   Duplicated Accounts on Web/Online Games
  Hello,I administer an online game and we have problems with players creating multiple accounts to gain advantage over their enemies. I wrote a detailed post about this.Basically, does anyone know of a good way to prevent this? Using IP or cookies isn't reliable, and having players cheating with multiple accounts ruins the game community.Here's a couple of metrics that we considered:*  Use IP -This is not an option, because several legitimate players will often share IPs. Just consider them to be behind an ISP with NAT* Cookies - Not very reliable; players can circumvent them easily* Passwords - We noticed that on Orion’s Belt, players with duplicated accounts used different mails, personal info, etc, but used the same password. This is also not reliable, but we found it to be a good metric* Time tables - Players with duplicated accounts usually use them in a short time frame. If we have two accounts always accessed one after another, after short periods of time, maybe it’s a cheaterAll these metrics aren't reliable.Does anyone know of another approach to this problem?Thank you.   
  If the game requires a credit card for sign up that's one of the most foolproof options but more realistically I think you have to look at eliminating the benefits of having second accounts in your games design.   ;  We've tried. :)There are no trading between players for example. But only having multiple accounts, means a larger army, means an advantage.And removing features from the game just to disable cheating, turns the game less interesting. That's why we're after other approaches.   ;  I am also interested in this, and have also thought of the very say methods as listed. The timetabling was interesting idea for me, maybe search for "logout" times, relative to login times, save them.. and map them when over 10 records of same match, set warning/ban.Big issue ive come across is multiple people using the computer, eg 2 brothers, because the usual check ip/cookie brings this up.To help against people who create multiple accounts with emails, ive blocked all known temp inboxes. but i guess even if they use a temp mail i dont know about, maybe have some kinda of random "call back" email, say after a few weeks/months, which has a code or link to reactive an account (the call back will disable the account until the code is inputted). But then comes the flaws with this, people will change email and not change the info for their account (but u could have timely reminders, kinda like cPannel does)The game i have, is about what you know (location of armies and size etc), so i cant disable much to allow for multiple users.Wonder if any one else has any more creative or alternative ways of doing this.. feel free to criticize my methods (please do, so i can see more flaws in it, and hopefully patch them up)   ;  No, there's no way.IP-limitation will severely interfere with anyone using NAT router. Two players within same network have same IP.Credit card limitation doesn't do anything for people that have access to multiple cards. Using names to check is bad again - who says that people with same last name and same address are not separate entities.Cookies only work locally. Since it's web game, people likely use multiple computers.About passwords - how do you know they are identical. You aren't storing them as plaintext, are you? You are following all the security precautions, and are storing only salted hash, right? So that if someone gains access to the database, they can't hack every single account.Quote:Does anyone know of another approach to this problem?Change the design of the game so that multiple accounts do not have a negative impact on the game.There is a way, such as some countries use, namely SSN or some other personal ID. But I don't believe this would work well, or even be legal, in many other countries.One such way would be to require a digital personal certificate. I can obtain one from government, for example, the problem is it available to 18+ only. I'm not sure which countries offer that. That is identical to the certificates banks use, and it's as close as you can get to unique identification.This problem became mainstream during UO time. Many companies have poured many resources into it. End result - Blizzard now offers transfers between servers and accounts. UO offers mediated account resales. Almost all other subscription based companies offer one way of transferring characters and accounts.There is no reliable solution that doesn't risk banning legit players. So rather than worrying about the symptom, try to work out a way to solve the problem - can you adjust the game in such a way to make this a non-issue?Quote:The game i have, is about what you know (location of armies and size etc), so i cant disable much to allow for multiple usersAgain, back in the days of MUDs, giving out hints, FAQs or walkthroughs was considered the worst of crimes, and would lead to banning. Needless to say, this was futile.Today, games have not only embraced the sharing of knowledge, but even provide walkthroughs.   ;  The login-logout mapping seems at least a bit promising since brothers or more than 1 people using one pc are not always logging in and out within a splitsecond what multi-accounters usually do. Also with IP your algorithm will get a lot of false alarms by those student dormatory gamers that all basically use one small IP band so that's impracticable since those students make up a rather large part of online game players. One advantage that you could harness is that multi-account-players are mostly the impatient ones. Also I think you need to crosscheck if those suspicious players are in the same ally or generally help each other fighting the same enemy/enemies the manual way (as admin). Looking for intersections in the database concerning common allies and foes and judging each case on its own (since brothers/relatives/friends/etc. tend to help each other too) is the only thing you can do.   ;Quote:Original post by AntheusAbout passwords - how do you know they are identical. You aren't storing them as plaintext, are you? You are following all the security precautions, and are storing only salted hash, right? So that if someone gains access to the database, they can't hack every single account.Nah, the application that I was referring to is old and stores hashed passwords. Indeed adding the salt will render this metric useless, but that's no problem, because this metric was basically empirical.Quote:Original post by AntheusThis problem became mainstream during UO time. Many companies have poured many resources into it. End result - Blizzard now offers transfers between servers and accounts. UO offers mediated account resales. Almost all other subscription based companies offer one way of transferring characters and accounts.I've played WoW, and in that context you don't have exactly the same problem. Because you can create several charaters, but that won't provide you with a major advantage against other players.In conquest based games, if one player controls one character, and another controls 10, the other will be 10 times stronger.Quote:Original post by AntheusThere is no reliable solution that doesn't risk banning legit players. So rather than worrying about the symptom, try to work out a way to solve the problem - can you adjust the game in such a way to make this a non-issue?Well, I find that perspective very interesting. :)We'll have to consider it. Instead of enforcing no multiples accounts, provide support for them at additional cost or restrictions.   ;  The question is why they should pay for it since controls seem not to be working so is support needed at all, especially when they come with restrictions? They could also see the whole thing as a trap.   ;Quote:Credit card limitation doesn't do anything for people that have access to multiple cards.The only thing that "works" is to charge actual money for the accounts. Even so, you may have people paying for multiple accounts. At that point, there's not much you can do (other than support only one-on-one battles).Consider an RTS like Warcraft III: I could sign up for multiple accounts, and play a map as part of multiple teams to gain an advantage.Consider WoW: I could sign up for multiple accounts, and be on both sides of a PvP battle at the same time.;  Wouldn't that kill off a rather small customer base? I mean people leaving there due to having to pay for an account hurt a small base more than a large one since a larger one doesn't likely appear empty as quick as a smaller one.   