Script Activation Keys

Feature Requests Studio Features
, ,
#1

As a Roblox developer, it is currently impossible to make scripts be verified before they run. I’ll expand upon this below:

Exploiters like to inject scripts, and this is a very big problem. So my solution would be to have a master script that creates a key that scripts must have in order to run (like a property.) All scripts would share this key, and if the script doesn’t have the key in their properties then the script can’t run. This would keep developers from needing to rescript their games for Filtering Enabled.

example: AcceptedKeys = {“39BcDefg29f0”, “3hfeuyr3yri394rhruihf”}

If a script doesn’t have a proper activation key, then the game would block it from running.

the key could be randomly generated per server, or preset by the creator. I think this would be a better alternative to Filtering Enabled.

The script could change every so often, so p = game.Workspace.Script.VerificationKey
p = “3234b23h4h”
wait(10)
p = “3h4iu2hkj3b4”

This would make it practically impossible for an exploiter to inject a script.

8 Likes
#2

Exploiters are unable to inject scripts – they are only able to run code locally. Because of this, there’s no need to verify on the server, and verifying on the client would be a waste because they can tamper with their client. Unfortunately, there’s no easy way the engineers can prevent clients from executing arbitrary code – even AAA titles like CoD fall victim to this.

You should just use FilteringEnabled – there’s no excuse not to. It’s how games should be made.

15 Likes
#3

Yeah but sending the key to the server might be an issue, because the exploiter would be able to see client-side what key it’s sending to the server, and an auto-renewing key wouldn’t help very much either, as the exploiter can possibly just make a program that auto updates its key so that it can continually use its malicious scripts.

1 Like
#4

All true, but for filtering disabled games it would be a step in the right direction - plus that’s another line of code for the hacker.

#5

Non-FE games are being phased out. “Experimental mode” (non-FE) is not meant to be used for production-level games. Please implement your game properly – no security measures will be developed for non-FE games.

5 Likes
#6

Even with FE turned on, something like this could be quite useful. If anything, it’s another layer of security. It may not stop determined exploiters from cheating, but it will stop the majority of most exploits.

#7

Exploits usually run in ScriptContext or CoreGUI which developers are off limits to. Also, as long as you have proper sanity checks and client server verification, you don’t need to worry about exploiters running code.

1 Like
#8

This is not how Filtering Enabled, scripts, or exploits work.

Please read these wiki articles here:

3 Likes
#9

Roblox actually does stuff like this already, you just don’t see it because it’s all behind the scenes.

just :clap: use :clap: filtering :clap: enabled :clap: pls

4 Likes
#10

Yeah, he wants a public facing setting thing I’m pretty sure (why tho)

This thread is wrong in many ways, so I think that this thread should be locked (because it’s clear that, not only does something similar happen internally, but this thread is extremely misinforming)

2 Likes
#11

Yeah go ahead and lock it, I think I have my answer. A public facing thing is what I was going for but I guess there would be no point if Roblox already is doing it.

#12

@Lilly_S please lock

#13