Abuse Protection
Map captcha
A code drawn on a map, handed to the player, to be copied before an account can be registered. A bot that speaks the protocol fluently still has to read a picture.
captcha:
enabled: false
# Characters in the code (3-8). Ambiguous ones (O/0, I/1/l) are never used.
length: 5
# Wrong answers before the connection is closed.
max-attempts: 3The code is typed back with /captcha <code>, and /register is refused until it is. It costs a real player one glance and stops the registration floods that fill a database with accounts nobody will ever use.
Connection limits
Two different limits, because they answer two different questions:
| Setting | Counts | Stops |
|---|---|---|
security.ip-rate-limit | Failed logins from one address | Somebody guessing at a player's password |
connection-limit.max-per-ip | Connections from one address, inside window seconds | A bot net cycling through names |
The second one is the one that was missing: a bot that registers rather than guesses never fails a login, so counting failures never sees it. Defaults are 6 connections per address per 60 seconds.