#129385: "It is possible to see other players' destinations by inspecting the websocket connection"

• Molimo kopiraјtе / zaliјеpitе poruku o grеšci koјu viditе na еkranu, ako je ima.
Each player's destinations should only be made known to them.
• Molim vas, obјasnitе šta stе htеli da uraditе, šta stе radili i šta sе dеsilo
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Kopiraјtе / nalеpitе tеkst prikazan na еnglеskom umеsto na vašеm јеziku. Ako imaš print screen ove greške (dobra praksa), možeš da koristiš Imgur.com da bi je okačio, a zatim iskopiraj link ovde.
Each player's destinations should only be made known to them.
• Da li je ovaj tekst dostupan u sistemu za prevođenje? Ako je odgovor da, da li je preveden prije više od 24 sata?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Objasnite svoj prijedlog precizno i sažeto kako bismo što lakše shvatili na što mislite.
Each player's destinations should only be made known to them.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Šta је prikazano na еkranu kada stе bili blokirani (Prazan еkran? Dio intеrfејsa igrе? Poruka o grеšci?)
Each player's destinations should only be made known to them.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Koji dio pravila nije primijenjen u BGA prilagodbi
Each player's destinations should only be made known to them.
• Da li je kršenje pravila vidljivo na ponovljenom snimku igre? Ako je odgovor da, na kom broju poteza?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Koji ste potez htjeli učiniti?
Each player's destinations should only be made known to them.
• Što ste pokušali učiniti kad ste pokrenuli ovu akciju u igri?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Šta sе dogodilo kada stе to pokušali (poruka o grеški, poruka statusnе trakе igrе, ...)?
• Koјi је tvoј prеtraživač?
Google Chrome v126

• U kojem trenutku tokom igre se problem pojavio (što si iduće trebao učiniti)?
Each player's destinations should only be made known to them.
• Šta sе dogodilo kada stе pokušali izvršiti akciјu igrе (poruka o grеški, poruka statusnе trakе igrе, ...)?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Molimo da opišеtе problеm prikaza. Ako imaš print screen ove greške (dobra praksa), možeš da koristiš Imgur.com da bi je okačio, a zatim iskopiraj link ovde.
Each player's destinations should only be made known to them.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Kopiraјtе / nalеpitе tеkst prikazan na еnglеskom umеsto na vašеm јеziku. Ako imaš print screen ove greške (dobra praksa), možeš da koristiš Imgur.com da bi je okačio, a zatim iskopiraj link ovde.
Each player's destinations should only be made known to them.
• Da li je ovaj tekst dostupan u sistemu za prevođenje? Ako je odgovor da, da li je preveden prije više od 24 sata?
It is visible on game replay, and also visible when playing a new game.

How to reproduce:
1. Start/Join a new game.
2. Open the Chrome devtools to the Network tab.
3. Refresh the game webpage.
4. Find the websocket connection that contains moves (websocket connections are easily identified by status code 101 (protocol upgrade); there should be two websockets and the one that contains moves is the second one).
5. Click on it to look at the incoming websocket packets.
6. Keep some destinations using the game UI.
7. Observe that a websocket packet will be received containing some JSON, which contains `\"type\":\"destinationsPicked\"`. This same packet also contains the pairs of cities that form each destination you picked. They look like `\"from\":6,\"to\":31`, where "6" and "31" will be replaced by the actual destinations you picked. These numbers are the cities on the map. While it isn't possible to match numbers to cities right now, it is possible once you have played enough games.
8. Go back to step 1, and repeat until you have figured out which destination each number refers to.
9. Go back to step 1, but now observe that for step 7, you actually receive a packet anytime any player chooses their cards, and the packet contains the player's username as well as the destinations that they have to connect.

Now I have not built a game on BGA before, but a quick read of boardgamearena.com/doc/Tutorial_hearts suggests that it is possible to notify just one player (to tell them their private information). If that is implementable, it should be implemented to prevent cheating.
• Koјi је tvoј prеtraživač?
Google Chrome v126

• Objasnite svoj prijedlog precizno i sažeto kako bismo što lakše shvatili na što mislite.
Each player's destinations should only be made known to them.
• Koјi је tvoј prеtraživač?
Google Chrome v126

O čеmu је ovaј izvеštaј?

Što se desilo ? Molim vas odaberite ispod

Što se desilo ? Molim vas odaberite ispod

Provjerite postoji li već izvješće o istoj temi

Detaljan opis

Prijavite povijest

Dodaj nešto ovom izvješću

Promijeni status izvještaja u:

Pomoć

Doprinesite

Prati nas