@Riot Tantram: Would it help to track punished players across multiple accounts if...

HalcyonDweller·Oct 20, 2017·4 votes·499 views

the League Client kept a hidden/encrypted file somewhere in the program folder that held a unique identifier so that Riot could tell if a user was simply using multiple accounts from the same client?
the League Client traced it's route to check if the connection is the same as that used by other accounts from the same location.

I believe that these techniques could be combined with existing profiling techniques used by Riot to match alternate accounts back to their owner. I believe they would help to ensure that punishments would stick instead of just forcing a player to play on their 'alt.'

Discuss in the comments, and feel free to share any other ideas you might have for how to address this issue.

39 Comments

DrugothOct 20, 20173 votes

I actually suggested this solution in another thread yesterday. It sounds great but there are some inherent problems with it.

Different users using the same computer could be affected
Hiding a file on the client side computer could be figured out and exploited
This doesn't work if the player used a different computer

HalcyonDwellerOct 20, 20172 votes

{quoted}

I actually suggested this solution in another thread yesterday. It sounds great but there are some inherent problems with it.

Different users using the same computer could be affected

Hiding a file on the client side computer could be figured out and exploited

This doesn't work if the player used a different computer

I see what you mean, but I have some ideas about solutions.

It would not automatically result in punishment, instead it should be combined with other tracking techniques such as matching heat-maps and champion-pools in order to build up a case surrounding the accounts on that connection. That said I do understand the issue of multiple users on the same machine or connection, as shown in my comment: "How should this be handled to prevent mistaken punishments against internet cafes, gaming lounges or college dorms where a user could bring down punishment on other users nearby?"
Should be simple enough to hide multiple files and encrypt them all, just to make it harder to tell which to figure out. Also keeping the encryption keys and algorithms on the server and only working with the file there would prevent the user from decrypting it. Then whenever the game patches (or at random times if Riot wants to really enforce it) the client could upload the file back to the server for decryption. If the file were messed with then it can be reasonably assumed that the user modified the file. Additionally a new file encrypted differently could be downloaded to replace it in order to ensure that the user could never decrypt it.
Trace Route would be able to track the machine through its connection route, even different computers will still have to use the same network, so if a user has similar heat-maps, champion pools, and other factors tracked by Riot then Riot may be able to verify if it is the same user on a different machine.

I'm not saying the proposed system is foolproof. But I do think that it is reasonably believable / reliable for the purpose of flagging potential accounts to watch out for.

DrugothOct 20, 20171 votes

Don't get me wrong, I'm all about keeping the perma banned assholes as far away as possible. I was just playing devil's advocate.

I posted my comment before you posted yours concerning the internet cafe/multiple users quandary.

I think this idea actually could work when used in conjunction with heatmaps and champion pools like you suggest. I never thought of combining them personally.

Now all we need is Tantram to come and weigh in here to let us know how viable he thinks this solution is, and present us any problems that we couldn't foresee not being part of the program behind the scenes.

HalcyonDwellerOct 20, 20172 votes

{quoted}

Don't get me wrong, I'm all about keeping the perma banned assholes as far away as possible. I was just playing devil's advocate.

I understand :) Sorry if my response was stiff, I just jumped at the opportunity to provide reasoning in support of my ideas. Nothing personal here except gratitude to you for giving me that opportunity!

I posted my comment before you posted yours concerning the internet cafe/multiple users quandary.

Ah sorry, I should not have assumed anything about this.

I think this idea actually could work when used in conjunction with heatmaps and champion pools like you suggest. I never thought of combining them personally.

Thanks! I really hope it could work :)

Now all we need is Tantram to come and weigh in here to let us know how viable he thinks this solution is, and present us any problems that we couldn't foresee not being part of the program behind the scenes.

That's the hope anyway, although I understand if he can't give too much details (due to trying to not give people ideas for how to get around it).

ModThe DjinnOct 20, 20173 votes

As Chermorg said, I believe #1 would be illegal in many places.

#2 seems tied to a machine, and that can harm innocent players in families or cyber cafes even IF a traceroute can be easily collected and can't be falsified (I'm not enough of an expert to be able to make that determination).

HalcyonDwellerOct 20, 20172 votes

Upvoted to counter whoever downvoted you.

I've responded to Chermorg's points with some questions and clarifications of my own, I'd be quite appreciative if you have any thoughts to add regarding those questions.

I understand about #2, I believe that this sort of tracking should be used to build a case, not as the sole reason for punishment. It should be combined with other techniques that Riot already uses to track connected accounts. Those other techniques could still be used to prove that two accounts belong to different users.

Mizuki ZahraOct 20, 20171 votes

then explain this to me

a few months ago my cousin was harassing me on the forums. he got banned but i got banned because riot thought it was a linked account....he used my computer and we both work together. idk how i got banned but after submitting several tickets they un-banned me .

so how the f did they even assume it was my account here's the message i got

Hey Toshiai, Due to your actions on your other account leading to it being suspended permanently, all of your Boards accounts are now suspended permanently as well. If you would like to discuss your suspension in more detail with Riot, you can send in a Player Support ticket and they will help answer your inquiries.

HalcyonDwellerOct 20, 20171 votes

You were likely tracked using a different method, one that is legal already. One that is prone to mis-identifying users on the same network or device as one user.

Mizuki ZahraOct 20, 20171 votes

So it doesn't work then cause obviously it thought 2 people were one so ya ur logic is flawed

HalcyonDwellerOct 20, 20171 votes

The boards operate differently from League of Legends. And the other systems of tracking and profiling that would work on league do not necessarily work on the boards.

Essentially, they have less to work with when trying to match accounts on the boards than they do to match accounts in the game client.

HalcyonDwellerOct 22, 20171 votes

I wasn't defending the boards, was simply explaining why I think the boards might make that mistake.

I was more just defending my idea, it's different on the boards than in-game. That was all I was trying to say.

GeauxxOct 20, 20172 votes

So basically if multiple people use the same pc for league, if one messes up they all get ruined.

Na it's not going to work.

HalcyonDwellerOct 20, 20171 votes

Not at all, it's not a standalone system. It would combine with existing techniques such as matching heat-maps and champion-pools in order to build a case surrounding the connection and the accounts. No way should it auto-result in punishment.

GeauxxOct 20, 20171 votes

ill use me and my lil bro as an example. me and him are both sup mains and run about the same champion pools and are around the same elo.

In what way would his toxic ass getting banned not result in me getting hit too?

HalcyonDwellerOct 20, 20171 votes

OK I'll bite, hypothetically speaking then:

Does your brother play with the exact same people as you do? Does he have the exact same clicking patterns and heat maps as you? Does he say the same kinds of things in chat as you?

There are lots of 'tells' that Riot can read to prove you aren't the same player. The chances of a false positive are extremely low.

DrugothOct 20, 20171 votes

And even in the case of a false positive, petitioning the support department will usually result in a quick overturn of mistakenly handed out punishments.

HalcyonDwellerOct 20, 20171 votes

Indeed, even a false positive can be overturned quickly, and given the unlikelihood of a false positive with that many different factors being tracked, there would be minimal cases of this happening anyway.

GeauxxOct 21, 20171 votes

Actually yes, yes he does.

I taught him how to play since he asked me and he tends to watch what i do.

as far as the chat goes idk if he says all the same things as me, all i know is i taught him to type out exact times for summoner spells which not many people do anymore.

Also, sorry for the late answer.

HalcyonDwellerOct 21, 20171 votes

{quoted}

Also, sorry for the late answer.

It's fine we all got lives.

Actually yes, yes he does.

I taught him how to play since he asked me and he tends to watch what i do.

as far as the chat goes idk if he says all the same things as me, all i know is i taught him to type out exact times for summoner spells which not many people do anymore.

Click patterns and heat maps are very specific to individual players. Copying your behavior would not enable him to replicate your heat maps. Thus Riot could still tell the difference between the two of you.

Edit: Also, he plays with your friends? None of his own? Because that's still a little odd for siblings.

HalcyonDwellerOct 22, 20171 votes

I know you received a notification for that comment. Why drop this discussion? There were unresolved points of contention.

GeauxxOct 22, 20171 votes

because i work long hours and forget about the boards until i ever just get on them eventually.

Now that i've read them, as far as specific heat map, i doubt that can be a liable tool for tracking as that changes per situation for any and every player.

As far as friends, yea we have the same league friends as we sit in the same discord... so when one person is heard in the background the other basically gets forced into the convo because we are all clowns

HalcyonDwellerOct 22, 20171 votes

Heat maps rarely change suddenly. They are capable of shifting over time, but a player usually reacts the same way to repeated situations. As they learn their patterns shift, but it's never abrupt like it would be when comparing the differences between two separate individuals.

ChermorgOct 20, 20172 votes

Number 1 would likely run afoul of law in a bunch of countries unless it was an opt-in system or easily removable (which both defeat the purpose of it).

I believe (don’t quote me) that Riot wouldn’t be able to get that trace route legally without input from the user. But I’m much less sure about that one.

HalcyonDwellerOct 20, 20172 votes

{quoted}

Number 1 would likely run afoul of law in a bunch of countries unless it was an opt-in system or easily removable (which both defeat the purpose of it).

Would it work to put it in the terms of use that the user must agree to opt-in in order to use the services or play the game?

I believe (don’t quote me) that Riot wouldn’t be able to get that trace route legally without input from the user. But I’m much less sure about that one.

That makes sense and I could definitely see why it might be a problem, but what about if the user gave consent prior? Like how I suggested in my response to your first point?

DrugothOct 20, 20171 votes

I think we may actually be getting somewhere here!

If this encrypted file had to be opted into on the ToU agreement it should protect Riot from any lawsuits.

Using an encrypted finger print file in combination with other pre-existing detection tactics like heatmaps and champion pools it could be an actual effective way to lock players out of the game that refuse to reform or follow the rules.

If we can effectively lock out players that refuse to follow rules, it may work as incentive for players that previously were immune to reform because they could always just create a new account.

HalcyonDwellerOct 20, 20171 votes

Thanks! It all depends though, some countries have strong laws surrounding the privacy of people and software installed on computers. I hope it would be okay but we can't be certain until a legal team looks into it.

The next step is to find a way to test if a client is on a a virtual machine, that way people can't easily work around it.

ChermorgOct 20, 20171 votes

Well, first ianal (I am not a lawyer).

That being said, some things have been found to not be legal parts of terms of use. For example, users must explicitly be told that they will be getting cookies on their machine if they visit an EU website. That's why you see that popup when you visit them.

I like the ideas and I think they'd be great if they can work, but I'm just not sure if they're feasible.

HalcyonDwellerOct 20, 20171 votes

{quoted}

Well, first ianal (I am not a lawyer).

Me too, I respect that and I understand we can't know for certain what legally works.

That being said, some things have been found to not be legal parts of terms of use. For example, users must explicitly be told that they will be getting cookies on their machine if they visit an EU website. That's why you see that popup when you visit them.

Ah, that makes sense, I would have thought that since people are forced to look at the terms of use and agree to them each patch that people would have been required to read them. But I see how it could be possible for people to not read it and still need to be notified.

I like the ideas and I think they'd be great if they can work, but I'm just not sure if they're feasible.

I understand that, thank you! That's part of why I want to discuss them, I want to find all the potential problems and discuss them and see if there is a solution that addresses them all.

ChermorgOct 20, 20171 votes

Yeah, I think the biggest problem here is it’s going to be Rito’s lawyers that make the final call on whether they’re willing to defend it if it goes to court. And they’re going to make that decision internally and not say a word to us about it, especially not on the boards. I do think it may be telling that they haven’t done anything like that yet.. or maybe they already are and we just don’t know about it?

A magician never reveals their tricks - and maybe Riot isn’t revealing this trick?

HalcyonDwellerOct 20, 20171 votes

Quite true. Part of the problem with malicious users being aware of your systems to catch them is that they could try to find workarounds to that. It's the same problem with scripters.

It's frustrating for me because I want to talk about these sorts of things with Riot, but at the same time I understand their need to keep quiet about whatever systems they might have in place.

HalcyonDwellerOct 20, 20171 votes

Another question, sort of a counterpoint to my proposal...

How should this be handled to prevent mistaken punishments against internet cafes, gaming lounges or college dorms where a user could bring down punishment on other users nearby?

HalcyonDwellerOct 20, 20171 votes

Also how do we ensure that the League Client is not simply being run in a virtual machine? Would tracing the route be enough?

TryMucinexOct 20, 20171 votes

Just so you know, players are allowed, even encouraged in the case of reformation, to make new accounts should they ever be punished.

HalcyonDwellerOct 20, 20171 votes

Oh absolutely. I understand about that, I'm more referring to players who have multiple accounts that they switch between in order to diffuse their toxic behavior and evade around 14-day bans.

nerak23Oct 20, 20171 votes

If you would like to discuss your suspension in more detail with Riot, you can send in a Player Support ticket and they will help answer your inquiries.

And did you file a ticket? What did it say, since you brought it up?

HalcyonDwellerOct 20, 20171 votes

What do you mean? I was not punished or suspended, I have no suspension to discuss with Riot Support.

And usually when you submit ideas to Riot Support they tell you to create a boards post.

CreampEyeOct 20, 20171 votes

[deleted]

HalcyonDwellerOct 21, 20171 votes

The point of creating a complicated system of profiling is to make it too complicated and not worthwhile for the average toxic player to bother working around it. There's not much that can be done to truly prevent a particularly determined player from continuing to use the system, but for most, this would be enough.

It would take a lot of steps done carefully and in the right order, which is way more effort than most players are willing to put forth after receiving a punishment.