Gaslight, Gatekeep, Girlboss: Breaking Minecraft's Decentralised Chat Reporting System (gpn24)

Minecraft servers have always been decentralised, but in 2022 Mojang attempted to roll out a chat reporting system. Without the ability to trust either the client or the server, this turned out to be very difficult to get right. Over the next 6 months, we were in a cycle of Mojang releasing an update, and us dropping an exploit. In all we dropped 7 exploits, and there were a couple more found by others. This talk covers the context behind the system, how the exploits worked, how Mojang tried to patch them, the community response, and why the system is still broken today, and a new exploit I discovered while writing the talk. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://cfp.gulas.ch/gpn24/talk/MJMUCB/