Re: This just in...
A unique identifier doesn't fix duping. Or rather, it creates another problem--how to check?
Imagine how long it would take to compare a single item's unique ID to a database of acceptable/non-duped IDs. Consider how long it would take to do that for every item. How often would this occur? Every time an item is generated as a drop? Every time it's picked up or moved? Every time it goes to the AH? Every time it's traded? Depending on when and how the dupe is created, the time between creation and when it's caught could be considerable. And if the comparison is run too often, the game would slow to a crawl for everyone (you can look online for speed tests for searching a database, or for sorting the database to make those searches faster).
An algorithm for each item is also possible, such that an acceptable range of unique identifiers is possible for each item. The dupe would have to guess the algorithm (or guess a correct identifier) but once that is known, the dupe would be as real as a server-generated item. Probably not an acceptable risk when real money transactions are accepted.
Keeping everything server-side, including the code for all item objects, and never allowing the code for an object to transfer from the client to the server is a secure solution. A hacker would need to obtain access to the server and modify code on the server in order to dupe items. At that point, it's probably easier just to hack into the accounts on the server, or better yet, hack into a PC to get the account login/password information.
The truth is, the only secure solution for players is offline singleplayer. If I'm offline, no one can hack into my computer (unless they're physically in my home), and dupes are of zero concern to anyone else--since offline, I can only make dupes for myself.
Of course, offline singleplayer means no multiplayer--and Diablo 3 is a multiplayer game. I believe Blizzard is taking appropriate steps to make the multiplayer game as secure as possible, while still making it playable.
Unfortunately, those of us who don't have sufficient Internet access are not supported by this approach. Those of us who can only play offline were never involved with the hacking/duping problems on Battle.net, because that would require online play. Instead of acknowledging this, Blizzard specifically accuses offline players as the most likely cheaters. Nice.
I can understand keeping online multiplay as safe as possible--but Blizzard is taking an extreme approach, in my opinion, by completely alienating the offline players (who were potential customers). I also believe a security solution could have been implemented that separates offline and online play. For example, if all character/item code stays on the server, and the information about characters and items flows one way (server to client, never client to server), code modifications could never be uploaded to the server. The offline games could be hacked and modded, but it wouldn't affect online play at all. Also, whatever online security is used could be completely eliminated for the offline game, so hackers couldn't learn how the online server security works through out-of-the-box game manipulation.
I don't know how the Diablo 3 software was written, and maybe it would simply take too much time and effort to have both an offline version and an online version.
------
EDIT: I took a look online (
www.tpc.org), which shows speeds up to 500,000 database transactions per second back in 2010. Imagine this speed, but transactions for every item manipulated on an entire server. Now, the size of the database and amount of processing power dedicated to the task will significantly affect the speed of the search...but no matter what they do it's not going to be instantaneous. Also, the number of items will always be growing (unless they have a cap on the number of items that can ever be generated for the life of the game). Something like an advanced version of the Warden that runs constantly and near-instantly eliminates dupes as soon as they occur is just not feasible given current database technology. As always, this is just my opinion (and my limited knowledge on the subject).