Don't allow players to see servers they are unable to join.

[NotRexButCaesar]

When looking for a new multiplayer server to join, one often encounters a server with a whitelist that they are not allowed on. It is frustrating to consistently find servers you may not join when looking for one you want to play on. I suggest that if a server has a whitelist, only whitelisted players will be able to see it (and likewise with blacklists I guess).

[asher_sky]

+1, this would be a welcome addition to the multiplayer server list

[Koub]

I'm not sure this is possible. If the whitelist/blacklist are not public, but processed on login attempt (which would make total sense from a developer's standpoint), that would mean the game would have to try and connect to all public servers just to hide those on which connection fails, for every single multi player.

[NotRexButCaesar]

If the whitelist/blacklist are not public

That is the suggestion: make them public so you can hide which ones aren't available to you.

[ssilk]

Somehow agreed, somehow not. A whitelist needs to be downloaded to see, if you can join, and that lists can get very long. Koub already explained it...
Edit: that wl-mechanism can be done from inside the game, not possible to see from outside.

And it doesn’t mean, that a game is closed. You “just” need to add yourself to that whitelist. Asking the admin to add you. Sometimes impossible, sometimes very simple.

Very different use cases possible. Removing means, you never have the chance to join. I would mark those games somehow, not removing from the list.

[NotRexButCaesar]

I would mark those games somehow, not removing from the list.

you could just move them to the bottom when sorting.

[SoShootMe]

I'm not sure this is possible. If the whitelist/blacklist are not public, but processed on login attempt (which would make total sense from a developer's standpoint), that would mean the game would have to try and connect to all public servers just to hide those on which connection fails, for every single multi player.

Good practice is to only provide the authorisation result (that is, whether a user is permitted or not) after authentication, to reduce information disclosure. This is a very good reason for it to be processed on login attempt.

However, a trusted intermediary (eg the source of the server list) could accept user lists from servers, and allow an authenticated user to request a list of servers with those the user would not be permitted to join either excluded (making them undiscoverable) or, less strongly but probably reasonable in this case, included but marked generically as "cannot join" (which could be used to enable a filter in the game browser). This does not reduce the server's need to check authorisation upon joining.

This concept could even be extended to servers' admin lists, enabling a filter for that.

[blahfasel2000]

IMO a simple marker plus a filter whether a server has a whitelist is enough, similar to how there's already a marker and a filter for servers with a password set. If a server has a whitelist, odds are that those on the list already know that they are on it, and also know what exact server they are looking for.

Completely (and unconditionally) removing servers from the list where you aren't on the whitelist, as proposed by the OP, would make the case that you are supposed to be on the whitelist but aren't for some reason (eg. a typo in the whitelist) harder to diagnose, because "I can't see the server on the list" is less specific than "I get an authentication error when trying to connect to the server".

[NotRexButCaesar]

Completely (and unconditionally) removing servers from the list where you aren't on the whitelist, as proposed by the OP,

It doesn't have to be like that: it was just the first thing that came to mind.

[SoShootMe]

IMO a simple marker plus a filter whether a server has a whitelist is enough, [...] If a server has a whitelist, odds are that those on the list already know that they are on it, and also know what exact server they are looking for.

Completely (and unconditionally) removing servers from the list where you aren't on the whitelist, as proposed by the OP, would make the case that you are supposed to be on the whitelist but aren't for some reason (eg. a typo in the whitelist) harder to diagnose [...]

Strong arguments; I think this solves the OP's problem as simply as possible with no significant downside. The main difference compared to what I suggested is when a user is on a blacklist, which is probably an edge case and, similar to the whitelist case, odds are those on the list already know what they did to get on it .

[Ranakastrasz]

I doubt downloading extra data is a problem. You already have a modlist, which is probably just a list of strings, and you don't have to join to get that.

[SoShootMe]

I doubt downloading extra data is a problem.

It's not clear what this is a response to but if you mean the "extra data" of the whitelist(/blacklist) content, the problem is not the quantity of data but what the data reveals. In this case, it reveals the names of user accounts, which puts a bad actor one step closer to gaining access to an account or causing other mischief (same reason as for "Incorrect username or password" rather than "Wrong password"). It also reveals information about what can be done with those accounts, which might not be so important in this case but in general might tell a bad actor whether it's worthwhile trying to gain access to a given account.

[Ranakastrasz]

Ah, that makes more sense.
Although you can already get the usernames from joining the game, and there aren't alieses.
Not sure if this forum uses the same login info as the game, been a few years since I registered, but I would imagine getting usernames is pretty trivial.

I would followup with having the client do the comparison and just say if you are whitelisted or not, but a thirdparty client could doubtless abuse that.

I suppose just adding a flag whether it has whitelist active, letting you filter them out is best. If you are whitelisted, then you presumably are also part of the group who is running the server.

Regardless, I don't understand security well enough to have a good opinion.

[ssilk]

Don’t forget,
A) it’s a matter of information privacy: it’s not really needed to exchange such lists
B) downloading lists can also be used as DoS attack: the list of users in the whitelist can be some Gigabytes big. Nice way to make Factorio community very unhappy

The right way is, that a server marks itself as “user whitelisting”, “password protected” or whatever limitations came into the mind of the community - so that it can be seen, sorted, filtered.

[Koub]

the list of users in the whitelist can be some Gigabytes big.

This is very unlikely. Assuming all Factorio players are in it, (I went with 3 million, as we didn't get information from the devs that the 3M mark was reached), one would need 333 bytes per name on average to reach the first gigabyte.

[SoShootMe]

the list of users in the whitelist can be some Gigabytes big.

This is very unlikely. Assuming all Factorio players are in it, (I went with 3 million, as we didn't get information from the devs that the 3M mark was reached), one would need 333 bytes per name on average to reach the first gigabyte.

As far as I know, nothing says the usernames present in the list have to exist. So, if the game downloads the whitelist, it means someone could create a server with a large list specifically to cause a problem for players. Which, contrary to what I wrote before, means the amount of data also matters.

The right way is, that a server marks itself as “user whitelisting”, “password protected” or whatever limitations came into the mind of the community - so that it can be seen, sorted, filtered.

Agreed. I think that whitelisting is being used as an alternative mechanism for the use case leading to "password protected" (and has some advantages over it). When viewed like that, marking and permitting filtering of servers with it enabled makes perfect sense.

[distortions864]

Yeah, it would be nice if password/whitelist were obvious in the server list (maybe color or icon?)
Maybe the password filter should also filter out whitelist servers as well?