Dealing with duping (multies)

[zenanthor]

How do you manage problems with duping on your games.

On v2 of my game, I had a very strict automated filter for not allowing dupe accounts.
But some games ive seen accepting even 2 accounts from same IP. (falling for the old my brother is playing).


But then again, games that dont seem to be so strict on duping, has tons of players online.

And do you check for proxy?

[davidjwest]

I assume you mean multis?

Personally, I'm not doing anything about this with my game at the moment, but I will if players complain that multies are ruining the game.

I'll probably follow the suggestion someone else had on these forums and let the players police the game with me looking for evidence of cheating and if confirmed deleting the players account.

[zenanthor]

hmm multies, might not be a problem on all types of games. You do have the possebility to compare the IP's so you get an idea of how many are duplicates?

[davidjwest]

IPs aren't conclusive, people can have dynamic IPs, they can be shared between people living in the same area, or on a network etc and they can be spoofed.

Someone on here posted they had a system of "flags" that got raised when something suspicious happened, so you could use that system for IPs, not conclusive enough to ban someone, but enough to make you suspicous perhaps if they had other suspicious activities.

[zenanthor]

Yes, ip is not conclusive. Like school etc

But due to high level of abuse, i made it so if the IP is already in the datbase you cannot make a new account. So at a scool, if someone has used the computer, sorry noone else can use that computer to play.

[die4me]

you can't stop people from multis try as much as you want if they want to do it they are going to do it unless you charge for accounts people will always do it

[codestryke]

you can't stop people from multis try as much as you want if they want to do it they are going to do it unless you charge for accounts people will always do it

Sorry but, not even charging stops multi's. I added just such a system and people were still registering and paying for multi's. The most was 75 accounts between two people all paid for.

My partner and I both play games, we run games and never had a multi or "share" each others accounts. So doing just an IP check would stop one of us from playing. For those that want to get there game out there and enjoyable that would be a deterrent and you would of just lost two people that love to play games and talk to others who play game (something to think about).

Having the player's tell you or alert you is also a method for disaster, trust me you'll be the last to know

We have a really good way of monitoring for multi's, I'de say we're about 95% accurate on detection but it still does take some human intervention, thinking you can automate the process is a fools errand. And no it's our trade secret on our method ~ Took me 6 years to develop so it's NOT FREE.

[die4me]

But if they are paying i wouldn't mind at all lol unless it is causing you to lose other members

[ranting]

But if they are paying i wouldn't mind at all lol unless it is causing you to lose other members

But the thing is that having people cheat, whether it's by having multies or in any other way, it will cause other members to quit. If they don't, or atleast not complain about it, then the game isn't competative enough

As said, IP alone isn't enough. If you stop multiple accounts from the same IP you also risk stop many legit players. I would log all logins and their IPs used, and then combine that with other logs to flag suspicious behaviour between the accounts. It can also be combined with cookies, to log if someone is using the same browser with more than one account (which may or may not be ok, depending on your rules). Restrict the game rules by stating that certain actions aren't allowed between players who share IP/computer/household/whatever, and pick the areas which are very sensible to cheating for example any player-to-player market. On top of that there will of course be a need of manual work, I totaly agree with die4me that trying to automate it will not work.

[Brandon]

But if they are paying i wouldn't mind at all lol unless it is causing you to lose other members

But the thing is that having people cheat, whether it's by having multies or in any other way, it will cause other members to quit. If they don't, or atleast not complain about it, then the game isn't competative enough

As said, IP alone isn't enough. If you stop multiple accounts from the same IP you also risk stop many legit players. I would log all logins and their IPs used, and then combine that with other logs to flag suspicious behaviour between the accounts. It can also be combined with cookies, to log if someone is using the same browser with more than one account (which may or may not be ok, depending on your rules). Restrict the game rules by stating that certain actions aren't allowed between players who share IP/computer/household/whatever, and pick the areas which are very sensible to cheating for example any player-to-player market. On top of that there will of course be a need of manual work, I totaly agree with die4me that trying to automate it will not work.

I have to second this.

In addition to it, if account duping is going to cripple your game, you may need to find ways to design around this.  Find a way that having multiple accounts is not actually going to help the player.  And I'll be the first to respond to my suggestion:  EASIER SAID THAN DONE. 

[raestlyn]

But if they are paying i wouldn't mind at all lol unless it is causing you to lose other members

But the thing is that having people cheat, whether it's by having multies or in any other way, it will cause other members to quit. If they don't, or atleast not complain about it, then the game isn't competative enough

As said, IP alone isn't enough. If you stop multiple accounts from the same IP you also risk stop many legit players. I would log all logins and their IPs used, and then combine that with other logs to flag suspicious behaviour between the accounts. It can also be combined with cookies, to log if someone is using the same browser with more than one account (which may or may not be ok, depending on your rules). Restrict the game rules by stating that certain actions aren't allowed between players who share IP/computer/household/whatever, and pick the areas which are very sensible to cheating for example any player-to-player market. On top of that there will of course be a need of manual work, I totaly agree with die4me that trying to automate it will not work.

I have to second this.

In addition to it, if account duping is going to cripple your game, you may need to find ways to design around this.  Find a way that having multiple accounts is not actually going to help the player.  And I'll be the first to respond to my suggestion:  EASIER SAID THAN DONE. 

My favourite game at the moment has done that perfectly.

[die4me]

One way is not to have trading or giving away gold items etc. Then there would be no benefit from having multiple accounts. But then again interacting with other members is what makes lots of games fun.

[mdshare]

just checking on IP is bad, check on multiple sources

IP, cookie, browser session , ...

Now banning players is always bad, what I had was a new NPC

NPC The Bailiff

If player x and y aren't flagged for allowed interaction following could happen.

* case 1: player x sends ingame cash to player y , bailiff confiscates the ingame cash
* case 2: player x attacks player y for exp gain, bailiff interupts the fight and no xp gain is given
* case 3: player x sends item(s) to player y, bailiff confiscates the goods

Now this was actually funny, as we looked at more than just IP, a certain player claimed by high and low that he hadn't multi accounts that it was his wife that played also. Ok no problem but how on earth do you switch seats in a second. (same browser session, cookie check)

Anyway, I had never anything against multi accounts, my experience from working with some game companies was that premium players that create a multi (mule/alt) account also donate/buy a premium account for the new account.

Now there was no interaction allowed between the 2-3-... accounts without using the ingame tools for it, which costs ingame cash, premium points, whatever ....

Banning multi account players is a bad method imo, I once banned a whole country for supposed multi play... Myanmar former burma had only 1 public IP a year or 5 ago. And I banned also once around 5000 players cuz I was to dumb .... they where all in the AOL DNS pool.

[jannesiera]

just checking on IP is bad, check on multiple sources

IP, cookie, browser session , ...

Now banning players is always bad, what I had was a new NPC

NPC The Bailiff

If player x and y aren't flagged for allowed interaction following could happen.

* case 1: player x sends ingame cash to player y , bailiff confiscates the ingame cash
* case 2: player x attacks player y for exp gain, bailiff interupts the fight and no xp gain is given
* case 3: player x sends item(s) to player y, bailiff confiscates the goods

Now this was actually funny, as we looked at more than just IP, a certain player claimed by high and low that he hadn't multi accounts that it was his wife that played also. Ok no problem but how on earth do you switch seats in a second. (same browser session, cookie check)

Anyway, I had never anything against multi accounts, my experience from working with some game companies was that premium players that create a multi (mule/alt) account also donate/buy a premium account for the new account.

Now there was no interaction allowed between the 2-3-... accounts without using the ingame tools for it, which costs ingame cash, premium points, whatever ....

Banning multi account players is a bad method imo, I once banned a whole country for supposed multi play... Myanmar former burma had only 1 public IP a year or 5 ago. And I banned also once around 5000 players cuz I was to dumb .... they where all in the AOL DNS pool.

Holly crap, banned a whole country? Now that's what I call a nice soty!
Can someone compose a complete list of what you should check? There should be an article or tutorial be written on this subject.

[mdshare]

well 5y ago , myanmar had only 1 public IP and while multi hunting stumbled on aprox 300 players using that IP :s and they all had interaction ccording the logs. ok, IP check was the only available tool next to player transaction logs, so there wasn't any other method of checking.

So I banned the country myanmar .... wasn't so bad as end result was that there where around 200 real multi accounts.

The aol dns pool, I guess everyone made that mistake once, banning players while they live multiple states away from eachother. Again it resulted in a 1/3 honest players and a ton of multi accounts.

Some of the players I banned even have it as a sport, joining games and see how long they can go undetected with xx multi accounts.

@jannesiera

just start with cookie placement, this would give you already more than just IP

* player gets a cookie on it's pc stored
* register page checks if a player cookie is placed, if yes flag new account as possible multi

simple and effective method

[jannesiera]

When I was typing an answer, I accidentally erased it . Thanks for that information, mdshare. But my game might have much harm from multies, so I will have to gather as much information as I can, so I will have to consider other ways of checking to. The rest of my reply will follow later this evening .

[jannesiera]

I explained it a little weird here, but whatever :

The reason why I want a list of techniques to gather information regarding multies:
I don't have the knowlege myself (the cookie thing for example, I don't have any experience with)

The reason why such a list should exist:
for other people such a list could also be a great resource, I have the intentiong to transform this into some sort

of tutorial

What should there be in this list? :
Ways to gather information about accounts, with the purpose to recognize multies. How this information will be

handled will vary for each game.

The list until now:
*place cookie and check when registering Disadvantage: people can remove cookies from computer
*IP tracking Disadvantage: people can share computer, change IP, ...
*check for matching passwords (people who use the same password, are suspicious) Disadvantage: it might be imposible

to recover password from the db

[AcidicOne]

Do not forget e-mails, users from the same house may have the same IP, but there is no reason they should have the same e-mail address.Making it so that separate e-mails are required for each account, does not offer full protection, it does only leave creating multiple e-mails or using multiple address left as a option for those wishing to use multiple accounts. Again is by far a full measure to insure dupes, but it does help contribute to lessening it automatically.

[Scion]

just one point event if recovering passwords is not possible you can still check the hashed password values to see if theyre the same...(unless using individual salts)

Rather than looking at it as a problem of finding multiple accounts used by one player perhapes modify the definition too finding groups of accounts that are colaborating in a way that is unduely benificial to one account. Using this definition we can allow players to hold multiple accounts (which might make sense if its pay to play), but we also are including friend bassed farming schemes.

you sould still do the basic ip, email, cookie, checks but it also directly implies that in order to do it properly you will need to build something that understands the goals of the game and that can evaluate the interactions between players...thus detection will be customised to each specific game..

however there are many game mechanics that are common to many games, trading for instance, so your detection system could watch trades and when it identifies a trade that is extremly biased ( for instance selling an item well bellow/above market value )  then it can be flaged as indicating biased collaboration.

Wehn it comes time to run your multi-check you can award points bassed on the various activities and sum up the points to find those accounts that have the highest likelyhood of being involved in biased colaboration.

Of course just because two accounts are involved in a biased collaboration does not mean that they are multi's but its indicative, and what your looking to do is to find a way to identify patterns of behaviour....unfortunately computers are inherantly bad at pattern evaluation, where-as people are good at it, so what were looking to develope is not a fully automated solution, but one that presents information so that a person can evaluate if they are....

One final thought... I rearly see any name and shame strategies used, I wonder if the occurence of multi's could be reduced if those multi's that have been identified are publicly named and shamed....have a section in the games forum where player bans are reported.....

[ranting]

One pattern I've noticed, is that many players who have several multies tend to log into the accounts in the same sequence. I.e. always start with loging in with account1, then account2 and so on.

Yes, name and shame do work. Have a publicly viewed list with all the names that's being punished. You could also use it as incentive to make the cheaters help you, to allow them to be hidden from the public list if they spill their guts.
Altho it can be a good idea to keep a new name hidden at first, in case you've made a mistake you wouldn't want to point him out publicly as a cheater.

Something that I plan to do in the future is a variation of this. People also tend to like history and statistics, so you can have a player's history on display. Date when the account was created, if he accomplished something special and so on. But also if he was caught cheating. The thought would be that old players, who otherwise might be tempted to cheat, will refrain themselves from cheating if they know that not only will it be publicly know that they cheated it will also show in their history forever.

[jannesiera]

Something that I plan to do in the future is a variation of this. People also tend to like history and statistics, so you can have a player's history on display. Date when the account was created, if he accomplished something special and so on. But also if he was caught cheating. The thought would be that old players, who otherwise might be tempted to cheat, will refrain themselves from cheating if they know that not only will it be publicly know that they cheated it will also show in their history forever.

I know a game which uses this. Normal players have the "citizen" status, officers the "officer" status, etc. and cheaters have a "cheater" status. Also with this status they are restricted in some of the game's options (like voting for new mayor, doing politics, etc.)

I eddited the list, but I don't have the feeling it's complete yet :

The list until now:
*place cookie and check when registering Disadvantage: people can remove cookies from computer
*IP tracking Disadvantage: people can share computer, change IP, ...
*check for matching passwords (people who use the same password, are suspicious) Disadvantage: it might be imposible to recover password from the db
*check for matching usernames (people who use almost the same username, are suspicious ; e.g. Jack and Jack2) Disadvantage: some people just use simillar usernames, this isn't that rare
*check for matching e-mail accounts Disatvantage: People can create multiple e-mail accounts

Other ideas for treating multies:
*have a section in the games forum where player bans are reported / cheater status ("name and shame")

[ranting]

There's other info you can log aswell, browser for example. And it should also be possible to gather some information about the player's computer by javascript I think, for example screen resolution. You could gather as much such information you can and log together with the login information. It won't show if someone is a cheater, but might add together with other suspicious information.

[cdoyle]

This is a topic I've been very concerned about with my game.
I've seen so many games just ruined by multi's.

The only things I have right now is the IP log, and I also log transactions between players.  Since my user base is still small,  and I can see if something doesn't look right.  Like player 1 always sending player 2 cash. 

I've seen cookies mentioned, but players can delete their cookies.  So not sure if that will work.
emails confirmation,  so many free emails out there not sure if that helps at all either.

What else can be done to help fight this. 

[codestryke]

I've seen cookies mentioned, but players can delete their cookies.  So not sure if that will work.

Yes but you would also know if they deleted there cookies as well

Save cookie when account is created, check for cookie on log-in, no cookie, flag account.....

Also you would be amazed at how many people DON'T delete there cookies.

It's not 100% but it's a better step to just tracking IP's

[JGadrow]

Many people do not delete their cookies. I'm one of the few I know who actually clears ALL personal information every time the browser is closed.