lila-ws icon indicating copy to clipboard operation
lila-ws copied to clipboard

frameLag should store per (UserId, IP, Fingerprint)

Open isaacl opened this issue 1 year ago • 1 comments

Potential exploit:

User can inflate frame lag by connecting a second time using a slower internet connection (i.e. a phone or another browser w/ VPN). They can they use an websocket exploit to inflate lag comp beyond their main tab's ping.

To combat this, frame lag should be stored based on (UserID, IP, Fingerprint) (or some lightweight hash of the three)

isaacl avatar Nov 29 '22 16:11 isaacl

This is a bit of a mess, because scalachess would have to select a specific framelag based on which connection was submitting the move...

One potential alternative would be to store each connection's avg frame lag, but propagate the min of all connections from a userid to scalachess... However this could cause issues if a casual user played from their slow connection while their computer still had lichess open.

isaacl avatar Nov 29 '22 16:11 isaacl