What I meant was, you are cloud-hosting (assuming not CE) the part where the non-anonymised PII is sent to [as opposed to sanitised coming out of] and processing it; and in addition the only provider supported is one subject to https://en.wikipedia.org/wiki/CLOUD_Act
HTML5 geolocation if you ever click allow even one time can granularly identify location based on where you are. It sends nearby MAC and correlates this to wardriving-equivalent scans. You do not need to be connected to wifi.
My non-invasive way for basic security - nothing sent to third parties at all; no blocking of VPNs other than the usual anti-bruteforce stuff:
- GeoIP server side; trigger MFA (email a confirmation code) if country mismatch. Anything less is too granular unless you have some good reason for it, people moved to cheaper places during the pandemic, mobile connections geo horribly wrong when NATed
- Drop a random unique cookie (long-lasting) on the client; if this cookie is not present and valid/signed prompt for MFA
- Give the user an opportunity to revoke all logged in sessions
It works well past 10 users on very high powered mobile. Less so on cheap phones.
It's really more that you are spraying high volume websocket and webrtc data continuously while doing realtime 3D/WebGL - you are practically running a full game at this point.
99%+ of them are all terrible. Think jQuery 1 written in 2020 with hundreds of useless includes, over 50 web fonts loaded simultaneously to frontload on the feature list while providing nothing of value.
CSGO relatively heavily suppresses "user maintained" community servers, the entire experience from onboarding to client launch prioritses the Valve-run official matchmade servers for casual/competitive/etc and any special game modes.
Server browser is a hidden afterthought behind a dropdown.
I appreciate that you are trying to do this with respect and hope you succeed.
I've done both sides (largely MMO-stuff as a kid), and for me, I'm done dealing with all this invasive garbage, and just spin up a fresh EC2 GPU instance when I want to play something, and simply don't play the games that choose to disrespect and abuse players to the point of not even allowing GPU passthrough (I can somewhat understand banning emulated GPUs; have dealt with people farming referral accounts a hundred at a time each queuing for games at <5 FPS).
I'm guessing this is a mix of attestation and inspecting what they actually do instead of just blindly checking the certificate and that the signature is verified? I'm curious how well executed that works when it comes to less well behaved anticheats (like Riot's Vanguard generally stays hands off, but GameGuard will immediately heartbeat a "ban me" and intentionally cause a bluescreen to cause you to "lose any data collected by your debugger" when it notices it's being looked at).
This type of BS is super common in Asian countries/published MMOs and a bit less acceptable in the west (you still have EAC and battleye, but at least they make an attempt to use TLS?)
Another insane example: xigncode has long since advertised a feature that the game developers can remote control into your PC like VNC. I don't know whether any developer has chosen to actually enable it, but the fact that they push it as a feature is some serious clown-egg-face.