NoMoreAlts - Advanced Anti-Alt Module, DELETED

[NotBugle (PinguLovesYou)]

Like mentioned RBLX-FingerPrint is the only thing I could trust without kicking out random legit players.

Yes it might do more good than harm but its still kicking or could kick a random legit player.

[sponguswastaken (spongus)]

Well, depends on how you use the module, not my fault if you configure it incorreclty

[Real]

I honestly want more information about this anti-cheat you’re working on.

Do you have a server for it?

[sponguswastaken (spongus)]

No, i dont think im ever gonna make a server for any of my projects

[Kiesere]

This entire module seems like it would be highly susceptible to false positives.

It’s making assumptions on data that has no relation to determining an alt from a regular user. Instead it’s relying on a combination of things that although has an unlikely chance, is still inaccurate.

Sure the likelihood of two players having the exact same CPU start time is low, but there is still a chance. Which means this would be limiting your games potential player base for no reason.

If someone is determined to use alternate accounts they will find a way.

Your best bet is to design your game so that it isn’t as vulnerable to alternate account usage. Or at least is more effort then it’s worth.

[sponguswastaken (spongus)]

@Kiesere

Sure the likelihood of two players having the exact same CPU start time is low, but there is still a chance. Which means this would be limiting your games potential player base for no reason.

That’s kind of like saying there’s a chance you’ll teleport to china via quantum tunneling, but you’re right there is a small chance that two people in the same region will start up their pc at the same time and play the same game

@Kiesere

This entire module seems like it would be highly susceptible to false positives.

Do you have any better ideas rather than completely changing your game so that its not vulnerable to alt account usage? almost every game i know add excessive accountage checks, which is not better at all

@Kiesere

If someone is determined to use alternate accounts they will find a way.

People are usually lazy, and with the predetermined configuration i made that’d still take a long time

I just dont understand why people on the devforum always act like this unless the script was made by a big team of 50 people, if this was a huge waste of time like you said, ill just delete the post

[Kiesere]

@sponguswastaken

Do you have any better ideas rather than completely changing your game so that its not vulnerable to alt account usage?

I don’t think it’s possible.
Nothing stops me from just loading up alts on my phone, tablet, laptop, desktop. Heck I could even spin up some VMs if I wanted.

I knew some off Roblox games that would limit connections based on IP addresses. However even that was flawed because it could be changed.

It would be interesting if Roblox provided developers with some sort of IP addresses representation or something. But even that would not be enough to eliminate it. Not to mention the privacy concerns it would entail with things like cross-game tracking.

@sponguswastaken

if this was a huge waste of time like you said, ill just delete the post

Hey I never claimed this was a “waste of time”, and I apologize if I lead you to think that. Actually I am impressed that you’re trying to solve such a fundamental problem with online games.

I actually wish we had more topics discussing important game development challenges such as these. I am definitely interested in hearing others thoughts on this though.

[VortexColor]

@sponguswastaken

• Hwid - Uses RbxFingerprint’s method to track players across accounts, this will always return a hash to store in a DataStore, but if it returns nil, the player possibly exploited to try disable this check. Trying to set this value to a new one will edit the StoredHwid value, while keeping this one intact / CLIENT CALL REQUIRED
• StoredHwid - Basically the Hwid value but from a DataStore

@sponguswastaken

• StoredHwids - Returns a dictionary containing all stored HWID’s, the index will usually be the player’s user id and the value will be the stored HWID

This would require a privacy policy otherwise it’s againts privacy laws. Storing the ID is never a good idea. Even worse is connecting the stored ID to an account.

One should only store the calculated ID if a player gets banned so “HWID” bans can be done.

---

Also you should give an automatic bypass to accounts which have premium or which have voicechat. Also accounts that are older than 5 years should be given a full bypass.

---

But otherwise a good idea, albeit it might have some false positives.

[MatkoRBX (Matko)]

I’m sorry but this idea is not worth investing your time into. Although it’s really great that you can show off that you’re a talented programmer, I don’t believe this was the right thing to create.

Systems like these cannot detect and kick genuine alternate accounts with high precision or accuracy simply because there are so many ways to get around them. There is no way to determine whether a user is legitimate or not.

For example, we have things like VPN’s, multiple devices, and even something as simple as a rotating IP address which is very common.

[sponguswastaken (spongus)]

That’s a great idea, thanks
and also the HWID’s are hashed with sha512, and there’s also an alt generator that generates alts from 2010

[sponguswastaken (spongus)]

The module is supposed to be used to check how experienced the user should be on roblox depending on their AccountAge, if they have an account age of 7 for example i’d say they’d need to have atleast 10 friends and 5 badges

Otherwise, if the account age is of 365, they’d need to atleast have 2 friends and 200 badges

[sponguswastaken (spongus)]

@Kiesere

I don’t think it’s possible.
Nothing stops me from just loading up alts on my phone, tablet, laptop, desktop. Heck I could even spin up some VMs if I wanted.

Yeah well its not so simple as creating a new alt on a vm

@sponguswastaken

The module is supposed to be used to check how experienced the user should be on roblox depending on their AccountAge, if they have an account age of 7 for example i’d say they’d need to have atleast 10 friends and 5 badges

Otherwise, if the account age is of 365, they’d need to atleast have 2 friends and 200 badges

[benpinpop (Ben)]

Okay so I’m going to quote my old post, but from the ToS, this is AGAINST TOS.

A way to track players across accounts

Since roblox support is not giving me a straight answer, I’ve decided to research the ToS. Here’s the ToS rundown. (not legal, i’m not a lawyer, if this illegal, then sucks for you) Roblox ToS states the following: With respect to an Experience created by a Creator, Creator and Roblox both have the right to use data related to or obtained in connection with that Experience for their respective legitimate internal business purposes to support the Experience and for business analytics, such as…

@benpinpop

Roblox ToS states the following:

With respect to an Experience created by a Creator, Creator and Roblox both have the right to use data related to or obtained in connection with that Experience for their respective legitimate internal business purposes to support the Experience and for business analytics, such as: (i) for the improvement and development of the Experience; (ii) to comply with applicable laws (including law enforcement requests); (iii) to ensure the security of the Experience; and, (iv) to prevent fraud or mitigate risk. Creator agrees that, except as expressly set forth in these Creator Terms, Creator will not use or disclose any User data.

Citation: https://en.help.roblox.com/hc/en-us/articles/115004647846#creator-terms Part 10.A

Roblox TOS states that you can use data for “internal buisness purposes to support Experience and for buisness analytics”. If I’m interpreting it correctly, it only states the reasons “(i) for the improvement and development of the Experience; (ii) to comply with applicable laws (including law enforcement requests); (iii) to ensure the security of the Experience; and, (iv) to prevent fraud or mitigate risk” after buisness analytics, meaning you can also use that information for those reasons. From this, it looks like this behavior would be allowed. Yet, it states, “Creator agrees that, except as expressly set forth in these Creator Terms, Creator will not use or disclose any User data .” So, if it can be understood, you can use this under the “A (III), to ensure the security of the experience.”

Not done yet, listen up: Main issue is below.

With respect to the personal information of Users (“User PII”) (if and to the extent received by Creator), Creator will not (i) use User PII to provide services to any third party; (ii) use User PII to build, help build, track or supplement any segments, profiles, or similar records on any individual User, device, or browser across the Roblox platform or across any third party websites or platforms; (iii) use User PII to associate the behavior of any individual device, or browser with any segment, profile, or similar record, or supplement any such record based on data of Users; (iv) use User PII to associate any data of Users with any other personal information of the User; (v) sell, disclose, share, rent, lease, syndicate, modify, reverse engineer, decompile, lend, or otherwise alter any User PII; (vi) use User PII for any unauthorized purpose in violation of any applicable law, including applicable privacy laws, or for any unauthorized purpose.

Citation: https://en.help.roblox.com/hc/en-us/articles/115004647846#creator-terms Part 10.B

Roblox defines User PII as: “The personally identifiable information of Users.” (You can find this by hovering over the green underlined term in the ToS). Considering the fact that it is saved as a fingerprint, which is identifiable to the computer, (specifically an SHA1 hash), this can be considered personally identifiable. This is assuming that when it states “Users” in the User PII definition, this refers to their account. (Hence you can use that information to identify their account). Now we know that this is considered User PII, we can see if it violates any of the specific use cases. B.(II) states: “[Creator will not] use User PII to build, help build, track or supplement any segments, profiles, or similar records on any individual User, device, or browser across the Roblox platform or across any third party websites or platforms;” From my personal interpretation, this use of data could be considered tracking accounts, as this is whole thing is about tracking accounts and alt accounts.

So hence, because of Use Case (II), I don’t think this would be allowed.

Summary:
While you could use data to protect your experience, collecting personally identifiable information to track users is against the TOS.

Use this at your own risk.

[2jammers]

Your requirements are extremely dumb by the way. Just because someone’s account is a year old doesn’t mean they will have 200 badges. What if they are 1 year old and only have like 50 badges? You have to keep in mind that users aren’t active all of the time.

[MightyDantheman (Fate)]

Keynote | RDC 2022

[jackjenningsdev]

this would block far more legitimate users than alts

[weakroblox35]

This is good against alt gens of which their accounts have 0 badges/0 friends/0 favs and random names with 5 digit numbers.

[sponguswastaken (spongus)]

Kind of depends, if your game is played by underaged people that create new accounts just to play your game only, then yes they might be detected as alts