Flight Arrival Lag/Exploit

14:36:22 - 14/04/2021 You boarded a 0h 17m private flight from Cayman Islands to Torn
14:53:26 - 14/04/2021 Spliffy mugged you (with 2 others) for $1,603,470,351 sending you to hospital for 0h 39m

https://www.torn.com/loader.php?sid=attackLog&ID=a5cf98a28752e21917ec1f41331d60d2

1) The javascript timer does not start counting down until the page is fully loaded, inducing a 1-2 second delay on the timer.
2) There is a forced page reload upon the completion of the timer that is unable to be bypassed further adding a 1-2 second page load delay before a flier is able to interact with the tc website.

These series of delays provide a window from which it is impossible for a flier to interact with the torn website, while a prospective mugger is able to attack and steal money from players.

This issue is present on both flying to and from TC.

In my specific example, my browser refreshed me into the hospital without even presenting me with a normal unhospitalized index.php.

This issue presents an unfair and exploitable form of lag that can be abused to steal money from players that would be otherwise unable to be mugged.

As a side note, this is further exacerbated by the requirement of CAPTCHAs prior to being able to interact with the TC website after flying to some locations. Specifically switzerland when flying to rehab.

Possible fixes for the issue would be to:

A) Implement a X second timer after a flight where which the player can not be attacked
B) Do not clear the "flying" status on a player until after the /index.php has been loaded post flight.

Ideally, to be most fair to both attackers and fliers, the flying flag should be removed on "index.php load" OR "60 seconds", whichever comes first.

That provides an acceptable amount of time for a player to respond to a captcha and it will allow attackers the ability to attack as soon as the flier is able to interact with the website themselves.

The issue of "who has the fastest internet connection" is still in play here, but at least the attacker would not have a 2-6 second advantage due to required page loads.

add a 5 -10 sec protection when people land and call it security controll, to counter page load , captcha and such. it really is bad when people sitting in torn can attack you earlier just becouse you need to load a new page and the guy in torn dosent.


like anything over that amount of time is fair game imo, and we can stop this mugg rant couse now everybody have a fair chance

This is true, but this particular issue also impacts those that choose to fly to SA for xanax runs. They can get mugged before they even make it past the captcha. Or someone can get mugged in Switzerland before they make it through the captcha.

Just keep refreshing the page and mug new arrivals before they can complete the captcha to take their money on a smaller scale.

Also, regardless of the popularity of the problem currently. Dumping all my cash into a stock or vault within 2-3 seconds of landing IS possible, just like it is also possible that I can get mugged in the same time-frame. It is a race against the clock. My report was an attempt to outline a long standing issue that has been exacerbated due to the mas exodus of funds from the caimans before your April 20th fee deadline.

It takes 4 clicks to go from /index.php to dump my cash into stocks(even less to dump into vault). I click on my Nav bar stock icon, then the first stock, then "purchase", confirm. If I was on equal footing with an attacker, it really is a race to see who nails it first. There is no typing required by either party, just a couple mouse clicks on parts of the screen.

Currently, attackers/muggers have a nearly 2-3 second head start on fliers due to the fact that at least 1 full page reload is required after fliers land before they permitted to interact with the TC site to try and stash their funds. Attackers spam refreshing someone's profile do not suffer this same impact. In fact, given the caching enabled on the TC site, their refreshes are actually faster when bench-marked against the full reload of /index.php after flying.

Given that use of the API is allowing other users to target me explicitly during that 2-3 second window when I have no ability to do anything is problematic.

I am in the top 1000 published player list of high net worth. Anyone using the API to monitor other players for mugging would be smart to monitor those publicly listed players. Does that mean that I will forever need to pay a mugging tax if I ever want to take large amounts of money anywhere?

These instances are not isolated cases where some user walked away from the computer and got mugged. I was actively trying to refresh my page to stash my cash but was completely unable to compete against the attacker due to the required page load after landing.

Seems to me a simple 15 minute API delay like on the stock market would do the trick. Then the muggers would have a WAY bigger refresh window of the player arriving. Going from 2 minutes to 17 minutes.

as things stand, at such a disadvantage, features can't be used as intended.

people are better off not using the bank.

some won't know that they could not have done anything to prevent it happening.

it is a pretty big bug if it is as op describes. i personally don't use or mug there.

i dont think that would solve it.

This would just mean muggers need to refresh for a longer period. but do have a guarenteed mug if they do take that effort.
In most cases looking at the last action taken (manually) by a person, would also render this useless. since it would give a smaller estimate of landing time.
Increasing the variance on flight times would probably be more effective than delaying the api. (but i also think this wouldnt help overal)

Somehow fixing the issue (no idea how) of the 4 second window when someone/a flier can't interact (as stated by the OP) and muggers can, would be a better solution

i do think this needs to be adressed, but don't think an api delay is the solution.

I landed, was watching home screen during flight on non refreshed page, as timer was at 1 second on travel screen, I was being attacked on 2nd display showing home page. They don't even have to win the fight to lock you down, they just have to start it. Physically impossible to react, I understand Cayman is known for this. But 40b+ mugged in a week while utilizing this, seems unfair.

Until the API creator took that 15 minutes delay into account and just offset the differences with a simple formula update...

The difference between landing time and stock market API delay is that stock market is unpredictable, landing time is not.

There are many options--I advocated a larger solution in a different thread, but with regard to delay: we could let the flyer add a small amount of time to their flight, if they're landing at a private airstrip. Us plebes who fly commercial can't dictate to the pilot: "let's circle around one more time, just in case". Then the attackers have to spam/click the attack button and suffer some internet-reload delay.

how about.... instead of a 15 minute delay, have the API update (for certain stats) on the 15 minute mark (similar to market refills). Anything from 00:00:01 to 00:14:59 updates at 00:15:00, this will introduce a certain amount of "randomness" to predicting arrival times

All of the solutions mentioned so far are rather complicated and would likely require an entirely new mechanic in order to even work. That is not fair to ask Ched for in a bug thread.

I am not after any sort of temporary immunity, new game mechanics, or reversal of the situation. I am after a "fighting chance", that's all. Restricting the ability to attack until after index.php has been reloaded or timed out provides that fighting chance. No more, No Less.

Personally, I am all for the cat/mouse game between those with tons of cash and those who want to take it all away.

My only issue, and the issue for which I opened the bug report, is that the cat and mouse game is currently heavily weighted towards the cat right now. Between all the mugging merits and mugging bonuses, now the API and scripted mugging.... This whole mechanic is out of whack. I can't even start to stash my cash until at least a full 2-3 seconds after I have ALREADY been attacked.

Now, instead of being happy about the stocks 3.0, I am pissed that someone took nearly 1 year worth of my account's efforts and I didn't even have a fighting chance to stop it.

This entire mechanic is out of whack. Now we have a massively one sided cash grab that has completely turned me off of any potential bonuses due to stocks 3.0.

problems arise when you dont get to even refresh another tab when land timer hits 0 and you are already mugged; i dont know what ping they had but come on, something aint right there;

Simply adding a 15min delay to the API data won't do much, Caymans and back still takes 50min. At best it will jumble the landing times a bit, but you'll still be able to get a list of caymans fliers to money spy. It will just increase the time needed to keep refreshing the page on landing.

All of the fixes I've seen suggested are: remove flight destinations from API and profile fields, a 10-15 sec 'grace period' (airport security?) after landing, or 1h+ delay to API data. First fix is best imo, second is a decent solution, third is not desirable due to collateral damage but preferred over doing nothing.

There should be a 15 second grace period for those who land to not be insta attacked.

Can't stop your friends from stealing money until you figure out another way to feed them cash eh? You're a f**king chump.