Proposal: VAC 2.0 with TPM/CPUID/GPUID Bans and Offline LTO Tape Storage – Detailed Analysis and Impact
Hey CS2 community, I’d like to propose a detailed overhaul of Valve’s VAC system—VAC 2.0—using TPM, CPUID, and GPUID for hardware-based bans, with data stored on offline LTO tapes. This could reduce cheaters and bring back players lost to cheating. Here’s the breakdown.

Implementation Details
    HWID Collection: VAC 2.0 would use a kernel-level anticheat to read TPM, CPUID, and GPUID on first launch. These are unique identifiers (TPM is a chip ID, CPUID is in the processor, GPUID in firmware). Data would be hashed (SHA-256) locally, linked to Steam ID, with an opt-in for official matchmaking. Non-consent restricts to unverified servers.LTO Tape Storage: Hashed data would be archived daily on LTO-9 tapes (18 TB each) in an offline vault with biometric access. ~40 GB daily for 500M users (200 bytes/user, compressed 2.5:1) fits one tape. Access is manual for ban verification.Detection and Banning: AI would match HWID with behavior (e.g., aim precision) to flag cheaters. Confirmed cases get a permanent HWID ban across Steam accounts. Appeals need hardware replacement proof.Legal/Ethical: GDPR-compliant with hashed data only, opt-out to unverified servers, and public documentation for transparency.

Effectiveness Analysis
  • Spoofing is hard: TPM needs chip swap (~$50–$100), CPUID requires CPU change (~$100–$500), GPUID risks damage with new GPU (~$200+). Combined difficulty is 8–9/10, tougher than current tools.

  • Impact: Casual cheaters (majority) would drop out, reducing cheaters by 70–85%. Pros might use unverified servers or new hardware, but few in number.

  • Retention: CS2 lost players (1.5M peak in 2023 to 1.2M in 2025 per SteamDB). Reclaiming 10% (120,000) with a “cheat-free” mode could boost activity.

Financial Impact
  • Revenue from Returns: 120,000 returning players, 20% buying skins ($5 each) = $120,000 initially. With retention, $500,000–$1M/year. Skins hit $1B+ in CS:GO.

  • Cheater vs. Skin Buyers: Cheater accounts (~500,000 bans × $5) = $1M–$2M/year, but lose legit players. Skin buyers (10% of 1.2M = 120,000 × $20/year) = $2.4M+, with returns adding more. One skin-buyer is 4–8x more profitable.

  • Cost vs. Gain: Development (~$1M–$2M for VAC 2.0/LTO) recouped in 1–2 years via skin sales and ads.

Conclusion
VAC 2.0 could cut cheaters by 70–85%, regain trust, and boost revenue ($2M+ via skins vs. $1M–$2M from cheaters).
A pilot “Verified Matchmaking” mode could test it. What do you think—support, tweak, or ditch?
Last edited by NOBODY KNOWS; 18 Jul @ 4:42pm
< >
Showing 1-15 of 28 comments
Build it and they will come....
Frequens 18 Jul @ 5:10pm 
What the cinnamon toast ♥♥♥♥ are you going on about??

If you seriously think intrusion by literal malware and biometric identification systems would somehow ring in a new era of cheater-free environments flooded with returning players, then you are so deluded you should be on medication!
https://steamhost.cn/steamcommunity_com/discussions/forum/search/?gidforum=882959061469925793&include_deleted=1&q=HWID+bans

Search before making threads HWIIDs can be spoofed.


AND


Valve cannot fix people.

https://steamhost.cn/steamcommunity_com/discussions/forum/9/4846392474904201492/#c4846392474904308685

#FixSociety

Until you eradicate the human predilection to gain any advantage at any cost, there will always be cheaters, liars and thieves.

Cheating and catching cheaters in any online game is always a game of cat and mouse that never ends.
@C²C^Guyver |NZB|

Thanks for your input! I acknowledge that HWID like disk serials or MAC addresses can be spoofed with relative ease using existing tools. However, TPM (Trusted Platform Module), CPUID (processor ID), and GPUID (graphics card ID) present a higher barrier. These identifiers are embedded at a hardware level—TPM via a cryptographic chip, CPUID within the processor’s firmware, and GPUID in the graphics card’s firmware—making alteration extremely challenging. Spoofing them requires physical chip replacement or firmware modification, costing ~$50–$500 per component, with a combined difficulty rated 8–9/10 due to the need for specialized tools and expertise, far exceeding current spoofing methods (e.g., disk ID changers).

Regarding human nature, I concur that Valve cannot eradicate the inclination to cheat (#FixSociety), as this is an ongoing cat-and-mouse dynamic in online gaming. VAC 2.0 isn’t designed to eliminate cheating entirely but to reduce it by 70–85% by deterring casual cheaters through cost and complexity, while pros may shift to unverified servers. The LTO (Linear Tape-Open) storage solution enhances security by archiving hashed HWID data (e.g., SHA-256) offline on 18 TB LTO-9 tapes, mitigating online breach risks with manual access only.
Originally posted by NOBODY KNOWS:

Conclusion
VAC 2.0 could cut cheaters by 70–85%, regain trust, and boost revenue ($2M+ via skins vs. $1M–$2M from cheaters).
A pilot “Verified Matchmaking” mode could test it. What do you think—support, tweak, or ditch?
So, I'm guessing you just pulled percentages outta your rear?
I would vote No on this proposal. Even though I dislike people cheating on games however, the proposal would violate many laws on privacy and consumer acts as hardware/PC are what you own. Steam doesn't own your PC therefore cannot be legal to "hijacked" your PC for online gaming.

Installing software that affects the device/PC/Phone and etc is a personal decision. A business cannot control those devices that you personally own.
Last edited by whole9yard; 18 Jul @ 5:17pm
Originally posted by NOBODY KNOWS:
@C²C^Guyver |NZB|

Thanks for your input! I acknowledge that HWID like disk serials or MAC addresses can be spoofed with relative ease using existing tools. However, TPM (Trusted Platform Module), CPUID (processor ID), and GPUID (graphics card ID) present a higher barrier. These identifiers are embedded at a hardware level—TPM via a cryptographic chip, CPUID within the processor’s firmware, and GPUID in the graphics card’s firmware—making alteration extremely challenging. Spoofing them requires physical chip replacement or firmware modification, costing ~$50–$500 per component, with a combined difficulty rated 8–9/10 due to the need for specialized tools and expertise, far exceeding current spoofing methods (e.g., disk ID changers).

Regarding human nature, I concur that Valve cannot eradicate the inclination to cheat (#FixSociety), as this is an ongoing cat-and-mouse dynamic in online gaming. VAC 2.0 isn’t designed to eliminate cheating entirely but to reduce it by 70–85% by deterring casual cheaters through cost and complexity, while pros may shift to unverified servers. The LTO (Linear Tape-Open) storage solution enhances security by archiving hashed HWID data (e.g., SHA-256) offline on 18 TB LTO-9 tapes, mitigating online breach risks with manual access only.
You don't need to buy new hardware, There are literally programs that will generate new ID's

Do you know anything about this? lol
Thanks, whole9yard, for your No vote and privacy concerns! I understand—your PC is your property, and Steam shouldn’t overstep. VAC 2.0 uses a kernel-level anticheat to read only TPM/CPUID/GPUID (hashed locally via SHA-256), which are hardware IDs, not your files or PC content. It’s opt-in for “Verified Matchmaking”; non-consent restricts you to unverified servers, preserving choice. GDPR-compliant with offline LTO storage, it limits data access to hashes, avoiding “hijacking.” Legal reviews will ensure compliance.
You REALLY need to stop making percentages up.........
Thanks, C²C^Guyver |NZB|, for chiming in! I get your point—some programs spoof disk/MAC IDs, but TPM/CPUID/GPUID aren’t the same. These are hardware-level IDs: TPM is a secure chip (isolated by design), CPUID is in processor firmware, GPUID in graphics firmware. Software like HWID changers can’t alter them—tests show they fail (e.g., no access to TPM’s cryptographic root). Physical swaps (~$50–$500) or risky firmware hacks are needed,
Originally posted by NOBODY KNOWS:
Thanks, whole9yard, for your No vote and privacy concerns! I understand—your PC is your property, and Steam shouldn’t overstep. VAC 2.0 uses a kernel-level anticheat to read only TPM/CPUID/GPUID (hashed locally via SHA-256), which are hardware IDs, not your files or PC content. It’s opt-in for “Verified Matchmaking”; non-consent restricts you to unverified servers, preserving choice. GDPR-compliant with offline LTO storage, it limits data access to hashes, avoiding “hijacking.” Legal reviews will ensure compliance.
The only way account are hijacked is when user give away the account login info.
Originally posted by NOBODY KNOWS:
Thanks, C²C^Guyver |NZB|, for chiming in! I get your point—some programs spoof disk/MAC IDs, but TPM/CPUID/GPUID aren’t the same. These are hardware-level IDs: TPM is a secure chip (isolated by design), CPUID is in processor firmware, GPUID in graphics firmware. Software like HWID changers can’t alter them—tests show they fail (e.g., no access to TPM’s cryptographic root). Physical swaps (~$50–$500) or risky firmware hacks are needed,
Are you also aware that you're posting this nonsense on user based forums? Valve is not here. We're all Steam users, just like you.
You’re correct—account hijacking typically needs login info, not VAC 2.0. This focuses on reading TPM/CPUID/GPUID (hardware IDs, hashed via SHA-256) to block cheaters, not access accounts.
True, Valve isn’t here directly, but we’re all Steam users driving change. High engagement on these forums—likes, comments—can flag this to Valve’s team, who monitor trends.
Originally posted by NOBODY KNOWS:
You’re correct—account hijacking typically needs login info, not VAC 2.0. This focuses on reading TPM/CPUID/GPUID (hardware IDs, hashed via SHA-256) to block cheaters, not access accounts.
There's nothing typical about it....that is the ONLY way accounts are hijacked.
< >
Showing 1-15 of 28 comments
Per page: 1530 50