We outsmarted CSGO cheaters with IdentityLogger

Banning new Steam IDs on banned IPs seems too strict to me. Some ISP use CG-NAT or rotate IPs, meaning a single bad actor could harm many innocent players.

Yeah that sounded like a very bad idea. It was already a bad idea years ago when there were enough IPv4 addresses, because still people were using NAT behind routers. So, it could happen that you just ban a whole family or people that are living together in the same flat, although only one of them cheated. But now, with this whole carrier grade NATting, it seems like not only a bad, but a dysfunctional idea.

This is mentioned in the article, hence why they added a third method.

They actually cover these concerns, acknowledge it was a problem with examples of siblings or students behind a shared IP, and then developed a parallel cookie based tracking system, using the "server welcome message" which is served as a web page in the in-game browser.

It's also worth noting this is a 3rd party dedicated server provider, who manages and leases community run game servers. Getting a ban here would prevent you from playing on that provider's servers, but not any of the official matchmaking ones or servers from another hosting provider.

They added the third identifier to detect ban evasion by changing the Steam ID and the IP address.

They implemented some specific exceptions but generally recommended to not play on untrusted networks to avoid getting banned along cheaters in the same network.

That's my take from the article.

Yeah. IPs are NOT identifiers. At best they are a session ID. Using IPs to ban players on the basis that they've been used by a cheater before seems extremely unfair and probably even an opportunity for denial-of-service.

NAT is a problem, but in this case I think it's a valid consideration regardless. Banning innocent players behind shitty ISPs sucks, but cheaters suck more.

I'd agree if it was being used to ban players across many servers, but a single community server is not that big a deal to be banned from. And they seem to have had an appeals process.