toko-fukawa-official:

kuzenbo:

shinarusayuno:

sunsetsullivan:

baronvonbaron:

Fallout 76 apparently has no client side file validation, and network traffic is unencrypted plain text

For people who don’t understand, this is absolutely bonkers.

Basically imagine opening up console and typing like “give player_item [the best weapon in the game]” in any other Bethesda game but online and everyone can do that.

You are likely able to just kill people you don’t like by walking around, finding other player’s player_id’s, and typing kill in the console.

This isn’t even getting into hackers using this maliciously steal information or use harmful programs through the game.

This is real bad.

I counter your seemingly informed Reddit link with an actually informed Reddit link!

https://np.reddit.com/r/fo76/comments/9up1g6/fallout_76_uses_tls_to_encrypt_data/

According to this guy (who did REAL TESTS with the accused Wireshark application), the game does use encryption – meaning that there isn’t a security exploit like the first guy  has claimed.

Additionally a lot of the claims that the guy makes are over exaggerated to the point of being straight up wrong. But he’s also correct in some places.

Firstly the game does indeed not verify that your files aren’t modified, hence why some mods work. I’m not entirely sure to what extent, however any mod that retextures something will absolutely work. This is not a GIGANTIC deal that the Reddit guy makes out, online games have had this for a long, long time. (RIP sv_pure 0).

Again, I’m not entirely sure what the extent of modding looks like so far, but you can see it for yourself that the only mods that exist right are replacing existing data, not introducing new data. Once again, this has been done in multiplayer video games since they were a thing. However Bethesda handles it us up to them. Getting upset over this is like getting upset that someone made an aimbot.

The game is not client to client like the Reddit post claims, it’s client to server, which is why you can’t play when the servers are down, or you don’t get disconnected or migrated whenever the host client disconnects. It’s also why the game has impressively decent playability in what most people expected to be a laggy nightmare.

However, what is true is that positional and movement data is all clientside. You can see this happening with the framerate bug where people would start running around at super fast speeds. The server simply takes the client’s word for it and will update itself accordingly.

What is not clientside however is information such as health, stamina, items, other actor positions, and so on. An example of where you can see this is sprinting consumes stamina, and your client thinks to itself “as long as i have stamina, I can sprint”. Then when you start sprinting, you’ll see a delay as to when the stamina bar starts to deplete. This is called latency. Fallout 4 did not have this when everything was clientside.

On top of that, the stamina bar seems to be bugged in that you can trick it in to not immediately depleting when you start sprinting, meaning you can sprint without it draining for a few seconds until the server realizes what’s going on. My theory is that it’s a hiccup of data interchange since it’s an interaction between your movement (clientside) and your stats (serverside), but it only causes a brief delay. I haven’t been able to reproduce this however.

Furthermore items and containers can’t be manipulated as they are all server side as well. You can literally see this as you manage inventories as there is a delay between actions combined with short loading times as the server fetches the contents of the container to display. Unlike singleplayer Bethesda games which just do it instantly.

So keeping all of that in mind… despite what the Reddit post claims, you would not be able to effortlessly send false packets from the client to the server that you took zero health damage. The client doesn’t tell the server what your health is, the server tells the client. The only information that can be modified by the client is their own positional data and client-to-server interaction data.

Having said all that, I’d like to draw attention to the fact that the Reddit account which made the OP in the link has only existed for less than 2 weeks of making this post, and all it has done is spread negative false information about Fallout 76. It’s almost like someone has some kind of agenda going on.

Is the game perfect? Absolutely not. Will it be exploited mercilessly? Probably. However, almost everything that that one guy said is inherrently flawed or wrong, and is grossly overexaggerated. I can’t say for certain that someone wont find a way to edit their inventories, but as it stands now the claimed methods in doing so are highly unlikely as they are based on false information.

@glitzer-blitzer

@critical-quit