti-cheat note; Wahlb*** and Shar*** bots (and most other packet bots I assume) just use cookies to resume previous sessions created in real browsers. If a machine never logged into the lobby, don't let them log into accounts.
- Etc. Etc.

Multis are hard to fight yes yes.
But at least make them play the multis manually, there is NO excuse to allow packet-only bots to work, there are so many ways to make that harder, up to impossible to maintain for the cheat devs.
There is no excuse not to actively target public bots, especially open-source ones. You can literally check what they are doing and then specifically target them.

Rant over

Quote from KryTon

Have you ever tried looking at how other browser games increase the difficulty of cheating?
While multis might be hard to fight, I took a quick look at open-source Travian kingdom bots on GitHub and detecting those should be child's play...

I recommend looking at how some other browser-games fight against cheaters.
Have you thought about the following client-side (to make cheating harder) and server-side (to detect cheating) changes:
- Encrypting data based on a dynamic key negotiated at the initial initialization of the game (hence requiring the need for packet bots to reverse and copy this procedure -> Higher entry-level requirements for cheat developers). Change your stuff up every now and then, you will know who runs cheats by who still tries to communicate the old way.
- Integrity checks on request. The server should request integrity checks from time to time, the client calculates a hash from the current game source code (js), as well as several dynamic (!) game objects that are frozen in the current state (village names, account id, kingdom id, etc.) and sends the hash to the server who verifies the correctness.
- Captchas on high activity. People won't mind solving a captcha once per day, but it will catch bots/cheats (or they will need to pay for a manual solver service + integrate the handling). Make it appear and required to be solved in the next 10-20 minutes or something (to not fuck with people sending ops/timed attacks/etc). This is by far the easiest way to kill 95% of the current bots.
- Hidden elements to verify stuff is clicked per mouse,
- Packet order verification (bots send attack packets without ever sending the packet to verify if one can send to that target...I reported that before). An extensive version of this would keep track of the actual game state locally (what windows are open, etc.) to verify, but a simple version could be fine and easy to implement.
- The login/session system is a big fuckup. Often when logged into the game, when you open the lobby in a different tab you get logged out from the game tab. This is due to it using different sessions to make the dual/sitter system work (at least I assume that is the reason). On an actual anti-cheat note; Wahlb*** and Shar*** bots (and most other packet bots I assume) just use cookies to resume previous sessions created in real browsers. If a machine never logged into the lobby, don't let them log into accounts.
- Etc. Etc.

Multis are hard to fight yes yes.
But at least make them play the multis manually, there is NO excuse to allow packet-only bots to work, there are so many ways to make that harder, up to impossible to maintain for the cheat devs.
There is no excuse not to actively target public bots, especially open-source ones. You can literally check what they are doing and then specifically target them.

Rant over

Display More

A very well constructed and educational rant from KryTon, lot of good advice that could/should be acted upon.

Quote from KryTon

Have you ever tried looking at how other browser games increase the difficulty of cheating?
While multis might be hard to fight, I took a quick look at open-source Travian kingdom bots on GitHub and detecting those should be child's play...

I recommend looking at how some other browser-games fight against cheaters.
Have you thought about the following client-side (to make cheating harder) and server-side (to detect cheating) changes:
- Encrypting data based on a dynamic key negotiated at the initial initialization of the game (hence requiring the need for packet bots to reverse and copy this procedure -> Higher entry-level requirements for cheat developers). Change your stuff up every now and then, you will know who runs cheats by who still tries to communicate the old way.
- Integrity checks on request. The server should request integrity checks from time to time, the client calculates a hash from the current game source code (js), as well as several dynamic (!) game objects that are frozen in the current state (village names, account id, kingdom id, etc.) and sends the hash to the server who verifies the correctness.
- Captchas on high activity. People won't mind solving a captcha once per day, but it will catch bots/cheats (or they will need to pay for a manual solver service + integrate the handling). Make it appear and required to be solved in the next 10-20 minutes or something (to not fuck with people sending ops/timed attacks/etc). This is by far the easiest way to kill 95% of the current bots.
- Hidden elements to verify stuff is clicked per mouse,
- Packet order verification (bots send attack packets without ever sending the packet to verify if one can send to that target...I reported that before). An extensive version of this would keep track of the actual game state locally (what windows are open, etc.) to verify, but a simple version could be fine and easy to implement.
- The login/session system is a big fuckup. Often when logged into the game, when you open the lobby in a different tab you get logged out from the game tab. This is due to it using different sessions to make the dual/sitter system work (at least I assume that is the reason). On an actual anti-cheat note; Wahlb*** and Shar*** bots (and most other packet bots I assume) just use cookies to resume previous sessions created in real browsers. If a machine never logged into the lobby, don't let them log into accounts.
- Etc. Etc.

Multis are hard to fight yes yes.
But at least make them play the multis manually, there is NO excuse to allow packet-only bots to work, there are so many ways to make that harder, up to impossible to maintain for the cheat devs.
There is no excuse not to actively target public bots, especially open-source ones. You can literally check what they are doing and then specifically target them.

Rant over

Display More

This is super interesting, thank you for the ideas!
bot detection is also a priority

Quote from th0mm

TKU/config.json at master · WahlbergRu/TKU · GitHub

If we look at it currently for example, we can see from the cookies that it is village=537247728.

From a quick self check, the village cookie saves the last selected village of the player.

If I open up the map and open the info of a random village I see:

https://eux3n.kingdoms.com/#/p…309/window:mapCellDetails

I can assume cellId is the village id of the village on the map, so I change it to:

https://eux3n.kingdoms.com/#/p…728/window:mapCellDetails

uGdcsRQ.png

And I get Дредноут's village at -16|11.

How convinient, a cheater just pushing his multi accounts login session to his public repository.

As I am not allowed to login due to me playing on the server, I asked one of my friends from work if he could figure out how to login with the cookies.

After a while he sent me this picture:

1PiB3bJ.png

This is all you right?

Display More

Hey!

That's my ticket!

Quote from Bellatora

This is super interesting, thank you for the ideas!
bot detection is also a priority

So nothing will be done? As per usual.

Quote from kicke

So nothing will be done? As per usual.

It will be added to low priority list that might or not happen in next 20 years

Quote from Bellatora

This is super interesting, thank you for the ideas!
bot detection is also a priority

Thank you for taking an interest in this.
Sadly I have already mentioned this several times in tickets, as well as in my long big ticket about the Wahlberg bot.

I doubt something will change.
I understand that this might not be related to you and I believe that you forward our feedback when you say so, but the PM is either incapable or not interested in pursuing this, or so it seems.