Answers.Body: <p>I'm a chess player and programmer. There was actually a paper on this 10 years ago about the timestamp and other security on ICC. You should read it with the understanding that things may be different now:</p>
  
  <p><a href="https://eprint.iacr.org/2004/203.pdf">How to Cheat at Chess:
  A Security Analysis of the Internet Chess Club</a></p>
  
  <p>But in general, you are correct. It is possible to manipulate the times reported in timeseal (timestamp). I've actually done it, even with ICC's official interface, just to see if it can be done. Speed hacks exist for many games and I used an existing speed hack program to slow down my clock instead of speeding it up (which you normally would do to run faster in a game). The result was a game I played vs KBNK (a bot which lets you practice B+N mate), in which I mated the computer after about 30 moves in less than 3 seconds played time. Averaging 0.1 seconds per move or so on a non-trivial mate is definitely unnatural.</p>
  
  <p>I reported the effect to the administrators of the site, but I was told they were able to detect it. In fact, they had a log of my fraudulent time stamps detected (somewhere... I assume they can see blatant false reports, as well as compare it to TCP/IP timestamps and see if the numbers are reasonable). I was told that they were able to detect such cheating and to please not use it but thanks for my concern.</p>
  
  <p>So, yes it is possible to manipulate anything client side, but it is also possible that they can detect fraudulent time stamps server side. Better chess servers typically already have a team of people that investigate reports of cheating, either by computer or clock manipulation. </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-05-19T21:15:42.700Z
Answers.Text: thx - that paper mainly descibes what i was looking for.
Answers.UserDisplayName: Simon Meyer
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2014-05-19T15:59:20.127Z
Answers.LastActivityDate: 2014-05-19T15:59:20.127Z
Answers.UserDisplayName: Alan
Body: <p>I know the the fics (free internet chess server: www.freechess.org/) does use a program called timeseal to measure the time that a user needed to take a move. This timeseal is some time measurement on the client. Measuring on the client is much better and fairer than measuring the time on the server since you don't lose time just by having a bad connection. </p>
  
  <p>But since fics has a lot of interfaces to play on - what prevents rogue interfaces to say that they always only used 0.1 seconds for any move? Does anyone know how this is handled?</p>
  
  <p>Just a sidenote: i don't want to build a rogue interface, but i'm trying to build something similar that is measuing client side time but should not be easy to cheat on.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2014-05-19T14:21:40.603Z
Comments.Text: This is probably a question better asked on a programming exchange, since it's not really chess-specific, even if *this implementation* is. At a guess, there's some form of obfuscation used, since you can't encrypt the workings in memory without having the key *somewhere* on the client. (Or you could have it reside on the server, but then that totally defeats the point of client-side operations...)
Comments.UserDisplayName: Jonathan Garber
Tags: <chess-algorithms>
Title: How does timeseal work?
ThreadText: # How does timeseal work?
  
  (Asked by: username_0 on 2014-05-19)
  
  I know the the fics (free internet chess server: www.freechess.org/) does use a program called timeseal to measure the time that a user needed to take a move. This timeseal is some time measurement on the client. Measuring on the client is much better and fairer than measuring the time on the server since you don't lose time just by having a bad connection.
  
  But since fics has a lot of interfaces to play on - what prevents rogue interfaces to say that they always only used 0.1 seconds for any move? Does anyone know how this is handled?
  
  Just a sidenote: i don't want to build a rogue interface, but i'm trying to build something similar that is measuing client side time but should not be easy to cheat on.
  
  **Tags:** chess-algorithms
  
  > **Comments:**
  > **username_1**: This is probably a question better asked on a programming exchange, since it's not really chess-specific, even if *this implementation* is. At a guess, there's some form of obfuscation used, since you can't encrypt the workings in memory without having the key *somewhere* on the client. (Or you could have it reside on the server, but then that totally defeats the point of client-side operations...)  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2014-05-19. Score: 13 | Accepted answer
  
  I'm a chess player and programmer. There was actually a paper on this 10 years ago about the timestamp and other security on ICC. You should read it with the understanding that things may be different now:
  
  [How to Cheat at Chess:
  A Security Analysis of the Internet Chess Club](https://eprint.iacr.org/2004/203.pdf)
  
  But in general, you are correct. It is possible to manipulate the times reported in timeseal (timestamp). I've actually done it, even with ICC's official interface, just to see if it can be done. Speed hacks exist for many games and I used an existing speed hack program to slow down my clock instead of speeding it up (which you normally would do to run faster in a game). The result was a game I played vs KBNK (a bot which lets you practice B+N mate), in which I mated the computer after about 30 moves in less than 3 seconds played time. Averaging 0.1 seconds per move or so on a non-trivial mate is definitely unnatural.
  
  I reported the effect to the administrators of the site, but I was told they were able to detect it. In fact, they had a log of my fraudulent time stamps detected (somewhere... I assume they can see blatant false reports, as well as compare it to TCP/IP timestamps and see if the numbers are reasonable). I was told that they were able to detect such cheating and to please not use it but thanks for my concern.
  
  So, yes it is possible to manipulate anything client side, but it is also possible that they can detect fraudulent time stamps server side. Better chess servers typically already have a team of people that investigate reports of cheating, either by computer or clock manipulation.
  
  > **Comments:**
  > **username_0**: thx - that paper mainly descibes what i was looking for.  
  
  ---
  
  