MULTIPLAYER QUESTION ( PARADOX READ )

[everburn]

Today we were playing HOI 3 multiplayer. You will tell what is the problem then?

The session was funny.. regardless we discovered during the week player saw each other country.

Usually in multiplayer session, there is a rule that you are not supposed to see the others country and just playing to serve the best your country and not your faction.

So regardless for the second you can't do anything, can we for the first one at least have some kind of protection?

So like a password ( not for the room.. but for the country) ( like i protect my country with a password?) so that people can't join and load my country during the week?? or any kind of similar protection?

P.s: If some italian read the post and want to play in a multiplayer group, feel free to contact me.

 

[Dakka]

Or do something like the total war system where if you join it automatically selects your own country for you

 

[just_legeek]

Or make a deal with your partner and trust him?

Btw, in EU IV there is something in multiplayer options like "allow save edit" maybe it is for allowing other member to load the save ?

 

[griffor]

i doubt it is possible, least on launch i think it comes down to more of the integrity of the group rather than anything else

 

[Paglia]

Today we were playing HOI 3 multiplayer. You will tell what is the problem then?

The session was funny.. regardless we discovered during the week player saw each other country.

Usually in multiplayer session, there is a rule that you are not supposed to see the others country and just playing to serve the best your country and not your faction.

So regardless for the second you can't do anything, can we for the first one at least have some kind of protection?

So like a password ( not for the room.. but for the country) ( like i protect my country with a password?) so that people can't join and load my country during the week?? or any kind of similar protection?

P.s: If some italian read the post and want to play in a multiplayer group, feel free to contact me.

You have a sad group !!!

 

[vector1]

As a polite note, remember that using all caps and demanding that Paradox read the thread is the equivalent of shouting with a loudhailer outside of the paradox offices; It's a good way to get ignored simply because of the delivery of an idea.

I believe it's been discussed before, but the general response is that by locking saves like this it makes editing it much harder than it has to be (almost regularly required in MP thanks to bugs/errors and rollbacks. Most people would simply find a better group instead. Furthermore, when you know the game well, there isn't any need to cheat in base HOI3 thanks to the overpowered radar/intel you receive that you can derive all the strategic and tactical information that you need. I know exactly how fast and well most countries can build up in HOI3 simply because of experience, and most times people won't go past that bar in a high speed MP since you need a lot of careful tweaking of build orders and staggering to keep saving that extra 1% of production time.

Misuse of this quote, but
"In an era when everything can be surveiled, all we have left is politeness." Diamond Age

 

[Anichent]

This thread should be closed just for its annoying title

 

[Atlantians]

This thread should be closed just for its annoying title

PARADOX SMASH!

 

[agentgb]

i agree with the OP, would be neat if paradox as sorted this, it was a major culprit of cheating in MP games, that took away the bluff element, even i'd admit and hold my hand up and say i have done it on occasions, out of downright paranoia that they were probably checking out my faction

 

[LordOfWar16]

Yeah, coop is possible, just like in HOI3 if you allow it when you set up your MP match. I am slightly hesitant to call it a full feature though as there isnt really any support for restricting access in these cases except for house rules (the General COULD have also started helping out with other fronts). Its something I'd love to develop more features around in future expansions though if multiplay of the type becomes popular.

 

[vector1]

I did it all the time to
1) edit units/territory when we had bugs/mistakes (you would be amazed how a misnamed fleet could have cause a irregular savegame crash, and how much work it took to find that)
2) writing AARs in MP. I'd accumulate like 1-2 years worth of monthly saves, or even daily/weekly and then refer back to it for AAR material.

 

[Alex_brunius]

This is at least valid for HoI3:

Due to the game being so moddable all information in the savegame is available in clear text format which can be read from notepad or any text editor...

Any password must also be saved in that savegame, if it is going to be possible for anyone else then the host to host the game.



So the only thing that a password entered in the game would change is that it would require a small bit of extra time/effort for someone else to go into the text savegame, and search and find your password and use that. Or search and find all information they want anyway in clear text. Everything the game uses is available in text in that savegame, your divisions, your constructions, your research. Everything.

 

[General Samson]

Any password must also be saved in that savegame, if it is going to be possible for anyone else then the host to host the game.

This is how only amateurs would implement it. If you save passwords, you save not the password but the hash of a password. To check if someone knows the password, the program is hashing the password and compares it with the saved hash. Due to the characteristics of a hash, this system is very save and used also in operating systems like Linux.

 

[vector1]

That is interesting, but I have this feeling that implementing complex cryto isn't on the top 10 list for the HOI4 devs now, even if they did have someone who knows how to put this together. I wouldn't mind having this option implemented but on the whole I'd play without it.

 

[Alex_brunius]

This is how only amateurs would implement it. If you save passwords, you save not the password but the hash of a password. To check if someone knows the password, the program is hashing the password and compares it with the saved hash. Due to the characteristics of a hash, this system is very save and used also in operating systems like Linux.

It will never be "very save" to store a password when the program you must have installed on your computer ( HoI ) have the key to unlock it, even if you make it encrypted or hashed.

The encryption/hash must be consistent to work on any client and any savegame combination in isolation, so as soon as 1 guy somewhere figures out how to crack it anyone can download a reader that cracks the password based on the savegame.

The only option that offers REAL security is to lock nations to your steam accounts + only allow mp through steam and verify through steam. But it has the added issue that if someone wants to quit the MP game you can never replace them with someone else.

 

[General Samson]

Sorry but you seem to have no clue about computer security. You don't have to implement such stuff by yourself. There are libraries out there which do this efficient and reliable for you. MD5 or SHA-family for example do this nicely. And again, its save because you save the HASH not the Password itself. Hashs are one-directional functions and don't work like a basic mathematical function like addition or multiplication. You can only revers it with a brut force attack (trying all solutions) This is not efficient and no system is save from a brut force attack.

 

[Alex_brunius]

Sorry but you seem to have no clue about computer security. You don't have to implement such stuff by yourself. There are libraries out there which do this efficient and reliable for you. MD5 or SHA-family for example do this nicely. And again, its save because you save the HASH not the Password itself. Hashs are one-directional functions and don't work like a basic mathematical function like addition or multiplication. You can only revers it with a brut force attack (trying all solutions) This is not efficient and no system is save from a brut force attack.

The game is the key that can unlock the password, it must be able to do so because otherwise the function of the password stops working.

So you have the key ( the game ) and with that you can read all passwords no matter if you used a super computer to encrypt them with and no matter what library you use to HASH...

It seems that it's you that "have no clue about computer security"...

 

[General Samson]

dude, the game, your program, can NOT read the password because it is not stored!!! Its only the hash which is stored!
Example: you choose the password "ILikeHOI4" this will be computed to --> "033ce61d0c004e4522b8428a53a6965c" (MD5) and will saved in this way! "ILikeHOI4" is saved nowhere. You friends can now find "033ce61d0c004e4522b8428a53a6965c" in the savegame of course, but this is useless to them because the can not convert it back! Got it?
btw: I nearly finished my PhD in computer science. So yes, I have some clue.

 

[Alex_brunius]

dude, the game, your program, can NOT read the password because it is not stored!!! Its only the hash which is stored!
Example: you choose the password "ILikeHOI4" this will be computed to --> "033ce61d0c004e4522b8428a53a6965c" (MD5) and will saved in this way! "ILikeHOI4" is saved nowhere. You friends can now find "033ce61d0c004e4522b8428a53a6965c" in the savegame of course, but this is useless to them because the can not convert it back! Got it?

And how do you think the game CHECK if the password you enter matches the HASH?

It needs to be able to take the 033ce61d0c004e4522b8428a53a6965c and covert it back to "ILikeHOI4" to check if what the player entered to authenticate, and compare them.

The game has to have the ability to convert the hash back to password, the GAME IS THE KEY.

So if you have the game, you have everything you need to convert any hash back to the correct password.



But:
Even without that you can literally read anything you want about your enemy in the savegame anyways, all information is there in clear text. So the password is failing it's purpose anyways because the information is accessible without the password or without cracking it.

 

[mursolini]

And how do you think the game CHECK if the password you enter matches the HASH?

It needs to be able to take the 033ce61d0c004e4522b8428a53a6965c and covert it back to "ILikeHOI4" to check if what the player entered to authenticate, and compare them.

The game has to have the ability to convert the hash back to password, the GAME IS THE KEY.

So if you have the game, you have everything you need to convert any hash back to the correct password.



But:
Even without that you can literally read anything you want about your enemy in the savegame anyways, all information is there in clear text. So the password is failing it's purpose anyways because the information is accessible without the password or without cracking it.

No, the game takes the password you inserted, and makes a hash out of it, and compares the resulting hashes. There is no "key", it is not needed, nothing gets converted back. That is why algorithm is efficient. You may know the resulting hash, but it is very hard to get the sequence from which the hash was computed, which is necessary for break, but is in no way needed for verification.

You are, of course correct on a broader point, that if the software is in your hands and on your computer, it is possible to crack it, granted, it is far easier to just bypass the security block altogether.