diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The world has never needed video games more than we do right now.



For people who are trapped in their homes due to coronavirus, games have become an important way to escape into other worlds, relieve boredom, and connect with other people. We’ve seen couples get married on [Animal Crossing](https://www.washingtonpost.com/video-games/2020/04/02/animal-crossing-wedding-coronavirus/), students recreate their campus on [Minecraft](https://www.businessinsider.com/upenn-students-recreate-campus-in-minecraft-to-host-virtual-events-2020-4#a-few-days-later-they-created-a-third-server-with-crazy-mods-or-additional-free-software-modifications-to-the-base-game-guo-said-9), and millions of people work out their tension on [Call of Duty](https://www.forbes.com/sites/paultassi/2020/03/13/fortnite-and-call-of-duty-straining-italian-internet-as-coronavirus-keeps-kids-home/), one skirmish at a time.

This surging demand represents a pivotal moment for the gaming industry: can it rise to the occasion and provide a public service without compromising security or buckling under the strain?

## Coronavirus Has Made Everyone a Gamer

Demand has surged most in places where coronavirus has hit hardest and where social distancing requirements have been most severe.

In Italy, one [telecom company reported](https://www.ccn.com/italy-plays-shocking-amount-of-fortnite-to-fight-coronavrius-lockdown-blues/) an over 70% increase in online traffic, which they attribute largely to online gaming (especially Fortnite). In the UK, the latest installment of Animal Crossing [sold more copies](https://www.cnbc.com/2020/04/03/video-games-sales-soar-as-coronavirus-leaves-millions-trapped-at-home.html) in its first week than the combined launch sales of every prior game in the series combined. And even when people aren’t playing, they’re watching; Twitch saw a [31% increase](https://www.nytimes.com/article/coronavirus-video-game-streaming.html) in viewers from March 8 to March 22. With professional sports canceled, it’s literally the only game in town.

The gaming industry, which has weathered its fair share of controversies in the past, now finds itself a major player in the effort to safeguard public health. The World Health Organization (WHO) has [supported gaming](https://venturebeat.com/2020/04/05/40-more-game-companies-join-whos-playaparttogether-coronavirus-awareness-campaign/) with its #PlayApartTogether campaign, which over 50 gaming companies have joined.

Individual game developers are doing their part to support social distancing measures. World of Warcraft is encouraging players to stay inside by offering [double XP](https://www.polygon.com/2020/3/22/21190029/world-of-warcraft-double-xp-weekend-winds-of-wisdom-buff-patch-8-3) through April 20. Three of the [UK’s biggest developers](https://www.bbc.com/news/technology-52172578) (which boast massively popular titles like Candy Crush) have inserted “Stay Home. Save Lives” on their launch pages or directly in their games.

![Coronavirus Has Made Everyone a Gamer](https://images.ctfassets.net/23aumh6u8s0i/5xg4ISZ9zUsVNF46JQFfkX/1db4e569a30ff93e702f601ad35666fe/DR2_Corona_Banner)
<p align="center">Source: <i>Codemasters’ DiRT Rally 2.0.</i></p>

## Gaming Companies Struggle to Scale

The unprecedented interest in gaming is good for social distancing, but it’s also testing the resilience of individual platforms and the internet as a whole.

The spike in traffic from games, streaming video, and people working from home has created a digital traffic jam, even as physical highways are empty. The [_New York Times_](https://www.nytimes.com/2020/03/26/business/coronavirus-internet-traffic-speed.html) reports that coronavirus has led to a 24% drop in median download speeds in New York, while one city in California saw a 38% drop. In response, gaming companies are trying to ease the burden. Xbox has requested that developers release updates only during a specific late-night window in North America and only on weekdays.

There’s been an industry-wide surge in crashes and outages as games struggle to absorb the demand. [Fortnite acknowledged](https://twitter.com/FortniteStatus/status/1239985306520125441) server outages and “issues with logins, matchmaking, the Item Shop, and other Fortnite services.” Blizzard, the makers of World of Warcraft, [apologized to Chinese gamers](https://www.independent.co.uk/arts-entertainment/games/news/coronavirus-online-gaming-china-world-of-warcraft-classic-blizzard-honor-of-kings-a9344471.html) for long lines and performance issues. And the mobile game Plague Inc. found itself [overrun by 130 million players](https://blogs.scientificamerican.com/observations/could-video-games-and-other-entertainment-help-slow-the-spread-of-covid-19/), which crashed its website and prompted the game’s developer to release a [statement](https://www.ndemiccreations.com/en/news/172-statement-on-the-current-coronavirus-outbreak) cautioning people that “Plague Inc. is a game, not a scientific model.”

<include src="TweetQuote" quoteText="Staying at home to stay safe during #covid has sparked a rise in online gaming — and attracted the attention of hackers. Find out how companies can handle the spike in traffic while managing the increased need for security."/>

Many games, especially from smaller developers, simply weren’t designed to have to scale at this speed. In-house identity systems are proving to be particularly weak spots. Tencent’s Honor of Kings experienced [outages in China](https://www.abacusnews.com/tech/coronavirus-outbreak-gives-chinas-internet-titans-surge-users/article/3049812) when 100 million users started trying to log in each day, overwhelming a system that usually deals with 60 to 70 million daily active users.

As developers run into the limits of their legacy identity and access management (IAM) systems, they’re confronted with a choice: patch up the holes as they go or offload identity onto a third party. In making that choice, gaming companies need to think past the current crisis. After all, even once COVID-19 recedes, plenty of the people who discovered gaming under quarantine will keep at it, creating a new normal. In that new world, outsourcing identity will free up developers to deal with the myriad demands of rapid scaling instead of struggling to expand databases and configure SSO integrations.

![Security Risks](https://images.ctfassets.net/23aumh6u8s0i/27u4EBUEBRbVO5SPpqhcT6/f07dbdc3aaf86da52b8a9fde821bbe83/ConductingEffectiveCodeReviews-sep)

## As Gaming Demand Spikes, So Do Security Risks

Security was already a growing issue in gaming before the coronavirus, but the pandemic has added urgency to the issue. In a [2019 McAfee survey](https://www.mcafee.com/enterprise/en-us/about/newsroom/press-releases/press-release.html?news_id=20190101005002), 75% of PC gamers cited security as their number one concern about the future of gaming. They’re concerned with good reason since 64% said they had been affected by a cyberattack or knew someone who had. Despite this concern, gamers are often at risk. The same survey found that 55% of gamers reuse passwords on accounts, making them vulnerable to [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

In credential stuffing attacks, hackers attack using stolen or commonly reused login credentials. Once they’ve gained control, hackers sell or trade the accounts or sell off a player’s unique items. This is potentially lucrative and widespread; Akamai cites a BBC report that children as young as 14 are making thousands of dollars per week selling and trading accounts.

Phishing scams are another way hackers steal the credentials of legitimate players. Cybercriminals will set up a fake login screen that looks just like the real thing or send fake in-game messages demanding users share their login information.

<include src="TweetQuote" quoteText="The primary advantage of @Auth0’s MFA is that it doesn’t force companies or players to choose between security and a seamless experience, helping gaming companies protect their flood of new gamers."/>

These security threats are greatly magnified by the coronavirus. The huge influx of new gamers is less familiar with login protocols and more likely to be fooled by an official-looking popup asking them to enter their email and password.

The best safeguard against these threats is multi-factor authentication (MFA). Historically, many gaming companies have been reluctant to implement MFA for fear of disrupting players and introducing friction. Some games have given players the option of enabling MFA, and [Fortnite even tried to drive adoption](https://www.businessinsider.com/fortnite-2fa-how-to-enable-2019-2?r=US&IR=T) by giving rewards to players who turned it on. 

But one of the primary advantages of [Auth0’s MFA](https://auth0.com/multifactor-authentication) is that it doesn’t force companies or players to choose between security and a seamless experience. You can choose the precise conditions under which to request MFA (for example, when making a purchase) and pick the authentication method that makes sense for your users.

The other element to protecting users from credential stuffing attacks is alerting them when their credentials have been compromised. Auth0’s [breached password detection](https://auth0.com/breached-passwords) maintains a constantly updated database of stolen credentials and will proactively notify users if their information has been stolen in a third-party breach. It also gives companies the option of automatically logging out those users until they can set a new (hopefully, unique) password. Best of all, for gaming companies that need security solutions in a hurry? You can enable it by flipping a single toggle.

![Anomaly Detection](https://images.ctfassets.net/23aumh6u8s0i/4OsfIJDpiNuT1xLkngpysA/29e5da2764dba12767f4cf802634d743/Anomaly_Detection)

[Battlefy](https://battlefy.com/), which lets organizers create esports events, [chose Auth0](https://auth0.com/case-studies/battlefy/) as their identity service provider largely for security reasons. With it, they’ve been able to stop storing sensitive information like password hashes in their own databases. They’ve also used Auth0’s breached password detection to communicate with users during a security threat.

## Putting in the Work to Let People Play

By and large, the gaming industry is rising to the challenge of the current moment. But the systems we put in place today shouldn’t just be designed to get us through the coronavirus crisis; they should build resiliency to prepare the industry for a new era.

With the right tools and the right mindset, gaming will come out of this moment more secure and more equipped to handle spikes in demand. Because even once people are allowed to leave their homes, many will keep going back to the pixelated worlds they’re discovering right now.

To learn more about how Auth0 can help gaming companies welcome new users and [fend off attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks), please reach out to our team.


<include src="asides/AboutAuth0" />


How Gaming Companies Can Meet Challenges of Coronavirus

Rapid gaming industry growth across mobile, console, and PC platforms can lead to disaster without proper security and anti-fraud protections.



In April 2018, Epic Games’ [Fortnite generated $296 million](https://techcrunch.com/2018/05/25/fortnite-had-a-296-million-april/)—more than double what it generated in February. Growth was rapid across mobile, console, and PC platforms.

At the same time as users peaked in February 2018 with 3,400,000 simultaneous logins, [mysterious charges began to appear in users' accounts](https://kotaku.com/whats-really-going-on-with-all-those-hacked-fortnite-ac-1823965781), ranging from $99.99 to $149.99. Hackers made off with one-off charges and often racked up multiple thefts from single users. [One player even struggled to pay his rent](https://www.reddit.com/r/FORTnITE/comments/841zdn/account_hacked_epic_please_help_thats_my_rent/) as a result of the total financial damage. Thieves exposed critical data via multiple log-in attempts, posted sign-in codes, and offered upgrades at steep discounts.

The example isn't isolated. Annually, [cyber thieves make off with over 40 percent](https://www.panopticonlabs.com/our-technology/) of video-game publishers' in-game revenue. As the global [gaming industry's sales top $100 billion](https://seekingalpha.com/article/4184342-video-games-taking-will-esports-become-larger-sports), more criminals are taking notice, and more companies are at risk.

In 2018, it will be critical for gaming companies to know exactly who is logging into their system, when, how, and from where — in order to create a safe and productive environment that users trust and continue to visit.

## What Are Auth0 Rules? How Can They Help?

[Auth0 Rules](https://auth0.com/docs/rules/current) are short JavaScript functions that are executed each time a user authenticates to an application. For example, if you want to know what country a user is logging in from, you can pull this data with the [Add Country Rule](https://auth0.com/rules/add-country) in the Auth0 user dashboard. This can be helpful in locating individual hackers or clusters of them working closely together. In the case of Fortnite, several thefts corresponded to Russia.

While Auth0 has several Rules, all of which developers can use to customize and [extend Auth0's current suite of capabilities](https://auth0.com/b2c-customer-identity-management) to understand and protect end users, we've highlighted two particular ones below that growing video game companies can implement for better security as they scale.

These can be used separately or chained together for modular coding.

### User Fraud Score

The User Fraud score is particularly helpful in confirming that users are who they say they are and in quickly blocking those who are behaving inappropriately.

Auth0 has partnered with [Socure](https://www.socure.com/) to develop a user fraud score for each account that authenticates, based on their email address and IP address.

```javascript
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  const request = require('request');

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: configuration.SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    const socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

Socure incorporates information about individuals from social media, offline identity verification services, and publicly available data, to determine if an account is real or fake. While other vendors generally aggregate static points, such as a user's name, date of birth, and/or social security number, Socure + Auth0 focus on behavioral cues (e.g., how a user has transacted on other platforms, when, and from where; if they have a stable history; or if there are gaps and inconsistencies).

If a user has a high fraud score, you can put them on a watch list or require them to [provide additional information before they can transact](https://www.teampay.co/blog/finance-stack-startups/).

### minFraud (For Games with Payments)

In addition to rooting out suspect account logins and signups, minFraud helps secure your online marketplace by identifying possible fraud in online transactions.

The minFraud Rule will send the user’s IP address, email address, and username to MaxMind’s [minFraud API](https://dev.maxmind.com/minfraud/). Similar to the user fraud score, the API will return the risk score — but this time the focus is on the specific transaction (instead of the user as a whole).

```javascript
function (user, context, callback) {
  const querystring = require('querystring');
  const request = require('request');
  const crypto = require('crypto');

  const MINFRAUD_API = 'https://minfraud.maxmind.com/app/ccv2r';

  const data = {
    i: context.request.ip,
    user_agent: context.request.userAgent,
    license_key: configuration.MINFRAUD_LICENSE_KEY,
    emailMD5: user.email &&
        crypto.createHash('md5').update(user.email).digest("hex") || null,
    usernameMD5: user.username &&
        crypto.createHash('md5').update(user.username).digest("hex") || null
  };

  request.post(MINFRAUD_API, { form: data, timeout: 3000 }, (err, res, body) => {
    if (!err && res.statusCode === 200) {
      const result = querystring.parse(body, ';');

      console.log(`Fraud response: ${JSON.stringify(result, null, 2)}`);

      if (result.riskScore && (result.riskScore * 100) > 20) {
        return callback(new UnauthorizedError('Fraud prevention!'));
      }
    }

    if (err) {
      console.log(`Error while attempting fraud check: ${err.message}`);
    }
    if (res.statusCode !== 200) {
      const message = err && err.message;
      console.log(`Unexpected error while attempting fraud check: ${message}`);
    }

    // If the service is down, the request failed, or the result is OK just continue.
    return callback(null, user, context);
  });
}
```

MinFraud collects information from over [2 billion transactions](https://www.maxmind.com/en/minfraud-services) in its network. The tool assesses signs of fraud, such as

- suspicious pairings of user location with address and IIN data;
- risk associated with the IP address; and
- reputation checks for street addresses, email addresses, phone numbers, and devices.

In cases like _Fortnite_, minFraud could have helped the team block transactions that didn't meet standards for the above criteria, stopping theft from spreading throughout its network.

## Use Rules As Part of a Larger CIAM Strategy

Adding individual Rules that pertain to certain users on your platform is a step in the right direction. Setting up a comprehensive strategy for more deeply understanding all of your users is the next. Either [building or outsourcing](https://auth0.com/b2c-customer-identity-management) customer identity and access management solutions can bring a new dimension to your insights.

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

[Source](https://auth0.com/docs/getting-started/dashboard-overview)

With a well-crafted tool like a centralized dashboard (above), admins are afforded a bird's-eye view of all current and past activity. They can drill down into the granular details of each user, if need be, including when they joined the platform, their latest logins, and heaviest usage times. Admins can easily troubleshoot issues that arise by logging in as any user — or block access if they note multiple failed logins or excessive transactions.

As the threat landscape quickly evolves, particularly in fast-moving and highly technical spaces like gaming, coming up with solutions that are cutting edge and safe against the latest attacks can be enormously challenging — particularly for IT teams working 24/7 just to keep a game running. But taking time to consider and create a broad CIAM strategy, centered on end users, will make your game a safe space for competition for years to come.

<include src="asides/AboutAuth0" />


"gaming"