Bots. How would you feel if you found out that many of the players in your game weren't actually humans? It can happen, as the
online poker world is all too aware. Properly designed, a game playing bot can be extremely difficult to tell from a human. Bots are simply computer programs that act as players to do repetitive tasks, but really they are a form of cheating. So here's a few hints and tips to make life hard for the Web game bot writers. There are three things needed to create a bot that can convince a game it's a human player:
- A user agent field that mimics that of a browser. This is the field the browser provides to identify its version. It's very easy to mimic.
- User inputs happening at regular intervals. Is there a user making their moves exactly four minutes apart?
- A user that plays 24 x 7 who never sleeps!
The trouble is that these aren't very difficult to hide. A decent bot can switch browser user agents, apply a degree of randomness to its input times, and limit itself to not running, say, more than 16 hours out of every 24. With many games having repetitive tasks, it can be tempting to "automate" some activities even if it's in clear violation of most terms and conditions. I think it's often a flaw in the game design that compels people to try and game the system. I know I've come close to creating a bot on a couple of occasions because of my frustration with particular games. A few examples of games where a bot might make the difference: The most recent is
Illyriad, which I've played for three months now and have built up a reasonable city and a second one. It's way too slow in free mode. It's broadly similar to
Lord of Ultima, but instead of the six build orders that LoU has (15 if paying), you get just two with
Illyriad. Oh sure, you can get the game's "Prestige" to have things built immediately, but the mark of a freemium game is how well it plays when free. Having to micro-manage is another reason to automate. When I started playing
Inselkampf, it took the best part of several weeks to get my second island, then successively shorter periods to find and capture subsequent islands. Each needed building and production orders. By the time I got to 80 islands (when I dropped out), it was taking me two to three hours a day just to stay on top of everything.
How to Stop Bots?
Introducing random events that break the flow is probably the best way. Perhaps popping up a random window or, if there's a Yes/No dialog, switch the buttons around randomly, or even use different terms like "Affirmative" and "Negative." The most annoying thing for users is to require a Captcha screen, one of those "prove you're human" pages where you have to read messed up text. There are more subtle ways that I've not seen done but are certainly possible. When the game advances--perhaps users are about to rise a level--email them a unique code or number that they must enter to move forward. The use of HTML5's <canvas> makes it trivial to display text that a bot can't easily grab. Printing a simple sum (3+5 = ?) and requiring the answer once or twice a game session will make life hard for the bot writer. The least intrusive way might be to rearrange the controls when the screen is first loaded, leave them in the same place for the rest of the session. That shouldn't annoy players too much. These are only worth implementing if players want them. Set up Google alerts and keep an eye on discussions where players might ask for them. When that happens, it's time to take action.
