NEWS

[SR6] Sanity check: Hacking scenarios

  • 87 Replies
  • 13964 Views

penllawen

  • *
  • Omae
  • ***
  • Posts: 804
  • Let's go. In and out. Twenty minute milk run.
« Reply #45 on: <10-12-19/1610:11> »
Let me ask: Is it a problem a Decker can basically find anything that is located online in publicly accessable places, as long as they take their time for it? Basically, should this be foremost a matter of time and secondarily a matter of skill, or solely a matter of skill?
Yes, it's a problem, on several levels.

First of all, 10 hits on a legwork test is a very different result if deckers can do extended tests against it but everyone else is doing one-off tests against the same table. It makes deckers superpowered-unbalanced at legwork. It seems clear to me that different archetypes should be on an equal footing when rolling against that table.

In fact, let me go one stage further. A normal Legwork test is through a contact and rolls a dice pool of Connection Rating x2. Connection rating maxes out at 12, which is a "famous person who regularly shows up on the news." So Jonny Spinrad rolls 24 dice to find something out, but a mediocre decker rolls 90+ dice? Nope. Doesn't make sense.

Secondly, look at some of the descriptions of levels in the legwork test:

5 hits - Deep academic familiarity, strong professional knowledge, behind-the-scenes familiarity
6 hits - Knowledge of secrets and hidden information
7 hits - High-level information, solid understanding of history
8 hits - Almost encyclopedic knowledge, including some deep secrets
9 hits - Rare knowledge only available to a select few
10 hits - Deep secrets others actively try to hide

As you've argued recently:
The bigger your site, the more likely your employees have to interact with the outside. So almost everything will be online. And as for security systems: Most places cannot afford a spider, so one spider covers multiple locations, just following up on alarms and doing the occasional patrol.
Taken together, the idea that any decker with a mediocre dicepool and an hour to burn can turn up unlimited numbers of "deep secrets others actively try to hide" about basically anything -- because "almost everything will be online" -- is a bit game-breaking, no?





Plan_B

  • *
  • Newb
  • *
  • Posts: 43
« Reply #46 on: <10-12-19/1636:22> »
Assuming that 10 net hits on a Matrix Search will always yield full value on legwork is a bad assumption because it is assuming that such a level of information is actually available that way. Just because the scale goes that high does not mean the amount of information available is also that high. It is very possible, and reasonable, that the publicly available information on the Matrix is much, much lower. In fact, it should be unless the GM is, to be rather blunt about this, a complete idiot or exceptionally lazy and just wants to get to the part where the PCís shoot stuff.
When the "milk run" goes sour, it's time for Plan B!

penllawen

  • *
  • Omae
  • ***
  • Posts: 804
  • Let's go. In and out. Twenty minute milk run.
« Reply #47 on: <10-12-19/1642:36> »
Assuming that 10 net hits on a Matrix Search will always yield full value on legwork is a bad assumption because it is assuming that such a level of information is actually available that way.
Should 10 hits on a legwork roll via the Matrix turn up the same value of information as 10 hits on a legwork roll via a contact?

I submit they should.

And the way to fix this is to not have deckers rolling 10x more legwork dice than other game mechanics. Itís clearly out of kilter with the rest of the game.

Plan_B

  • *
  • Newb
  • *
  • Posts: 43
« Reply #48 on: <10-12-19/1655:52> »
ďWe have this super secret site where we do really sketchy stuff, so letís put all of our information out there for any skilled computer user to find in an hour and take advantage of because this is a really good ideaĒ said no exec ever. Even the dumbest of low level managers is smart enough to know this is idiotic. Just because the scale goes that high does not mean that the publicly available information also goes that high. This is, quite honestly, only a problem if you want it to be a problem. A far more reasonable person will just acknowledge that no matter how good the hacker is, they arenít going to find any real information about alien space ships at Area 51 on the Internet because Area 51ís most important information isnít even ON the Internet. Non-existent problem solved!
When the "milk run" goes sour, it's time for Plan B!

Banshee

  • *
  • Catalyst Demo Team
  • Ace Runner
  • ***
  • Posts: 1092
« Reply #49 on: <10-12-19/1659:29> »
Assuming that 10 net hits on a Matrix Search will always yield full value on legwork is a bad assumption because it is assuming that such a level of information is actually available that way.
Should 10 hits on a legwork roll via the Matrix turn up the same value of information as 10 hits on a legwork roll via a contact?

I submit they should.

And the way to fix this is to not have deckers rolling 10x more legwork dice than other game mechanics. It’s clearly out of kilter with the rest of the game.

I would say absolutely not, a matrix search should never be a simple replacement for legwork. It should only augment legwork. A matrix search doesn't represent much more than a Google search which can uncover quite a bit, but is still no replacement for actually talking to people. There should always be information that is not available online. That's why published legwork tables have different thresholds for different information and not all of it is available via the matrix

EDIT: also to add..  getting deep dark secrets from the matrix should be a matrix run involving getting inside a defended host and  not a search at all
« Last Edit: <10-12-19/1705:48> by Banshee »
Robert "Banshee" Volbrecht
Freelancer & FAQ Committee member
Former RPG Lead Agent
Catalyst Demo Team

Plan_B

  • *
  • Newb
  • *
  • Posts: 43
« Reply #50 on: <10-12-19/1704:40> »
Beyond the silliness of assuming such high level information is out there just to grab easy as you please, there is also an assumption here that the GM will let you just keep buying hits. The roll has meaningful consequences to the outcome of the game. It is not one that should get free hits. This is a check that absolutely should be rolled to its conclusion. At some point, if you keep digging, youíre going to risk screwing it up badly and that is also a meaningful consequence. There are far more reasons to require rolls than to just give away all the secrets. Any GM who does that is either inexperienced, lazy, or stupid.
When the "milk run" goes sour, it's time for Plan B!

Michael Chandra

  • *
  • Catalyst Demo Team
  • Prime Runner
  • ***
  • Posts: 9901
  • Question-slicing ninja
« Reply #51 on: <10-12-19/1715:58> »
Matrix Search itself notes it only applies to information that is available on "the publicly accessible grid". When a Contact rolls, they're not accessing publicly accessible info only, they have knowledge from gossip, rumors, etc.

So sure, at 8 hits when it's public info your Decker will get more info than your contact may know at 6 hits, but if it's not in public their 8 hits won't get them the info while the contact can.

In SR5, thresholds were different between Contacts and Matrix Search, while some info was never available through Matrix Search. (See SRMs Legwork tables as example.) In 6w, maybe the thresholds might be pretty much the same (as indicated by 'Use the Legwork Results table (p. 50) as a general guideline for what is uncovered'), but some info still will not be findable in the Matrix. So if it's public info, the Decker can get you more stuff even if it takes a bit longer, but once it's not public anymore the Contacts really shine.

@Plan_B: If you have 13 base dice, I don't think 10 hits comes with a significant risk. First roll roughly 1/400, second 1/800, third 1/200... That's less than 1/100 chance you glitch during 3 rolls on an Extended Legwork test, vs 1/500 chance of not scoring 10+ hits. So I agree the GM can require rolls, but I think there's more value in doing so for the impact on the game clock, rather than actually mattering for glitch-chances.

A case where the clock matters: Our Decker scored 9 hits with a full reroll in 1 roll, allowing us to obtain critical info for a choice we had to make within 15 minutes.
How am I not part of the forum?? O_O I am both active and angry!

Xenon

  • *
  • Prime Runner
  • *****
  • Posts: 6457
« Reply #52 on: <10-12-19/1741:39> »
Is it a problem a Decker can basically find anything that is located online in publicly accessable places, as long as they take their time for it?
Yes, I think it is (depending on what you mean with 'publicly accessible').

A character that just have a budget commlink and a few points in electronics (for example a total dice pool of 10 dice or so) should probably automatically find general knowledge or public information.

Even if it might not be totally impossible, the same character should probably have a rather hard time finding limited information such as whispers of gossip or professional knowledge that is not publicized.

The same character should probably not even have a chance at all to find deeply hidden secret information that perhaps only a select few know about or is actively being erased from the matrix.

I liked this

(and this was also how matrix search played out in SR5 and how it would be played out in SR6 if Matrix Search was just a simple test with a duration of 10 minutes).

However, if matrix search is treated as an extended test with a zero threshold then even someone with such a small dice pool as 10 dice will pretty much automatically find deeply hidden secret information that perhaps only a select few know about or is actively being erased from the matrix.

Every. Single. Time. In less than an hour and a half.

I don't like this.
« Last Edit: <10-12-19/1756:08> by Xenon »

Banshee

  • *
  • Catalyst Demo Team
  • Ace Runner
  • ***
  • Posts: 1092
« Reply #53 on: <10-12-19/1759:38> »
Is it a problem a Decker can basically find anything that is located online in publicly accessable places, as long as they take their time for it?
Yes, I think it is (depending on what you mean with 'publicly accessible').

A character that just have a budget commlink and a few points in electronics (for example a total dice pool of 10 dice or so) should probably automatically find general knowledge or public information.

Even if it might not be totally impossible, the same character should probably have a rather hard time finding limited, secret or hidden information that is not publicized.

The same character should probably not even have a chance at all to find deeply hidden secret information that only a select few know about and that is actively being erased from the matrix.

I liked this

(and this was also how matrix search played out in SR5 and how it would be played out in SR6 if Matrix Search was just a simple test with a duration of 10 minutes).



However, if matrix search is treated as an extended test with a zero threshold then even someone with such a small dice pool as 10 dice will pretty much automatically find deeply hidden secret information that only a select few know about and that is actively being erased from the matrix.

Every. Single. Time. In less than an hour and a half.

I don't like this.

No ... not really. If it is a deep dark secret that has been erased from matrix you could perform a matrix search for years and never find it. A search will never find anything that has been deleted or hidden behind any kind of firewall out of the public realm ... that is what electronic forensics and hacking are for

Just one example... you may be able to see things find out about a person from social media post or public matrix posts but unless you hack them you would not ever gain access to their private text messages
Robert "Banshee" Volbrecht
Freelancer & FAQ Committee member
Former RPG Lead Agent
Catalyst Demo Team

ZeroSum

  • *
  • Omae
  • ***
  • Posts: 401
« Reply #54 on: <10-12-19/1815:37> »
@All
In an effort to moderate this thread a little and to avoid having the discussion just go in circles, I'm going to start a separate thread on Matrix Search, because I have many thoughts and scenarios I'd like to run through. I also have several points of reference from previous and current editions I'd like to bring up and get your thoughts on.

For now, let's agree that the definition of what is publically available information is entirely up to the GM, and that Matrix Search as written is more about how long rather than if at all it will take a PC to find public information.

I would greatly appreciate it if you would kindly direct your attention back to scenario 2 while I type up my thoughts on Matrix Search in a separate thread.

Xenon

  • *
  • Prime Runner
  • *****
  • Posts: 6457
« Reply #55 on: <10-13-19/0514:41> »
Not at book but to turn augmentation that are connected via neutral interface (not to be confused with DNI) used to be a free action, and in this edition it is probably a minor (probably the Switch Device Mode Anytime Action).
I read it as if turning on cyberware (such as your cybereyes, at least cyberware that is directly connected to your nervous system) is a Minor action. Note that the device will probably not come back on-line until at the end of the following combat turn (as per the Reboot Device action). It also seem to be a Minor action to disable wireless in a device that you are linked to via DNI:

SR6 p. 41 Minor Actions - Change Device Mode (A)
A character may use a Minor Action to activate, deactivate, or switch the mode on any device that they are linked to by a direct neural interface, be it a wired or wireless link. This includes activating or deactivating cyberware, changing a smartgun’s firing settings, switching a commlink to hidden mode, turning a device’s wireless functionality off, and so on.



Turn on a device (such as a pair of smart goggles) seem to be a Major action (DNI can't really help you here since the device is currently offline, you need to manually press the on-switch). Note that the device will probably not come on-line until the end of the following combat turn (as per the Reboot Device action). It also seem to be a Major action to disable wireless in a device in case you don't have DNI:

SR6 p. 44 Use Simple Action
A character can use any simple device with a Major Action. Simple devices are those that are activated with a simple movement like a thumb trigger, pressing a single key, or tapping a single icon.
It takes longer to interact with more complex devices, with required time being up to the gamemaster or listed with the description of specific gear.
Remember, a device connected via a DNI-enabled system uses the Minor Action.




To actually reboot a device that you are the legit owner of or if you have Admin access to seem to be the Legal Reboot Device Major Matrix Action (no matter if you have DNI or not) and also note that the device will not come back on-line until the earliest at the end of the following combat turn. In previous edition this action also mentioned that it was used for just shutting down a device - and also when taking this action you could also decide when the device (or your living persona) should boot up.

SR6 p. 183 Reboot Device
The target device shuts down and immediately reboots. The device comes back online at the end of the following combat round. The device ceases electronic functions and disappears from the Matrix until its reboot time is over.
« Last Edit: <10-13-19/0532:41> by Xenon »

DigitalZombie

  • *
  • Omae
  • ***
  • Posts: 744
« Reply #56 on: <10-13-19/1003:33> »


Assumption 2: The cybereyes are slaved to the samurai's PAN, and are Rating 4.
While not explicitly specified, we can (safely?) assume that the Rating of the eyes are equal to their Device Rating, which is used to determine their Matrix Condition Monitor. In this case, DR/2 + 8, for 10.





Scenario 2.1: Raw Matrix Damage
Turn 1:
Major Action: Data Spike
Major Action: Data Spike

Result: The Matrix attributes of the hacker will determine Matrix damage. The cheapest deck has A/F 4/3 while the most expensive is 9/8, and base DV is Attack/2 so base DV will range from 2 to 5. Causing enough damage to brick the device in a single attack is mathematically improbable; modified DV would need to be 11+ in order for enough damage to be inflicted assuming a Willpower of 3 for one probable success on the damage resist test. This means you would need 6+ net hits on the attack test.



I think the Damage is a lot higher. Dataspike Damage is Attack rating/2 round Up.
Attack rating = Attack+Sleaze.

So its not your Attack Attribute, but your Attack rating ( which partly consists og your Attack Attribute) that determines your Damage value.

So its between 4 and 9.

Regarding the First part of the quoted text. Where do I find the rules for PAN granting firewall and DP processing ratings to my slaved gear? I feel like Ive made a critical glitch on my search check :/

Edit: Spelling errors
« Last Edit: <10-13-19/1028:52> by DigitalZombie »

ZeroSum

  • *
  • Omae
  • ***
  • Posts: 401
« Reply #57 on: <10-13-19/1008:35> »
I think the Damage is a lot higher. Dataspike Damage is Attack rating/2 round Up.
Attack rating = Attack+Sleaze.

So its not your Attack Attribute, but your Attack rating ( which partly consists og your Attack Attribute) that determines your Damage value.

So its between 4 and 9.
Wow, you are right about RAW. That doesn't quite jive with page 174, however:
Quote from: SR6 p.174, Personas and Attributes
Attack represents the offensive power of the device in cybercombat and how much damage it can do when attacking.

But you're 100% correct, the rule for Data Spike does specify "Attack Rating/2". That... is wild.

EDIT:
@Banshee Can you comment on this?
There are no examples for Data Spike, but it seems unlikely that the intent was for Data Spike DV to be (Attack+Sleaze)/2 as opposed to (Attack)/2, but the way this is worded straight up says "Attack Rating", not "Attack attribute" or "Attack Rank".

This has pretty significant consequences. Assuming the default A/S values for the available cyberdecks, your BASE Matrix DV with Data Spike is:
Erika MCD-6: A/S 4/3, Attack Rating 7, base DV 4
Spinrad Falcon: A/S 5/4, Attack Rating 9, base DV 5
MCT 360: A/S 6/5, Attack Rating 11, base DV 6
Renraku Kitsune: A/S 7/6, Attack Rating 13, base DV 7
Shiawase Cyber-6: A/S 8/7, Attack Rating 15, base DV 8
Fairlight Excalibur: A/S 9/8, Attack Rating 17, base DV 9

In other words, the higher end decks are likely to be able to take out most generic devices (Condition Monitor 8 + (Device Rating / 2) = range of 9-13) in a single Data Spike Attack. Add Fork to the mix and you're bricking two different devices with a single attack action.

This seems wildly disproportionate to physical combat, where DV values (other than explosives, rockets/missiles, and grenades) range from 2P to 6P.

Regarding the First part of the quoted text. Ejere do I find the rules for PAN granting firewall and DP processing ratings to my slaver gear? I feel like Ive made a critical glitch on my search check :/

Page 174:
Quote
Most people access the Matrix through a device. Nowadays, everyone has a commlink, a pocket-sized smart device that interfaces with the Matrix at large. Some are integrated into glasses, or even fully into cybernetic augmentation, while others still have the familiar handheld screen look. They are used for rudimentary access, most commonly for commcalls and searches, as well as basic Matrix Firewall defense for devices attached to the user’s PAN.
« Last Edit: <10-13-19/1020:04> by ZeroSum »

DigitalZombie

  • *
  • Omae
  • ***
  • Posts: 744
« Reply #58 on: <10-13-19/1024:55> »


Page 174:
Quote
Most people access the Matrix through a device. Nowadays, everyone has a commlink, a pocket-sized smart device that interfaces with the Matrix at large. Some are integrated into glasses, or even fully into cybernetic augmentation, while others still have the familiar handheld screen look. They are used for rudimentary access, most commonly for commcalls and searches, as well as basic Matrix Firewall defense for devices attached to the userís PAN.

Aah. Thanks, must have skimmed that part 2 og 3 times already :)

Banshee

  • *
  • Catalyst Demo Team
  • Ace Runner
  • ***
  • Posts: 1092
« Reply #59 on: <10-13-19/1056:29> »
Good catch on the data spike damage. That's a holdover typo, we had not settled on calling it attack rating at that point ... it is based on the attack attribute only. I will submit the change, thanks!!
Robert "Banshee" Volbrecht
Freelancer & FAQ Committee member
Former RPG Lead Agent
Catalyst Demo Team