The online racing simulator
Hackers alert / license rental
(189 posts, closed, started )
Quote from Ped7g :What? You as player agree with the terms and conditions https://www.lfs.net/agreement
It's up to you to follow them, or don't play.
If you break the rules, there could be consequences:



You sound a bit like "ok, it's forbidden by law to kill someone, but look, nobody enforced it, *bang* *bang* I shot him!" ... Shrug makes no sense to me.

No, that is not what he means and it's obvious.
I don't see too deep into this problematic, but isn't the solution simple?
2-step authentication, normal thing nowadays. Wanna login to LFS account? Confirm via mail/SMS code/you name it. Wanna unlock the game? Same thing. I am aware the infrastructure required and the price of such systems might not be within reach of Scavier financial possibilities, but if it is, then isn't this the way? Steam has been working with this option for years. And that's only a drop in the sea, just to name one.
Quote from Kid222 :I don't see too deep into this problematic, but isn't the solution simple?
2-step authentication, normal thing nowadays. Wanna login to LFS account? Confirm via mail/SMS code/you name it. Wanna unlock the game? Same thing. I am aware the infrastructure required and the price of such systems might not be within reach of Scavier financial possibilities, but if it is, then isn't this the way? Steam has been working with this option for years. And that's only a drop in the sea, just to name one.

2FA would indeed be great (also apart from this topic). Using SMS as second factor isn't considered safe btw. Using an OTP would be great and shouldn't cost a dime (apart from the time spent).
Quote from Kid222 :I don't see too deep into this problematic, but isn't the solution simple?
2-step authentication, normal thing nowadays. Wanna login to LFS account? Confirm via mail/SMS code/you name it. Wanna unlock the game? Same thing. I am aware the infrastructure required and the price of such systems might not be within reach of Scavier financial possibilities, but if it is, then isn't this the way? Steam has been working with this option for years. And that's only a drop in the sea, just to name one.

Bingo. I'm a bit confused by the debate going in circles because this is a well understood problem with a simple solution.

For what it's worth, this is precisely why some Steam games require a verified phone number to install and play.
Quote from Scawen :I never said they had.
...
Try to keep up and please stop suggesting I've said things that I haven't.
...
I haven't thought that or suggested it any any point.

Firstly, to the above point:
Quote from Scawen :It's an ugly thing you have created.

Quote from Scawen :... you are recreating many ugly aspects of capitalism in a game world and supporting a license rental trade in direct contravention of our license agreement ...
... as you have allowed a fun game to shift towards real world earning instead of staying on the fun side ...

The tone and words used heavily implies that you thought we actively created a system for people to buy in-game items for real-world money, and that we knew about and facilitated account renting/sharing. Some others' use of words suggest they had similar assumptions.

Merely having a purely in-game money/trading system is normal and far from controversial (see below).

We only found out about the rental issue as a result of this thread (and/or a DM that started it, I'm not sure of the exact timeline).

Thus, given the words you and others used, it never occurred to me that the fact our system simply allows in-game item/credit trading would result in such language/statements directed against us.

------------

Quote from Scawen :... supporting a license rental trade in direct contravention of our license agreement

For the record, [TC] have been actively enforcing the "no account sharing" part of the LFS Terms of Service for many years:
  • We have actively investigated suspected shared accounts (and have a system to help track this) and permanently banned a number of accounts with sufficient evidence that they are being shared by multiple people.
  • Our system even automatically bans accounts showing the most obvious signs of being shared.
  • After seeing more suspicious account activity very recently, we have also implemented an additional feature to disable accounts.
I'd say we've gone above and beyond to help enforce LFS account sharing ToS. Enforcing this isn't our responsibility, but we have always done it where we can, to help the LFS community.

------------

Since I was not aware of [TC] "allowing" trading for [TC] money, I have asked around for clarification regarding what that actually means.

Turns out people were using our Off-Topic "Marketplace" forum area, to trade things for [TC] money. This area was intended for people to trade real world items for other real-world items and/or real money.

The only official written stance about paying for [TC] money that we can find is from a discussion in 2012: "We don't encourage or endorse it but we have no control over what people do with their money, real or game-based." Beyond this, [TC] never really decided on an official policy. It apparently was not a problem for us until very recently either. The marketplace area has been removed for now, and we are currently discussing how to deal with advertising of trades.

To be clear, our forum's Marketplace area has never been used to trade, sell, or rent, LFS accounts.


I've always personally been against selling [TC] money for cash, however historically it doesn't seem to have caused any problems. I've even heard reports today of trades resulting in a number of S3 upgrades being bought for people who genuinely couldn't afford it (no actual money changed hands, but LFS vouchers were purchased and gifted).


------------

Background:

What [TC] have is a "credit/'money'/economy based progression system", which is incredibly common on many thousands of very popular games, and many multiplayer games. It is a core mechanic of many genres of games. It goes beyond simply unlocking items at certain stages to be used infinitely, which the majority of players get bored of quite quickly (eventually, you "win" and that's the end of it). The style of progression system, as used by [TC], is normal and far from controversial.

Several of those biggest multiplayer games have implemented payments systems to facilitate purchasing of in-game items with real-world money and/or trading between users for real-world money (Valve, Rockstar, EA etc), and was wildly controversial when it started (blame EA/Valve) and continues to be so. [TC] do not do this and have never done this. As mentioned, some other cruise servers have historically (don't know about now).


To use your Monopoly example. The entire point of Monopoly is to trade money and goods. Someone wins when noone else has any money. People play it because it's fun.
Trading real money/items for Monopoly money isn't in the Monopoly rules, and it's not in [TC]'s rules either.
One difference though, is that you don't win or lose in [TC], unlike Monopoly. In fact, with the mod rental system, you don't even need to have much money to drive all the cars these days, so there's less incentive to gain money quickly other than to make a number go up.

A vanishingly small number of users trading [TC] money with real money, while we would rather they wouldn't, doesn't really make a significant impact to the economy. It certainly doesn't go as far as "unbridled capitalism that appears to be currently corrupting the server"



Within LFS, [TC] weren't the first (or even second I think) to implement a money system. As far as I'm aware, being able to send in-game money to other players has always been a standard feature with cruise InSims and not unique to [TC].

The core implementation of [TC]'s money system is practically old enough to drink. It's an industry standard gameplay mechanic. It has been refined enough so that it doesn't easily inflate to infinity and keeps people interested (mostly).
It's not a novel or controversial concept in LFS or beyond in any way.
It hasn't "caused" any issues until recently being blamed for third-parties unscrupulous activities outside the platform.

This thread started off with 20-40 compromised accounts due to people cracking LFS, and devolved into [TC] being to blame because people who were already breaking laws abused our system?


Quote from Scawen :I have repeatedly asked why it is necessary to allow money transfer between players, but have not received an answer yet.

It's a core gameplay mechanic. It's how the world works, and has worked before capitalism or even money. Trade is the basis for all economies around the world for millennia. Money is simply a tool to standardise value, or a stand-in for trade where goods aren't appropriate. It's interesting for people and gives a reason to continue playing. That's the reason it's the basis for so many games. If people lose interest, they move on. It is incredibly difficult to come up with a continuous progression system that doesn't include some kind of economy.

------------

I'm not sure what you expect us to do at this point, other than continue to proactively ban accounts with real evidence of sharing, as we always have.

We are considering actively cracking down on advertising in our platforms to sell [TC] money, but will that actually make a difference? People have been trading for real money off-platform, or for non-TC in-game LFS currency for years. As mentioned, other (not [TC]) servers have done it officially where people could pay the server admins for in-game items/money.

I'm not sure it would be helpful to "simply" remove a standard, core feature, which has many positive uses (mentioned previously, by several people). What about blocking trading in-game cars or items? They have "value" (even if we got rid of the money system altogether). Would you require every other InSim system to do the same? It would remove a lot of genuine interactivity between community members and in my opinion (and clearly others', looking at replies to this thread) doing so would ruin a large portion of it. Where do you stop? Does it even make a significiant difference to the account sharing problem?

Removing feature(s) from one server will do little to stop people sharing accounts one way or another, as they have done for many years without needing to trade [TC] money.

------------

The crux of the matter is this: how big/widespread of a problem is this actually? How many accounts are involved? Is this even happening with accounts that haven't been hacked?

If it's known that a significant number of accounts have been hacked, industry standards suggest it would prudent to do a global reset of GAME passwords - if not WEB as well, given the evidence of password reuse. This would save you a lot of work chasing down hacks from passwords that were stolen years ago.

------------

Finally, I really don't want to say the below out loud, but this comment just hurts, given the immense time and effort [TC] as a whole has put into LFS for nearly 2 decades
Quote from Scawen :So after all the support I've given to cruise servers and [TC], now the result is you are recreating many ugly aspects of capitalism in a game world and supporting a license rental trade in direct contravention of our license agreement.

We understand that you, Eric and Victor have given the cruising community support over the years, but please bear this in mind:
  • [TC] have been directly responsible for several hundred (thousands?) of S2/S3 licenses being bought. We have had over 44000 unique players connect, since we started tracking them.
  • We have consistently been in the top few servers and sometimes the *only* server with decent a player base during some of LFS' dark times, no small part down to the sticking power of all our game mechanics.
  • As mentioned above, we have always - voluntarily - actively helped to enforce LFS ToS on account sharing.
The [TC] team have been dedicated to LFS since 2006 and this year it will be 18 years since we began.

A large number of members who were around in 2006 have replied here today, and some who have not yet replied are disappointed to read what has been said about the servers we created and all care a lot about. These members have helped provide thousands of people with entertainment for almost 2 decades.


------------

This was posted after I'd written most of the above, so I'll reply separately:
Quote from Scawen :It's funny how may people around here are attributing me with all sorts of stuff I haven't said, and aren't reading what I have actually said.

I realise it's 2024, but there must still be a place for replying to what people actually said, instead of making up stuff you pretend they said, and arguing against that? Or is that too old-fashioned now?

Please bear in mind that, especially in text online, the choice of words and tone (which, in hindsight, may have been poorly chosen), or omitted clarification, can give the wrong impression/interpretation.

------------

While I drafted the bulk of this post, I had input from Pete, Chuck and the rest of [TC] management, and we have all been variously working on, and thinking about this all day. We are taking this issue seriously. We believe a solution can be found from the many suggestions that have already been made in this thread to make it more difficult for people to share accounts, without significantly altering core, engrained functionality in use since 2007.

What I hope is clear by now is that there are many, many people who are trying to help LFS. [TC], Sim Broadcasts, NDR, and many other teams have members who are talented developers and IT professionals who can lend some actual help to come up with solutions if you should need it e.g. TOTP-2FA as mentioned by others above.
Quote from Degats :[long text]

I'm sure there is a text that will summarize the whole issue and really the TC server has been keeping the LFS audience alive for years and it is not nice to blame TC for what happened, I think your explanation is very sufficient for the LFS developers and I think they should start fixing the problem themselves now.
Degats: thank you for explanations, understanding and efforts to prevent or reduce license sharing and certain types of trading.

I see you have felt under attack from me, but I'd like to mention that I have felt under attack all year so far, not from TC but generally, as most of the time I have been having to deal with people working out ever more ways to try to circumvent every rule or limit we have, to the point of causing problems with the online experience. I've had some success with that but every time I get near the end, another issue seems to come along.

On this thread I gradually learned more about an account rental problem that we have received information and evidence about, and as I gradually realised how it was unintentionally made possible by the TC system, I asked questions, made an unpopular suggestion about removing the free donation of in-game money, and asked for explanations why that was necessary. At that point I was accused of things like trying to destroy TC and so on, which is silly as I've always supported it. I'm sure I should be allowed to ask questions as anyone else can. I'm not some all-knowing sage, I'm just a person who works hard to understand what is going on, and I'm not afraid to ask questions to increase my knowledge.

Making a suggestion and asking questions is not the same as laying down the law and it would be helpful if it's not interpreted that way, so we can have a discussion and it could lead to fixing or reducing problems.

I don't really have more to say at this point but I'll read your post again later to let it sink in a bit more. Thanks again for looking into the problems and making steps to reduce them.
I don't think anyone has any problems with questions asked in good faith. It's just certain accusations will get us down a bit.
Quote from Scawen :I see you have felt under attack from me, but I'd like to mention that I have felt under attack all year so far, not from TC but generally, as most of the time I have been having to deal with people working out ever more ways to try to circumvent every rule or limit we have, to the point of causing problems with the online experience. I've had some success with that but every time I get near the end, another issue seems to come along.

One piece of advice, which may help: Try to treat it as a technical challenge to solve, not an attack against you.
Switching around the thought process may make it less burdensome, or maybe even enjoyable to come up with solutions.

Depending on how your mind works, it may or may not make a difference, but some personalities (especially in programmers/engineers) thrive on challenge.
Odd, the last two posts I could say back at you two, exactly the same.

I was trying to discuss things, you were taking it as attack and accusations.

I certainly was falsely accused several times on this thread.

I don't really need a lecture now from you guys, thanks.

Pity you couldn't see what I was saying in my last post but I can't really be bothered to explain now, I'm actually too busy.
Quote :I was trying to discuss things, you were taking it as attack and accusations.

I fully agree that.
Scawen presented facts, TC guys answered with nonsense and denying and they needed 5 pages to recover a little bit of reason, but they still dont admit explicitely that the problem mainly spawns from their server, while pushing forward that they "saved" LFS for the last 2 decades.
Hum...

edit:
kipieslim made some tool to detect shared accounts, and wrote this morning that 7.5% of Just a Ride connections since november are shared acounts.
People use them to evade bans.
1. they get banned with their own account
2. they go TC server and farm TC money
3. they rent another account with the money they made on TC
4. they get back on JaR, evading the ban.
Keep it hacker related maybe you all
I think this topic has gone on for too long. I don't care about anyone's money exchange, but if there is a problem such as rental accounts due to this transaction, this should be prevented. lfs, I think we should send the necessary warning to TC administrators via e-mail and see the results. Because of this issue, the LFS development process slowed down.
Quote from turbofan :I fully agree that.
Scawen presented facts, TC guys answered with nonsense and denying and they needed 5 pages to recover a little bit of reason, but they still dont admit explicitely that the problem mainly spawns from their server, while pushing forward that they saved LFS for the last 2 decades.
Hum...

You mentioning removing sirens isn't nonsense? Some people would say it's the statement that makes the least sense in this entire thread.

Also they "needed 5 pages to recover a little bit of reason" because they do know how to build proper arguments, and, by your behaviour in this thread, I am surprised at the fact that you, apparently, read it all. The TC members that have presented their views have also stated facts, by the way.

Also, the problem doesn't exactly spawn from their server, it's the people who are actually renting accounts.

Quote from Viperakecske :Keep it hacker related maybe you all

Sounds like a plan.
Quote from turbofan :I fully agree that.
Scawen presented facts, TC guys answered with nonsense and denying and they needed 5 pages to recover a little bit of reason, but they still dont admit explicitely that the problem mainly spawns from their server, while pushing forward that they "saved" LFS for the last 2 decades.
Hum...

edit:
kipieslim made some tool to detect shared accounts, and wrote this morning that 7.5% of Just a Ride connections since november are shared acounts.
People use them to evade bans.
1. they get banned with their own account
2. they go TC server and farm TC money
3. they rent another account with the money they made on TC
4. they get back on JaR, evading the ban.

JaR is basically jail for people banned from TC. Its an ongoing joke for quite sometime now. So it makes sense that a lot of your connections are shared accounts.
Quote from klbbadd2002 :JaR is basically jail for people banned from TC. Its an ongoing joke for quite sometime now. So it makes sense that a lot of your connections are shared accounts.

we have the same joke actually : people getting banned from JaR go to Freedom Factory server
superlol Big grin
Sounds like a cruise absolute goal is staying away from ban list
Quote from Scawen :you were taking it as attack and accusations.

I'm sorry, but how else are we meant to interpret the following other than as an accusation/attack:

Quote from Scawen :It's an ugly thing you have created.

Quote from Scawen :you are recreating many ugly aspects of capitalism in a game world and supporting a license rental trade in direct contravention of our license agreement

Quote from Scawen :If you can't understand this, the only explanation is that you don't want to understand. If you do understand but think this is fine, then we have a different point of view that cannot be reconciled.

The only thing we accused you of was in response to you potentially thinking we did any of this to deliberately enable account sharing, which, as Chris has explained, we realise you did not intend.

All any of us is trying to do here is help. That's all we've ever tried to do.

Quote from Scawen :but I'd like to mention that I have felt under attack all year so far

You can't fight fire with fire, especially towards people who are on your side.

The account rental/account hacking problems are the result of illegal activity by a small minority, not [TC].
This to me is like saying that firearms manufacturers are to blame for school shootings. The only blame is on the person who did the shooting.

The same applies here. It's not the TC server or their economic system nor Scawen's fault. It's the actual guys that misuse it by teaming up and driving/playing from different computers with the same LFS account.

I'm afraid 2-factor security stuff will not solve anything, as whoever is sharing the account can easily share the SMS code as well with his accomplice.

My point here is, that people will be people no matter how hard you try to impose some rules.
The issue of the rental system persists as long as there exists the ability to exchange In-Game Currency for real money. This longstanding concern, though not newly arisen, has only recently come to light.

In a simulation game like Live For Speed, where players engage in racing and drifting against AI or other players, the presence of In-Game currency lacks coherence.

Rather than adding value, it perpetuates long-term problems, as evidenced by its emerging persistence.

Furthermore, the prevalence of shared accounts poses another challenge, exacerbated by the increasing use of VPNs, which complicates the detection of such activity.

As long as avenues for trading in-game currency persist, the rental system is unlikely to be eradicated.

Additionally, it is disheartening to witness individuals misrepresenting Scawen's intentions, particularly considering his longstanding support for the Cruise server community spanning nearly two decades. Unwarranted attacks against him are unjust.

Regarding the statement, "[TC] have been directly responsible for several hundred (thousands?) of S2/S3 licenses being bought. We have had over 44000 unique players connect, since we started tracking them." Such a claim appears self-serving and fails to accurately reflect the broader contributions to the game's sustainability.
I was a community officer at Riot Games until 2 months ago. The Riot team was checking our accounts at certain periods. Do we share accounts? Do we pay attention to the rules in the game? No security measures can solve this problem. the only thing left to do is to manually review the login records. scawen cannot do this alone. It would be quite tiring work. So it is difficult to identify rental accounts. no one is accountable to anyone. He either sells his account for money or rents it for TC money as in the subject we are talking about. As far as I understand now, Scawen seems to be trying to solve the problem via TC....

No matter how much TC tries to prevent this, it is a fact that the rental issue will still continue. It's the only thing that bothers me. I'm not saying that a server violates the LFS rules, but if it violates the rules through a server, this responsibility belongs to both the server and the player.

The solution for rental accounts is to manually examine them or develop a system and detect those who log in from different computers. Is this possible? I cannot comment on this.
My two cents: close the thread, let those people who need to talk to each other talk with one another without constant input from third parties, who interpret the same written text in different ways. Putting the energy that it took to write and read all the posts with all the attacking and defending, with the accusing and judging into working on a solution, probably would have created first results already…

But then again this comes from me, someone who does his best Waldorf and Statler impression…
Respect people's ideas and opinions. This topic is open to everyone. Anyone can comment. If the parties you mentioned are LFS and TC management, they could have resolved it among themselves without opening this forum. Something needs to be discussed so this forum is open. If there was no need for this forum, Scawen could have closed it as he did before.
-
(Scawen) DELETED by Scawen : post too rubbish
Sorry for my previous failed reply when I thought your post was another from Chris.

Quote from mbutcher :I'm sorry, but how else are we meant to interpret

I'm disappointed by the lack of understanding going on now.

Chris wrote a well formed post which I appreciated and thanked him for while explaining a bit more from my side, and I ended with a repeated thank to make sure it wasn't missed.

Then I got back a silly post from Boypower, and one from Chris advising me how to use my own brain. This is ridiculous and antagonistic.

I thought things were getting better after Chris's post where he acknowledged certain issues we have all learned more about on this thread. Learning more is a good thing, I think. So I don't know why argument and jibes continue at this point.
Quote from turbofan :I fully agree that.
kipieslim made some tool to detect shared accounts, and wrote this morning that 7.5% of Just a Ride connections since november are shared acounts.

It's easy to say that if nobody can verify that.

It's hard enough to (reliably) tell, whether someone is using multiple accounts, detecting that a single account is used by multiple individuals as more complex by magnitudes. Maybe you have access to secret data, that we don't, but I'd rather believe you base that information merely on IP addresses. Which, as history show, has turned out to be a very unreliable information. It may be an indication, but it is by far too weak to base bans on that. Especially automated ones.

We often came across cases where people in the same household play (their own copy) of LFS via the same internet connection, and its also often the case that people travel, e.g. visiting their families abroad. We can often witness that around the holiday seasons.

The reality is that it takes a lot of different information that need to be brought together by human beings, that analyse it and come to a conclusion. But our admin capabilities are simply limited.

Hence why I proposed to have a solution built-in right into LFS that would enable to identify individual hardware. But it's ultimately up to Scawen to decide whether the issue is big enough to undertake such steps.
This thread is closed

Hackers alert / license rental
(189 posts, closed, started )
FGED GREDG RDFGDR GSFDG