MULTIPLAYER QUESTION ( PARADOX READ )

[Alex_brunius]

You are, of course correct on a broader point, that if the software is in your hands and on your computer, it is possible to crack it, granted, it is far easier to just bypass the security block altogether.

My point is a general one, without adding any online verification ( for example through steam user ), it is can never be called "safe" or "secure".

Any hash or password encryption Paradox could put in would be possible to crack or bypass in 1min by anyone with a bit deeper knowledge and the crack could be shared to anyone that wants it. All the information needed is and must be in the game, and all the password HASH must be stored in the savegame which is also available.

If you call it password in clear text or HASH is only semantics, the principle is the same and you don't need to crack any encryption to bypass it when you have the key ( the game ) and the passwords in the savegame.

 

[General Samson]

Ok if you don't want to listen, its your problem. Mursolini explained it again to you! The program Hash your entered password and compares it with the hased saved one!!!
How do you think online verification works? You can bypass any online verification much more easier by just sniffing the network traffic and build a small program which just replays what you have sniffed. Please do not talk like you know what you are saying if your knowledge is not well founded.

The online verification is, especially coupled with steam, indeed a very bad idea because IF steam would die someday (which it will hopefully not) you wound be able to use this feature anymore. I always loved PDX for not pressing this always online policy or some similar policies.

 

[Alex_brunius]

How do you think online verification works? You can bypass any online verification much more easier by just sniffing the network traffic and build a small program which just replays what you have sniffed. Please do not talk like you know what you are saying if your knowledge is not well founded.

Oh so it's easier to bypass an online verification then it is to bypass an offline one?

That's why offline verifications (like CD-keys) died out 5-10 years ago and EVERYONE now is using online verification today in all games?

It is perfectly clear you are the expert here...



And you still didn't address the issue that all information is available in the savegame in cleartext, so you don't even need to start the game to learn how many tank divisions your enemy have, all you need is notepad.

 

[JerkyJerry]

I've been following this conversation like a ping-pong match!
Who is correct? Alex_brunius or General Samson? I have no clue and knowing this forum as well as I do I would think that they are both at least a little bit correct if that is possible? Hopefully someone from Paradox can settle the score.
So are you a Brunius or a Samson?
Are you going with the kid (Samson) who is just hours away from graduating with a degree in computer science? Or, are you going with (Brunius) the cagy veteran who has experience on his side? Which side will you choose?

 

[potski]

I'm going with Samson. Sorry, Alex but you couldn't use the program as the key, without reverse engineering it. And they would be using some standard encryption library. And if that was easy to crack then there's no point in anyone having encryption to access their banking, or anything else they do online. That includes Steam itself - you can opt to have the program autosubmit your password, but it's not in any readable format on your PC. You can password protect Word documents, but believe me you cannot just open the file in Notepad and get anything out of it which would allow you to know that password, nor read any of the contents. Only a brute force attack would work, and a strong password of at least 9-10 characters would take days. And, no, Microsoft would never help you, even if it contains the number of your Swiss bank account with $millions. I work in IT support, and I've done it for people who have forgotten the password. Fortunately most people don't set strong passwords

 

[Alex_brunius]

And if that was easy to crack then there's no point in anyone having encryption to access their banking, or anything else they do online. That includes Steam itself - you can opt to have the program autosubmit your password, but it's not in any readable format on your PC.

If the hash your comparing with is stored online on their servers like with banking or with steam, then of-course it can't be cracked easily ( since you have no way of knowing what the HASH is ).

That's the main difference here, a HASH stored offline on your disk ( or in a save-game on your disk ), can be cracked as easily as a CD-key can be cracked with a keygen, and is not secure. Especially when you also have easy access to the software making the HASH offline ( the game ), and can make as many of them as you want from any password you want to type in and find the patterns.

You can password protect Word documents,but believe me you cannot just open the file in Notepad and get anything out of it which would allow you to know that password

I'm talking about HoI savegames here though! ( for example HoI2 or HoI3 ).
In these documents everything is readable in plain text in Notepad...

Give me a HoI3 savegame and I will tell you how many tank divisions Soviet have in that savegame without even having HoI3 installed on my computer!

 

[vector1]

Alex, computing cryto is something that isn't so easily reversed engineered, and it's specifically designed to be not easily "cracked" as you said. If properly implemented I'm sure reverse engineering the entire save game is improbable to say to least. Clearly if save-loading is to be protected, the entire save needs to be encrypted together with any passwords so clear text saves not something that they would miss if implementing the suggestion. HOI3 has no such feature so of course it's readable in clear text.

Online verification can be just as easily cracked with the proper tools, but any system is as strong as it's weakest link. Having a key-logger physically attached to your keyboard isn't going to save you with any amount of cryto, but it's also unlikely to happen to most people. Online verification is just a side effect of digital delivery of software now, not necessarily a more secure method. And of course no amount of security can protect a system from foolish users, who fall for phishing scams and the sort. On the whole, most people don't need to worry about being spied on secretly when we consent to vast amounts of data collection anyway just by using the relevant websites.

 

[General Samson]

That the information of which division is where is stored unencrypted in previous games (and I bet also in HOI4) is a total different topic. The topic was, if saving a password as hash is save or not. I don't have to repeat myself over and over again. So the only way to encrypt such a system is, to check every possible string by converting it to a hash and compare it with the stored hash. You can crack every security algorithm by brute force, but the question is how long it will take. And if the system is build correctly, it will not be possible in a short time as long as the password is long enough.

Please try to think about this, before writing again. I will not explain it again. Thank you.

Otherwise please tell me how you crack the hash (except with brute force)? No mathematics can do it, so I am curious about how YOU do it. Write a paper about it and let the world know. A job at the CIA is saved for you as well.

 

[Alex_brunius]

Alex, computing cryto is something that isn't so easily reversed engineered, and it's specifically designed to be not easily "cracked" as you said.

Otherwise please tell me how you crack the hash (except with brute force)? No mathematics can do it

I am curious how you think the cracking community was and is able to create CD-key generators within minutes of new games being released despite as you write: "No mathematics can do it"?

Do they practice magic or maybe I am right in that the software used to authenticate ( the game ) IS THE KEY that you can use to unlock ANY encrypted information with? ( including encrypted passwords or encrypted lists/generators of valid CD-keys stored offline on your own disk ).

but any system is as strong as it's weakest link.

In this case the weakest link is the authentication software ( the game ), and the fact that all information is stored offline where you ( or any cracking tool ) can read them.

Clearly if save-loading is to be protected, the entire save needs to be encrypted together with any passwords so clear text saves not something that they would miss if implementing the suggestion. HOI3 has no such feature so of course it's readable in clear text.

That was my point I wanted to arrive at, because encrypting the entire savegame also bring alot of other issues, like making debugging or modifications to it to "fix" some issues with the saves or your game impossible. Modding the savegame is done regularly in my HoI3 multiplayer groups I participated in when all agree something was wrong, when a mistake was made or when the game just produced some buggy undesired results.

With the lack of an editor being able to edit an open savegame is worth alot to the multiplayer community.

It's also required to be able to read and mod the savegames if you have alot of houserules and want to be able to enforce punishments if people don't follow them. Otherwise your only option is throwing them out of the game ( which with encrypted savegames and passwords mean abandoning your month long game you have been playing since they refuse to share their password and the game is ruined ).

 

[General Samson]

Regarding the CD-KEY validation topic. Its possible because its a completely different mechanic in contrast to password validation.
You can read some interesting stuff about key generation at this reddit https://www.reddit.com/r/askscience...oes_a_keygen_generator_actually_come_up_with/
CD-Key basically just have to follow a specific pattern which is checked by the game. This is something completely different.

 

[lrbaumard]

1. I saw the incident you are refferring to OP from your MP thread, and the reason he could see all your production queue and country details was intel, no cheating required. Put more spies into counteresp.
2. EU4 had a decent system to stop country spying via locking ledger and save game.

If someone is determined enough to cheat that way though, there's nothing you can do to stop it. - e.g. load locked save with someone else in MP = full info.
You can either expect that no one does it and trust people. Or accept that everyone does it.
I myself would never load the save until I learnt our enemy was doing it constantly.

 

[Alex_brunius]

Regarding the CD-KEY validation topic. Its possible because its a completely different mechanic in contrast to password validation.
You can read some interesting stuff about key generation at this reddit https://www.reddit.com/r/askscience...oes_a_keygen_generator_actually_come_up_with/
CD-Key basically just have to follow a specific pattern which is checked by the game. This is something completely different.

Interesting read,

Looks exactly the same to me ( when it comes to cracked EXE of games though, not Key-gens, I guess I was mixing these up ):

They make a cracked game EXE of the game by figuring out where the validation happens, and in that cracked EXE the validation part is simply removed/bypassed.

It would be just as easy to make a cracked EXE allowing you to load any MP game without the password.


I admit I am not technical or cryptology expert in these matters but I know the basics ( from having been gaming for 20 years ) and they seem to have been proven yet again:
- Any online validation where the game has to be connected to servers to work can't be cracked easily.
- Any offline validation game can be cracked easily.

 

[potski]

Only because online security also generally means having access to a valid username and password, and some (good) systems verify that with a third piece of information. Such as the pseudo-random pin code generators most banks now require you to use. Steam I think tells straightaway that a login came from a different PC, even if it's on the same home network, and then requires additional validation through an email sent to the account holder.

The whole security process has come on enormously from the type of security that was being used even a few years ago. Even for gaming, where hacking someone's Warcraft account could cause them more stress and concern than taking their wallet

Having a security system work totally offline allows hackers to pull it apart at their leisure. Online systems should block your account if someone tries with the wrong password more than a couple of times, so brute force attempts are almost impossible.

Unless HOI4 MP got really serious - with competitions, leagues, published achievements, etc. Then I can't see the devs putting in greater security, so this is interesting, but slightly academic.

 

[vector1]

I am curious how you think the cracking community was and is able to create CD-key generators within minutes of new games being released despite as you write: "No mathematics can do it"?

Do they practice magic or maybe I am right in that the software used to authenticate ( the game ) IS THE KEY that you can use to unlock ANY encrypted information with? ( including encrypted passwords or encrypted lists/generators of valid CD-keys stored offline on your own disk ).

In this case the weakest link is the authentication software ( the game ), and the fact that all information is stored offline where you ( or any cracking tool ) can read them.

You have to understand that not all forms of cryto are similar. CD keys that have an easily reversed engineered algorithm stored in an offline exe is quite different from publicly available programs based on PGP like GNU Privacy Guard.

The CD key just unlocks the game, so by removing the "lock", or the part that authenticates the CD key from the exe you have access to the game.

On the other hand, encrypted saves are considerably more complex and harder to reverse engineer without the private key if implemented right. You should not make a mistake distinguishing between the engine (the program), the puzzle (encrypted save) and the key (your private key). Even removing the part from the game that authenticates the save would mean that it's unable to actually decrypt it, leaving you unable to open the save still while still being able to play the game.

This is similar to how emails are secured via public encryption programs, and a public key/private key system.

Programs tend not to be protected like that simply because it needs to actually run, and running stuff that's encrypted should have a lot more lag, and a separate translation layer in between to encrypt/decrypt information passing through. Once you load the entire program into memory it's basically unencrypted anyway, and some attacks can proceed like that.

 

[General Samson]

You have to understand that not all forms of cryto are similar. CD keys that have an easily reversed engineered algorithm stored in an offline exe is quite different from publicly available programs based on PGP like GNU Privacy Guard.

The CD key just unlocks the game, so by removing the "lock", or the part that authenticates the CD key from the exe you have access to the game.

On the other hand, encrypted saves are considerably more complex and harder to reverse engineer without the private key if implemented right. You should not make a mistake distinguishing between the engine (the program), the puzzle (encrypted save) and the key (your private key). Even removing the part from the game that authenticates the save would mean that it's unable to actually decrypt it, leaving you unable to open the save still while still being able to play the game.

This is similar to how emails are secured via public encryption programs, and a public key/private key system.

Programs tend not to be protected like that simply because it needs to actually run, and running stuff that's encrypted should have a lot more lag, and a separate translation layer in between to encrypt/decrypt information passing through. Once you load the entire program into memory it's basically unencrypted anyway, and some attacks can proceed like that.

Right.

There is a difference between authentication and encryption. But Alex is right if the save game is not not encrypted. If you can change the program to skip the authentication process, then of course you can read the save file if its not encrypted.

 

[everburn]

Ok but just discourage other people.

I mean this is why houses have locks. Just to discourage anybody to go in. And only thief can go in.

This why you put alarm. Because you need way more specialized thief for stole something.

And i think should be done the same for Hoi. So you want really to see a country? Ok you need to find the ascii and so go on.

Maybe i would have also gone wrong on capslock But i love to shout outside of the other people office.

Anyway i will play a lot multiplayer and for me was just be a nice feature that could have been added.

 

[Guraan]

We have talked about it, but as you guys just said; we cannot make anything "safe and secure" for this as it is right now, and since we do not want to encourage ppl to use their passwords for something that is not safe (yeah most ppl do reuse their passwords), we will delay this feature some more (it is under great consideration thou)

 

[General Samson]

We have talked about it, but as you guys just said; we cannot make anything "safe and secure" for this as it is right now, and since we do not want to encourage ppl to use their passwords for something that is not safe (yeah most ppl do reuse their passwords), we will delay this feature some more (it is under great consideration thou)

What do you mean by "not safe"? If you save the hash, tell me how you can revers engineer it? You guys just have to implement it correct ;-) And i am sure that you guys are able to do so.

 

[Lys91]

OMG. A Hash is a one way function, it is security 101. Even if you know the hash function being applied, you will still need to hash every possible password and compare it to the hash (which is basically the result you want). I find it really annoying when people act all arrogant and rude when they have zero clue...

Wikipedia article:
https://en.wikipedia.org/wiki/Cryptographic_hash_function

Edit: which has nothing to do with all the game data being in plain text in the save file in the first place though, but did not iron mad mode encrypt the data?

 

[General Samson]

OMG. A Hash is a one way function, it is security 101. Even if you know the hash function being applied, you will still need to hash every possible password and compare it to the hash (which is basically the result you want). I find it really annoying when people act all arrogant and rude when they have zero clue...

Wikipedia article:
https://en.wikipedia.org/wiki/Cryptographic_hash_function

Edit: which has nothing to do with all the game data being in plain text in the save file in the first place though, but did not iron mad mode encrypt the data?

+1