Technical solution to eliminate desync in single-player sessions

"

ScrotieMcB wrote:

I probably shouldn't post this, but it is relevant to the discussion.

There are actually methods to get a remote server to trust the client; this process is known as trusted computing, and involves computers being outfitted with a chip (hardware) called a TPM which stores a private encryption key which it then hides from the user and the rest of the operating system, using a process called curtained memory to perform encryption and decryption tasks without allowing the operating system to view the key in memory. The processor can call on the TPM to encrypt something, but decrypting the key based off the results is essentially like deciphering a giant hash that would take decades (if not longer) to break.

"

ScrotieMcB wrote:

I probably shouldn't post this, but it is relevant to the discussion.

There are actually methods to get a remote server to trust the client; this process is known as trusted computing, and involves computers being outfitted with a chip (hardware) called a TPM which stores a private encryption key which it then hides from the user and the rest of the operating system, using a process called curtained memory to perform encryption and decryption tasks without allowing the operating system to view the key in memory. The processor can call on the TPM to encrypt something, but decrypting the key based off the results is essentially like deciphering a giant hash that would take decades (if not longer) to break.

However, the cost of the server being able to trust the client is that the client can be made far more dependent on third parties. For example, music files can be sent encrypted using the TPM private key (or a derivative), which means such files cannot be easily pirated; however, this essentially means the user has data encrypted on their hard drives which they do not have the key for. TPMs in general give more power to those who make TPMs (and those who do business with them), leading to an Internet where the user has less and less control over their own data. Imagine a future where OpenOffice no longer works on MS Word documents, because MS Word encrypts saved files using the TPM.

When I worked in the US Army, we used TPMs quite a bit, but I considered such use ethical, because at the end of the day the Army controlled the private keys hidden in the TPMs, and the users did not own the systems — the Army did. In instances where the holder of the keys is also the owner of the hardware, obscuring private keys within TPMs is ethical.

Applying TPMs to general public computing is not ethical; therefore TPMs should only be used as a secure computing feature on LANs or WANs owned by a single entity, for verification between devices on their private network and other devices also on the same private network, and should not be an Internet-wide technology.

Unfortunately, the current trend in computing is towards more consolidated power in the hands of major corporations, and it should surprise no one that TPMs are likely to be required in the hardware specifications of future versions of Windows. I encourage everyone to fight this by supporting the Electronic Frontier Foundation, writing your Congressman, or otherwise become politically active in efforts to keep the Internet public rather than owned.

At the very minimum, if such power is to exist as an internet-wide phenomenon, it should be in the hands of the elected representatives of the people — the government — and not in the hands of corporations and think-tanks.

In any case, for the moment GGG cannot assume that clients have a TPM (it is hardware, after all), so they have to design assuming that trusting the client is impossible. In the future, maybe GGG could trust the client... but they'd be morally wrong if they did so, for further contributing to a TPM-based Internet. Unless the government stepped in to regulate, in which case PoE's global reach might still make TPM-based trust difficult to implement (due to having to deal with a variety of governments).

In other words, gonzaw, yes, it's theoretically possible, but it's still not really an option.

"

grasmann wrote:

resyncing the player and the mobs on screen every 500ms by default. Basically what "/oos" does.

"

qwave wrote:

Sorry guys, but 'brute-forcing' synchronization is just not the answer. If this was feasible, GGG obviously would have already done it. The amount of rubber-banding that would result from this would make the game unplayable.

"

qwave wrote:

Sorry guys, but 'brute-forcing' synchronization is just not the answer. If this was feasible, GGG obviously would have already done it. The amount of rubber-banding that would result from this would make the game unplayable.

"

gonzaw wrote:

Right, so in an attempt that "hacker users" don't get that data, TPM also makes it so that "legit users" can't see that data as well, right?

"

But does this stem from the fact the computer has TPM, or does it stem from software that makes use of this TPM to encrypt their data (in user's machines?)
If it's the 2nd one, then, if it is shown that the software/corporation/etc uses TPM in an "ethical" manner, then is there still a problem?

"

For example, imagine the PoE client code is open source. Anybody can see what it does. Now imagine the PoE client calls TPM as the private key I mentioned in my posts (to decipher packets received from the server, to use as a common key with the server for authentication).
If we look at the source, and notice this "TPM lookup" is called EXACTLY once, and in this exact place, wouldn't we know that there is nothing unethical going on with TPM?

"

Okay, this exact example would still have the "virtualization" problems and the like. So imagine the PoE client uses TPM for ANYTHING necessary to prevent hackers from getting the data in-memory, etc.

"

Although....yeah it wouldn't be good business for GGG to force everybody to get that TPM chip before playing PoE :P

"

deteego wrote:

And if your idea was feasible, than GGG would have already done it