One particular emerging service is open authentication. Groups such as the OpenID Foundation have emerged in order to promote a common set of standards for developers to use, while several decentralised OpenID providers have sprung up. In essence it all sounds like a good thing, with a site visitor benefiting by being able to use an existing username and password combination. The developer also wins by only having to use a set of freely available modules in order to support authentication instead of designing it themselves from scratch. Everything sounds perfect, right?

As you’ve probably guessed, there is a fly in the ointment. That fly is the relentless barrage of security nightmares that we face every time we switch our computer on and connect with the outside world. Everything from phishers to keyloggers are out there to try and find a chink in our virtual armour or our achilles heel. All of them lie in wait, hoping for a whiff of a password or a hint of a credit card number that they can then trade in underground markets. Don’t think that videogames are immune from this as well – indications are that credentials for World of Warcraft accounts can sell for up to twice as much as a set of credit card details.

Of course, the next step is to look at where your open authentication might be used. A collection of social networking sites might not be that big a deal – both Facebook and Twitter are setting themselves up as identity providers. At the moment, all that you’d be likely to lose is your reputation if someone managed to gain access to your Twitter account, particularly if you have a large number of followers. If it becomes possible to access your web-based email through the same service then suddenly all the other websites you use with a “forgotten your password?” function suddenly become vulnerable as well. This might expose things like names and addresses of friends and family members, which other online communities you visit and how you access them, and so on.

Paranoid yet? Potentially you should be, but that doesn’t mean that a solution can’t be implemented. Two-factor authentication has been kicking around for years, with reliance on something you know (a password) combined with something you have (a fingerprint, a retina scan or a key-ring with a digital display that changes every minute) in order to get around keyloggers and phishers sniffing your credentials out of the ether. Trouble is, fingerprint and retinal scanners are expensive, while it’s difficult to make a case for sending out tokens and dongles when a firm is effectively supplying a free service to customers.

There is another option. With the mobile phone becoming an increasing necessity in our lives, it’s becoming safer to assume that anyone using popular online services has one. As a result a number of free apps have emerged in order to support two-factor authentication, most notably from Blizzard Entertainment and Verisign. With these, the only cost is in developing the app itself before uploading it to the handset supplier app stores.

Twitter has also been moving towards OAuth as a way for granting applications access to a user’s account. The trouble with such techniques though is that they still fall back on the standard username and password, except that the user is logging in to Twitter directly instead of the website requesting access. It also grants access permanently until removed, meaning that the third party now has continual access to your details instead of the time required to support the transaction. For occasions where regular access is not required, the use of OAuth tokens is not suitable. That doesn’t mean that OAuth should be scrapped entirely – for apps that regularly need access to our individual identity data, a periodic refresh mechanism is fine. Sitting it alongside a solution that works for those one-off moments, or even to approve regular-access apps/OAuth tokens, would be a good move.

But why bother going to all this expense? At the end of the day, it’s about two things: the damage that someone misusing your credentials can cause, and the amount of time it’ll take to fix them again. Having to fix either of them is unappealing, yet whenever we use open authentication we run the risk of this happening. It’s crucial that this problem is addressed as part of the move towards identification services in order to maintain confidence in the social networking infrastructure as it moves to support them. Without it, all it takes is a couple of large scale compromising incidents for growth in the medium to stall.

As always, comments are welcome. If I’m wide of the mark or spot on, feel free to add your thoughts.

DooM: Multiple difficuly options available

Going back through history, the earliest videogames traditionally took a static approach to difficulty. Although games demonstrated a difficulty curve, there wasn’t any way to alter it. If you couldn’t complete the game, it was either a case of getting a friend to complete it for you, or finding a way to cheat so that you could overcome an obstacle. Cheat codes were passed around school playgrounds like sacred lore, offering young gamers a sure-fire way to finish certain games if only to see how the story ends.  Although cheat codes offered developers a back-out clause of allowing a player a way of making the game easier, it wasn’t until difficulty menus started emerging that players could really choose how difficult they wanted a game to be. This was arguably popularised through the id software classic DooM with it’s now legendary “Nightmare” difficulty setting being the hardest of five different ones available. The legacy left behind by this still crops up in more modern videogames, typically first-person shooters. As time has progressed, techniques such as dynamic difficulty adjustment have been developed in order to tune a game experience even more closely to the person playing it. The difficulty of individual components that may make up an encounter or level are also studied in much more detail now, in order to control elements such as pacing in much the same way that a director or editor would seek to control the pacing of a scene in a film.

All this, in a rather roundabout way, brings us to the central theme of this post: defining the difficulty level of MMO content. Problem is, in an MMO, you don’t really have the option of letting the player choose a difficulty level to play at. Pretty much all of the content is designed in such a way that the majority of players will get to experience it, if they want to. The problems emerge when you have a clash between two parts of a player’s MMO experience – levelling their character, and “endgame” content.

Burning Crusade: Lots of content, flow restricted

As a player levels up, there’s usually a lot for them to do: there’s quests to complete, zones to explore, dungeons to investigate and so on. As they progress, their character develops by gaining new gear, becoming tougher and gaining new skills and abilities. Once a player hits maximum level, their options become more limited: they can take part in maximum level dungeons, invest time in PvP, or look at joining a raid group. As a result, your choices as a developer become limited – you want to maximise the value of the content already available at endgame, but you also wan to be able to provide new content in a timely fashion for players to experience. This is where the difficulty curve comes into play – by varying the difficulty of challenges sufficiently at endgame, you force players into a situation where they have to complete the easier content before they can move on to the more difficult stuff. You can even put artificial barriers in to play in order to slow down the progression between one grade of content and another. Get it wrong, and the players will have rapidly completed the hardest content you have available, putting increased pressure on your development teams to churn out more content, and increasing the risk that the new content will be rushed. To give an example of this, I’ll use two popular examples from the same game: The Burning Crusade and Wrath of the Lich King, both expansions for World of Warcraft.

Burning Crusade: Gates galore

On release, The Burning Crusade introduced two new concepts for endgame players. For 5-man dungeons, players would have the option of tackling them at either their standard difficulty setting or a new “heroic” one, specifically tuned for endgame players with a minimum level of equipment on their characters. In addition, unlocking the heroic mode for a dungeon usually required completing it in normal mode a number of times. Beyond that, being able to access raid content relied on players completing a number of tasks in 5-man dungeons, while accessing higher tier raiding required players to complete lower tier raid locales first. This enforced gating process meant that upon release, Blizzard would have a reasonable idea how long it would take for groups to progress through the content. It also meant that the complexity or challenge of each instance was less of a risk – it didn’t matter if the difficulty curve was poorly implemented if the flow of players into the higher content was restricted through the use of gates. Over time the gates and restrictions were removed in order to open up content to more players, but by then Blizzard had managed to release further content updates in order to keep players with something to do. More than that though, having far off goals provided players with an aspiration to work towards, even if they would never ultimately reach that goal.

Wrath of the Lich King: No gating

By contrast, Wrath of the Lich King has been completely open to players. There are no gates or hoops for players to jump through, and heroic modes are available to all players as soon as they reach endgame. Only, it hasn’t been as successful as one would have hoped. The normal modes of endgame dungeons have been largely discarded, as heroic ones are instantly available and in many cases are only marginally more difficult. This in a stroke halves the replay value of these dungeons – the trick was to use the gear your character would collect in the normal ones to enable you to complete the heroic ones, but if the gear from normal dungeons is worthless and heroic ones are easy to complete, why bother going through that step if you’re not forced to by some artificial gate? The situation gets worse with raiding – players can throw themselves into either a 10-man or 25-man version of every raid dungeon currently available and are likely to be able to complete it. There’s no tiering or gating mechanism in place, which means that once players have gorged their fill on existing content they start turning to Blizzard asking for more. Understandably, the responses have been less than firm . Although content patches are planned, there are no firm dates on when they’ll arrive or what’s in them.

Morton's Fork: both prongs are unappealing

For Blizzard, as much as any developer, it’s a difficult situation with no easy choices. Although it’s painfully obvious now that the difficulty level of much of the endgame Lick King content is not only low but closely packed together, it’s endemic of a Morton’s Fork when it comes to building an MMO difficulty curve. Do you build gates, quests, attunements and so on in order to restrict the flow of players through content, or do you rely on the intrinsic difficulty level of each piece of content to control the pace of progression for you? Neither are particularly appealing to the player base, as on one hand accusations of “holding players back” emerges, while on the other the risk of unbalanced content becomes much more pivotal in the player experience. For my own end, I prefer hard gating mechanisms, as they provide a checkpoint that the player has to work through as well as a mechanism that can be removed once further content is in place.

More than this though, I think there’s a more fundamental question to ask. Do players need a mixture of both goals (I’m going to finish this dungeon) and aspirations (One day I’ll have a full set of top-grade armour) in order to keep them motivated to play a game in the long term? More than that though, how dependant are they on those aspirations, even though they may never achieve them? And does providing a game with few challenges have the result of generating fewer aspirations in their playerbase? For me, a game without long-term goals to work towards leads me to wondering what all the short-term goals are in aid of, how they fit together and where they’re ultimately going to lead my character. And as soon as you get that seed of doubt about your short-term goals, your motivation to complete them evaporates like morning dew.

The original version of Everquest

So what’s made WoW so successful, straight from launch? Well, two of the three lead designers on the game (Rob “Furor” Pardo and Jeff “Tigole” Kaplan) were both heavy players of the EverQuest series of games, being part of the same guild. This meant that although you had a veteran game designer in the form of Tom Chilton, it’s reasonably safe to assume that the design team were focused strongly on what concepts would make the game more fun for the player and which would pull away from that. With this in place, concepts that had previously been traditional in MMOs (such as a heavy death penalty) were abandoned and new ones that rewarded players (such as granting players a bonus for taking regular breaks) became the norm. Before the game was even announced, the stage was set for World of Warcraft to become a mainstream MMO, designed from the core with the player in mind.

By the same token, development of a new MMO can be a high-cost, high-risk business. Blizzard managed to mitigate a large chunk of this risk by using the same root engine for both World of Warcraft and Warcraft III, the continuation of their real-time-strategy series, forking development part-way down the process so that they could be tailored for their eventual purpose. This meant that a lot of datafile formats and toolsets could be repurposed to go from one game to another, allowing you to share your development cost between three titles. I honestly wouldn’t be surprised if the same thing was happening with their current in-development titles, Diablo III and Starcraft II. This afforded them additional luxuries not commonly known to game developers – additional development time. WoW was in production for about 5 years while various design choices were implemented, tested and so on.  One often used mantra by Blizzard designers is “iterate, iterate, iterate” or continually revisit concepts until you’re completely happy with how they work. By comparison, most other MMOs tend to go through a punishing two year development cycle where as much as possible is crammed in before launch, with further content promised as patch updates later.

Age of Conan: looks pretty, lacks content

Following on from this Blizzard had a couple of luxuries. The low polygon count strategy allowed the art and animation teams to create a large amount of assets – items, creatures, monsters, environments and so on – quickly and easily. This meant that they could ramp up the number of developers working on questing content such as building storylines, developing quest hubs and generally making sure that there was plenty of content to lead a player from one area of the game to another. By contrast, most MMOs of late (I’m thinking of Lord of the Rings Online and Age of Conan) have been really heavy on pushing the realism factor or advancing graphical capabilities in order to win some screenshot space in the videogaming press, or to have some flyover videos to impress the public with.  Eye candy might be great for the initial wow factor, but it’s content that keeps people hooked and playing for months on end.

Finally, Betas. Now, I’ve taken part in a few beta trials, and they’ve usually been of the kind that starts about 3 months before release, just in order to make sure that there are no glaring problems with the wide variety of hardware out there. This was particularly the case with Tabula Rasa and Hellgate: London, where the beta was more of a pre-release demo than an external testing phase. Compare that with the 7 month beta window that WoW had before release and the sheer amount of changes and revamps that took place when developers found concepts that just weren’t working for players. Even post-lanch, Blizzard kept piling on the pressure by releasing new content on a regular basis. This allowed gamers to build confidence with Blizzard and the development teams, reassuring them that they wouldn’t be left with a game that suffers from a lack of post-release support.

So as you can see, Blizzard made several strategic choices that gave their movement into the MMO arena the best possible chance to succeed.

Hellgate: London eventually flagshipped

It’s only natural to assume that as a result, other publishers would consider learning from this and foster their own creative paths in order to support the mammoth amount of work that an MMO requires. Unfortunately, this hasn’t exactly been the case. In LOTRO the game was pretty but dull, with a huge amount of “wouldn’t it be cool if…?” and not enough “how do we make this fun to play?”.  In Age of Conan the game suffered from a lack of cohesion between the various different aspects – items had stats associated with them but it wasn’t obvious how each stat benefited your character, and crafting and player economies were severely neglected. In Hellgate: London, Flagship Studios tried to circumvent a large part of the development process by having different aspects of the world being randomly generated on the fly, but this only served to make areas feel repetitive and indistinct once the scenery had been encountered a handful of times. Not only that, but the nascent development company got heavily tarred with an internet meme that only grew as they became insolvent.

That hasn’t stopped studios from taking risks and developing MMOs. Star Wars: The Old Republic, Star Trek Online, DC Universe Online, Jumpgate Evolution and Otherland to name but a few. Of these, I have fairly high hopes for SW:TOR as it’s being developed by Bioware, formerly of Neverwinter Nights and Mass Effect fame.  They’re used to developing role-playing games with a high level of content (particularly with NWN, which also featured a high level of online capability). I would also really like to see Jumpgate Evolution succeed, but it feels like Codemasters are going down the same roads they have before. They haven’t started a beta phase yet they’re proclaiming a release window of Spring 2009, which goes back to my point earlier about betas being used as a pre-release demo. I’d also really like to see Otherland succeed, but I’m concerned that RealU (the developers, based in Singapore) may have bitten off more than they can chew with an MMO being the first title they’ll release. I’d hate to see this turn into another Flagship.

Will games companies treat the MMO concept as something that requires a unique design path and strategy, respecting what players wants are in order to make a game with true mass-market appeal? Or will they cave to the demands of their publishers and stockholders to produce games that ship within a rigid release window, but ultimately fall flat? Is it possible for a developer to achieve both of these goals? Is an MMO the right thing for a newborn developer to focus on, or should they earn their stripes by pushing out some easier to develop but still hard to do well traditional role-playing games beforehand? It seems that as long as we have studios willing to venture into MMO territory, and as long as we have publishers to finance them, that we’ll see developers going over the same classic mistakes and fail to gain any meaningful market share. Blizzard has already demonstrated there’s a huge mass market out there waiting for the developer that gets it right. It’s just up to the developer to figure out what the right moves are.