Valorant's anti-cheat system requires TPM 2.0 and secure boot on Windows 11

https://www.techspot.com/news/91138-valorant-anti-cheat-system-requires-tpm-20-secure.html

by josephcsible • 5 years ago

44 54 5 years ago

To clarify a point that was brought up elsewhere, Windows 11 itself only requires that your hardware supports Secure Boot, but Valorant's anti-cheat will require that it be enabled.

combatdisinfo• 5 years ago

I'm calling what comes next -- Eventually when Win11 has enough penetration, there will be some sort of "Boot into Xbox mode" for a cheater-free PC-gaming experience.

If it doesn't come with Win11+TPM, it will come from this: https://www.microsoft.com/security/blog/2020/11/17/meet-the-...

LeoPanthera2• 5 years ago

This is almost already a thing, and if this does happen, it will surely be an extension of "Game mode":

https://support.xbox.com/en-US/help/games-apps/game-setup-an...

dane-pgp2• 5 years ago

And once 90% of computers support this, governments will make "measured boot" a requirement in order for a computer to go online at all, enforced by ISPs.

Perhaps, for backwards compatibility, "insecure" computers that don't implement this will be allowed online, but they will have to either be registered or have something like the "evil bit" set on all their packets so that sites (like banks) can refuse connection to them.

r3muxd• 5 years ago

You can see how well that's working with SafetyNet right now. Rooted phones can't even use Snapchat.

h2odragon2• 5 years ago

If they're this torqued over control over the client end hardware, why have any pretense the client owns it? Make a leased terminal / Xbox console (without the "open") part of the requirement already.

Or to put it another way, "past the elbow, you have to give us a kiss first"

B-Con• 5 years ago

Could you explain the expression at the end?

h2odragon2• 5 years ago

Perhaps "There is a threshold of intimacy beyond which more will be owed."

eric__cartman2• 5 years ago

I'm not playing any online games that require what is especially a rootkit to be installed on my system. This isn't the first time that anti-cheat software made by Riot has taken stuff too far. Anyone remember when they introduced an anti-cheat measure that would run on ring 0? Why does a video game need so much control over my computer?

I can understand these measures being taken in game consoles, but most people use their PCs for a lot of stuff, and most likely store sensitive information that they wouldn't want to risk being exposed to some potencial malicious entity.

dageshi• 5 years ago

The moment you install any software on your PC you've essentially become exposed to the same risks. For the people who play the game, avoiding cheaters is a big deal. As you say, you have the right not to install or play the game, they're very clear about what they're doing.

vkou2• 5 years ago

You won't install a closed source rootkit, but you will install a closed source self-updating binary blob?

That's a weird hill to die on, but it is, of course, your choice.

josephcsible5• 5 years ago

The more privileged code is, the more important it is that it's FOSS.

reitzensteinm• 5 years ago

A video game made in good faith will not screw with your machine when it's not running.

This is absolutely not remotely true with a root kit which could mess with all sorts of things, especially if you have multiple installed. And it won't be clear what is causing it.

It's not a weird view at all, it's perfectly pragmatic.

eric__cartman2• 5 years ago

Actually I avoid non-free software as much as possible nowadays. My main use for a Windows partition is for occasional gaming and using that odd piece of software that doesn't have a good replacement that runs under Linux.

I understand that propietary things like the graphics drivers are inevitable to install on Windows, but what Riot does with their Vanguard anti-cheat system is crossing a line. If you look up the documentation on how to disable it, this piece of software loads every time your computer boots, and to enable it again the computer has to be restarted, so the kernel module can be loaded again. Most games will load any anti-cheat mechanisms when opening the game and run it only while playing. After you exit out of the game, every single process related to it is killed. This is different from having Vanguard constantly running in the background, with maximum privileges regardless of what you're doing.

marcodiego• 5 years ago

I'm not playing any online games that require what is especially a rootkit to be installed on my system.

Isn't all anti-cheat systems exactly that? Is there a way to differentiate any proprieatary driver to what you describe?

josephcsible5• 5 years ago

The point of invasive client-side anti-cheat is to surveil the user and report back to the game developer. Most proprietary drivers don't do that.

ASalazarMX• 5 years ago

Why does a video game need so much control over my computer?

The most benign explanation would be the misguided attempt by their system architects to solve the cheat problem by abusing client resources because it was easier.

The malign explanations border on conspiracy theories, but benign or malign, I too refuse to allow it. Cheating is a scourge of multiplayer games, but this isn't an acceptable solution.

chuckee2• 5 years ago

It starts with something palatable like anti-cheat systems.

But I look forward to video players using the TPM preventing screenshots or recording, and after that, websites preventing screenshots or copying text, and your bank verifying your browser before letting you log in.

Of course only a handful of large browsers will be supported or able to get licenses for the accompanying DRM code, but you can still use your 'free' browsers for less important things. Don't worry.

marcosdumay• 5 years ago

Windows has been forbidding screenshots for a long while now. If I remember it correctly, Windows 7 already did that.

short12• 5 years ago

Is that actually windows or just their crappy media player?

notJim2• 5 years ago

I take screenshots in Windows all the time. Maybe your keyboard is broken? ;)

vikingerik• 5 years ago

This isn't really intentional. It happens because all 3d or MPEG rendering is hardware-accelerated these days; the pixels are written or decoded on the GPU and never exist in the framebuffer that Windows knows about. To take a screenshot of that, you need a media player or screenshot tool that knows how to dip into the hardware-accelerated rendering. The basic snipping tool can't do it. Steam generally can although it's not perfect.

kfprt4• 5 years ago

The was one webpage where I wanted to highlight->right click-> google a persons name but it wouldn't let me make a selection. Which was stupid because all of the text was unobfuscated plaintext HTML. What is even the point of such moronic systems that only serve to annoy the user.

timw4mail• 5 years ago

That can be accidental, too. If you format text as `display:block` in CSS it is not selectable.

notJim2• 5 years ago

I look forward to video players using the TPM preventing screenshots or recording

Haven't browsers supported DRM for some time now? Anti-cheat like this has also been around for a long time, with the apocalypse you posit having failed to come to pass. This reads like a slippery slope fallacy to me.

chuckee2• 5 years ago

And Netflix degrades video quality on untrusted platforms, and there is a host of apps that refuse to run on unlocked phones. Wide availability of TPM could be just what is needed to spread this to PCs - which are the exception among computing platforms in being open.

We're sliding down the slope right now. The fallacy is thinking the trend will stop, because.. well, surely this is the last step, right? Just like all the ones before it.

heavyset_go• 5 years ago

Of course only a handful of large browsers will be supported or able to get licenses for the accompanying DRM code, but you can still use your 'free' browsers for less important things. Don't worry.

You already can't login to, or use, Google accounts with unapproved browsers.

munk-a4• 5 years ago

I think the Battlefields and CoDs of the world have proven that anti-cheat software doesn't mean crap if you don't support vote kicking or actually fund a reasonable CS team that can respond to active cases.

Cheaters will find a way - but not around ban-hammers... and if their cheating is so subtle that most people can't notice then it's a much less important issue to deal with (outside of professional league stuff - there sure, force people to do all sorts of crap to their computers if there is a cash prize on the line).

vkou2• 5 years ago

The battlefields and the CoDs of the world have proven the completely opposite point.

Valorant does not have a cheating problem. The Battlefields and the CoDs of the world do. The difference between them is not that Valorant has a vote kick feature (it doesn't.)

The difference between them is that Valorant anti-cheat is far more capable, because it is far more invasive.

ssully• 5 years ago

Looks like you were getting down voted a bit for this a bit, but it's unfortunately true. I am not a fan of Valorants anti-cheat system, but so far it has been effective. It's extra unfortunate because it's effectiveness is inspiring other games[1] to implement similar systems.

[1] https://www.callofduty.com/blog/2021/10/ricochet-anti-cheat-...

guiomie• 5 years ago

'Cheaters will find a way - but not around ban-hammers.'

Depends on the incentives of the game and game price. Escape From Tarkov has a big cheating problem because people will pay for in game items, the devs will ban them, they will simply buy another copy of the game because they still make a profit even buying the game a few times a year.

I'm unsure how Valorant bans are useful, they must ban based on hardware 'signature' ?

munk-a4• 5 years ago

I've mentioned this before but I would again advocate for a subscription based FPS with a seriously low subscription price - then ban people by CC number. Sure, some people can infinitely cycle CC numbers - but most people can't.

The farmers will continue to find work-arounds if farming is profitable, but honestly, wtf is farming doing in an FPS - that's a bad design decision. Just let people play the game and enjoy stand alone sessions.

rcfox• 5 years ago

Seems a bit sensational to complain about the TPM 2.0 requirement for a game on Windows 11 when it is in fact a requirement to run Windows 11.

stefan_• 5 years ago

I don't get it, what exactly is being verified by secure boot & TPM 2.0 that helps anti-cheat? That doesn't restrict the user from screwing with the game in userland, and doesn't restrict from loading signed kernel drivers. Sounds like the same.

dane-pgp2• 5 years ago

I don't know if the anti-cheat does this, but the architecture I imagine is that the game comes with its own kernel driver which detects/prevents tampering with the game in userland, and the secure boot process attests to the presence of kernel driver on the running system.

kfprt4• 5 years ago

So if you want to cheat just use Win10? What's the point, are they going to separate the matchmaking in the future?

josephcsible5• 5 years ago

Eventually they'll drop support for Windows 10.

kfprt4• 5 years ago

Because everyone is going to rush out and buy a new PC? 15% of people still run Win7. https://gs.statcounter.com/os-version-market-share/windows/d... https://www.statista.com/statistics/993868/worldwide-windows...

thanhhaimai• 5 years ago

This is why I'm bullish on tech like Stadia. It's simply not possible to have conventional cheats on it.

If you haven't, give it a try (free): https://stadia.google.com/games/destiny-2

donkarma• 5 years ago

that is your only reason?

josephcsible5• 5 years ago

Stadia goes even further towards making sure you don't actually own any of "your" games, though.

KingMachiavelli• 5 years ago

NVDIA has a similar service that let's you run your own Steam games but for some reason you can only run games Nvidia has their own licensing agreements with. I.e the problem is that you apparently don't own the game 'enough' to install it on a cloud virtual machine. I suspect that Google ran into the same problem and the game publishers would only agree if it meant they could sell the game yet again.

LeoPanthera2• 5 years ago

Is cheating a real problem on consoles? I know virtually nothing about the topic but I just assumed that consoles were so incredibly locked down it would be infeasible, and that cheating was a mostly PC problem.

bob1029• 5 years ago

This is my position as well. Maybe not stadia specifically, but something on that axis.

The edge is going to eventually get so close that no one is going to care. As a person who enjoys competitive gaming, I would be more than happy to surrender local simulation for a guarantee that no one has access to more information than I do.

The path Riot has taken is never going to work. The most devastating user experiences are going to hide in the shadows of "world's best antihacks". The best hackers will continue to be undetectable because they use other external computers and low-level hardware magic that doesnt give a shit about TPM or other measures. All someone really needs to do is break whatever encryption exists on the network stack to gain access to 100% of the available information regarding other participants.

The only solution is restricting the theoretical information at the source. Nothing else could ever be trusted by any participant.

cletus• 5 years ago

Stadia will only ever be a niche and honestly should not have been launched. You can point out the fatal flaw with two words: "input lag".

No one who cares about actions-per-second or reaction times is ever going to seriously use Stadia.

Now is there a market for more casual users who don't care about that, want to play games and don't want to have their own hardware? Maybe? But I'm not seeing any evidence it's anything more than a niche.

You could probably play Civilization that way. FPSs? MOBAs? Not so much.

munk-a4• 5 years ago

I am waiting until the chance I get to burn down several Google data-centers running dwarf fortress on stadia and egging on a catsplosion.

Nicksil• 5 years ago

This is why I'm bullish on tech like Stadia. It's simply not possible to have conventional cheats on it.
If you haven't, give it a try (free): https://stadia.google.com/games/destiny-2

Perhaps you should also mention you work for Google.

cybernautique• 5 years ago

Agreed. Seems like a conflict of interest. I'd very much appreciate any Googler outright stating as such at even the slightest mention of their employer, and doubly so when recommend Google products.

It would be hypocritical of me to not do as I ask of others, so for the record: I'm a self-employed programming consultant.

mhh__• 5 years ago

Is Stadia actually acceptable for games where people really care about cheating?

madrox2• 5 years ago

I think it's impossible to make an anti-cheat system that is both effective and palatable to security-minded individuals. Game cheating is an arms race, and it can quickly poison an online community. If you want to see examples of what it looks like when anti-cheat isn't taken as seriously, pop over to the Titanfall 2 or Apex Legends subreddits. Every single anti-cheat system has been the subject of hand wringing by HN at some time or another.

I don't think there's an answer until the OS itself has a way of preventing cheaters in a trustworthy way. Maybe cloud gaming will solve this, but it isn't solving it yet. Until then, I don't blame Riot or anyone for aggressive anti-cheat practices. They're protecting their community and their business.

bArray• 5 years ago

The same mechanism games are going to use for anti-cheat are soon going to be used for normal software too. You could imagine Adobe for example using the TPM to ensure there is no license deactivating modifications.

The problem is, after some time demands will be made as a requirement of porting software into Linux and soon we'll have this in the Linux kernel.

Valorant's anti-cheat system requires TPM 2.0 and secure boot on Windows 11

Related Stories