SE Please start caring about your players privacy.

My initial concern with the new blacklist was the prospect that someone was going to exploit and reverse engineer it and intensify the invasive activity. Now more than ever people's sensitive information is vulnerable and the underbelly of the community shows that no low it too low. I can but hope this is swiftly resolved and new strategies and technologies are implemented to protect all the law abiding players. Bonus points if someone gets sued into oblivion.

Quote:

---

Originally Posted by Lilapop

CAN they do it? Are you familiar with the specifics of their system? Is it compatible with everything else and they're just lazy like you say? You're 100% certain?

---

Of course I'm not familiar with it, but yes I am 100% certain it's within their ability to make that sort of change. However as I said it's a lot of work, I don't know exactly how much because that depends on the specifics of the system. Maybe it's as easy as manually changing the numbers and nothing would break (they'd program something to automate that process but even then it would take time to do it for every account/character), and if it's that easy then not doing it would be so wildly negligent that they have no business continuing to keep the game online with so little concern for player safety. Maybe they'd need to adjust every function that uses it. Maybe some of those adjustments are harder to make than others. Maybe the game's code is such a mess that it's all hard to change. The harder it is, the more work it will take. But it's still just a matter of work. Work they should absolutely do for player safety, but they may not agree with me on the necessity of it.

Maybe they'd rather crack down as hard as they can on any third-party software use and obliterate the Savage/Ultimate raiding scene in the process if they think that's less work. It would be very reasonable for them to decide we can't have nice things after nearing a million accounts have had their detailed character and location history compromised by stalkers. They'd still need to fix the way the blacklist gets account data from the server no matter what though. In fact at minimum they should be rolling back to the old blacklist right now just to stop that database from continuing to grow. I imagine that would need to be rolled out in a patch, or else we'd have seen an emergency hotfix to do it. If Square Enix doesn't do anything at all though this game just becomes a stalker's paradise.

Xeno talked about it on his stream but here's a shorter video about it. If anyone's curious how it actually works, Xeno shows a video of a demo around minute 12.

Quote:

---

Originally Posted by Archmortal

I think you already know I'm well aware of that.

---

Do I?

Hi hello, I know we've just started quoting each other, but no, I don't know. I went by what you said in your initial post. Not trying to be mean or sarcastic here and never was it my intention to challenge your intelligence, man.

Quote:

---

Mitigating factors still help. None of it will matter if they don't even fix the information vulnerability but if they do at least that much everything else becomes possible to manage instead of being in freefall. The question is will SE dedicate the work to fixing the account ID problem now that so many hundreds of thousands have been compromised. Cuz when I say "let's assume it's too hard" what I mean is "let's assume they aren't willing to do it." They CAN do it, it's well within their ability to do so and for us to lose nothing in the process. But it's a lot of work.

---

So, how does a name change help, given the fact that your Lodestone ID does not change? You are still discoverable until you put your Lodestone profile to Private, but even then we don't know if it's going to do much of a change. The best move, that I can think of, is to revert back to the old way of handling blacklists until they figure out how to go about fixing the new one. Yes, that is completely lazy for now, but it does mitigate any further damage UNTIL they can roll out a better version.

Sure, they definitely can spend whatever resources to fix their blacklist system, but can they do it in time before everyone's character data gets compromised? I don't think so.

Quote:

---

Originally Posted by Lilapop

CAN they do it? Are you familiar with the specifics of their system? Is it compatible with everything else and they're just lazy like you say? You're 100% certain?

---

It would be crazy if a company this big is not competent enough to work with the code THEY implemented XD. Even if I am not familiar with their systems, I know, as a dev myself, of two ways to fix this BS, but what do I know, right? Like, have an ID on their server side, maybe even with security behind it, and do not start with "the servers can’t handle this" it’s BS. They just don’t want to put some money into hardware that is not from 2010. The other one: revert the change. Rollbacks exist for a reason. The only reason why they wouldn’t do it, even to mitigate until they fix it behind the scenes, would be that they don’t have a backup from before the new BL launched or they don’t know how to do it and I actually don’t know what’s worse. The sad thing is, I could think of all of this. You can, of course, bring some light in here if you know more.

Quote:

---

Originally Posted by VanillaWafer

Do I?

Hi hello, I know we've just started quoting each other, but no, I don't know. I went by what you said in your initial post. Not trying to be mean or sarcastic here and never was it my intention to challenge your intelligence, man.



So, how does a name change help, given the fact that your Lodestone ID does not change? You are still discoverable until you put your Lodestone profile to Private, but even then we don't know if it's going to do much of a change. The best move, that I can think of, is to revert back to the old way of handling blacklists until they figure out how to go about fixing the new one. Yes, that is completely lazy for now, but it does mitigate any further damage UNTIL they can roll out a better version.

Sure, they definitely can spend whatever resources to fix their blacklist system, but can they do it in time before everyone's character data gets compromised? I don't think so.

---

just to add there is a nono tool which will tell you person changed its name

Quote:

---

Originally Posted by VanillaWafer

So, how does a name change help, given the fact that your Lodestone ID does not change?

---

Any iota of inconvenience to the malicious party helps. It's not much on its own and it's bordering on ineffective without SE changing our IDs. But on a large scale that minor inconvenience is the same as adding an extra click to a feature you regularly use. I'm sure we've all seen someone throw their hands up and quit in irrational frustration at minor inconveniences. It wouldn't help against the dedicated problems, but it would reduce the potential volume on a large scale. Stack enough minor inconveniences like that up and it starts to really make a difference. Unfortunately there are only so many tiny inconveniences we can create on our own and for some of it we have to pay money to the company whose lack of account security protocol got us into this mess. SE has to do the bulk of the work to protect us from this crap, and if they don't I'd sooner suggest people outright quit the game or at least switch their sub to a new account than pay for a name change.

Quote:

---

Originally Posted by Dante131

just to add there is a nono tool which will tell you person changed its name

---

Yes, but if SE fixes the blacklist issue that created this problem, it won't be anywhere near as convenient. That's my point. SE still has to fix the blacklist first, or nothing matters.

Of course. It’s actually a shame that it’s taking them so long to even say something. Other games would have patched it in a hotfix or just rolled it back until they found a solution, but I guess that’s too much to ask from SE. But I guess deleting the threads is more important

Quote:

---

Originally Posted by Archmortal

Any iota of inconvenience to the malicious party helps. It's not much on its own and it's bordering on ineffective without SE changing our IDs. But on a large scale that minor inconvenience is the same as adding an extra click to a feature you regularly use. I'm sure we've all seen someone throw their hands up and quit in irrational frustration at minor inconveniences. It wouldn't help against the dedicated problems, but it would reduce the potential volume on a large scale. Stack enough minor inconveniences like that up and it starts to really make a difference. Unfortunately there are only so many tiny inconveniences we can create on our own and for some of it we have to pay money to the company whose lack of account security protocol got us into this mess. SE has to do the bulk of the work to protect us from this crap, and if they don't I'd sooner suggest people outright quit the game or at least switch their sub to a new account than pay for a name change.

---

I don't think anyone can be fast enough to change their name when all the stalker/tracker/whathaveyou need is your Lodestone Profile ID before you even think about it. This series of numbers in the URL is publicly available.

Could it be possible to have the URL changed to something like /[datacenter]/[server]/[name]? Sure, it's longer than /character/[LodestoneID], but that's probably how I'd go about it. If that name's changed, welp, it's 404'd until someone replaces it.

What you outlined can work if you yourself set your profile to Private if it's that severe, but will the average player do that? Who knows.

Can this cause any issues and get SE in trouble with the EUs GDPR laws about data protection of this plugin can get your account ID data?
I'm wishing FFXIV could go back to how it was when l joined originally in 1.0 and there was zero add-ons or mods as I feel the add-ons seems to cause bigger negatives issues rather than positives. :/

Quote:

---

Originally Posted by Dante131

Even if I am not familiar with their systems, I know, as a dev myself, of two ways to fix this BS, but what do I know, right? Like, have an ID on their server side, maybe even with security behind it, and do not start with "the servers can’t handle this" it’s BS. They just don’t want to put some money into hardware that is not from 2010.

---

Handling blacklisting client-side is likely vastly more performant than handling it server-side. But yeah, they're probably reluctant to spend millions on globally migrating their servers to better hardware in unison simply to facilitate a blacklisting feature. Reasonable to be fair.

Is there even a way to fix this? Once your alts and retainers are known you cant just undo that.

Quote:

---

Originally Posted by Altera

Can this cause any issues and get SE in trouble with the EUs GDPR laws about data protection of this plugin can get your account ID data?
I'm wishing FFXIV could go back to how it was when l joined originally in 1.0 and there was zero add-ons or mods as I feel the add-ons seems to cause bigger negatives issues rather than positives. :/

---

I think GDPR only refers to a natural/real person, and not a fictitious character, so I think unless the account ID can be linked to a real person, e.g., email address/location/IP then I don't think it violates GDPR, though if it is managing to infer and accurately track login history then that is a very blurry line.

Quote:

---

Originally Posted by Saraide

Is there even a way to fix this? Once your alts and retainers are known you can't just undo that.

---

That's the part that sucks, there isn't. The only "undo" is existing information changes, any alts you've not logged into or create in future, name changes, retainer name changes, the only things it does now that couldn't be done before are alt linking's and retainer linking's. If the data is frozen in place as of (assuming it ever got fixed), fix date then there's no ability for anything else to be certain related to it.

Of course, if information wasn't provided in the first place, then it would make it less accurate, like location from search or friends list for example.

To me, this is more a case of "How much does SE care" than information itself.

Edit: What you can only do is remove incentive for people to use it should it go public, for example one thing I am going to do, is tell friends that if it does come out and they decide to use it, to never mention it to me because I will report them. I am willing to turn a blind eye to things people do that do not harm others, let them take their own risks but this affects me.

Quote:

---

Originally Posted by Saraide

Is there even a way to fix this? Once your alts and retainers are known you cant just undo that.

---

nor really because the information is already taken. Even if you fix the issue with the id and give every character a name swap or whatever not everyone wants this aswell. damage is definitly done

Quote:

---

Originally Posted by Saraide

Is there even a way to fix this? Once your alts and retainers are known you cant just undo that.

---

The ID numbers for your account and characters are immutable. Once you're catalogued, the only way to get out of the database is to make a new account and start from scratch.

Quote:

---

Originally Posted by Rehayem

Xeno talked about it on his stream but here's a shorter video about it. If anyone's curious how it actually works, Xeno shows a video of a demo around minute 12.

---

This is just disgusting...

Reverting the blacklist isn't the answer, if anything the database is out there. If they revert it then stalkers have all the information and we have none of the protection that the current blacklist offers. Unless we expect people to abandon their alts that they may have invested time/money into because of this careless oversight and still the game would have plenty of stalker friendly features....

Quote:

---

Originally Posted by Rueby

This is just disgusting...

Reverting the blacklist isn't the answer, if anything the database is out there. If they revert it then stalkers have all the information and we have none of the protection that the current blacklist offers. Unless we expect people to abandon their alts that they may have invested time/money into because of this careless oversight and still the game would have plenty of stalker friendly features....

---

Of course, it wouldn’t fix the issue entirely it would only prevent it from growing worse. Honestly, I don’t know what kind of solution could truly fix this... It might not even be recoverable at this point. You could try taking down databases one by one, but somewhere out there, someone will have a backup and figure out how to avoid getting caught next time.

The more I think about it, the more depressing it becomes. Not so much for myself because who would even care enough to stalk me? but for many others, this is a huge issue. And the sad reality is that it might not be fixable anymore. Maybe if decisive action had been taken quickly, things could have been mitigated, but now it’s too late. The damage is done that’s the most realistic way I can put it.

I fear there will eventually be a network where all this information is readily accessible. If someone truly wants to stalk you, they’ll find a way. Maybe some of us got on the list because we are talking in threads about it. Like a "Revenge" act i dont know how this people think so yeah .... happy times.

Quote:

---

Originally Posted by Exmo

Handling blacklisting client-side is likely vastly more performant than handling it server-side. But yeah, they're probably reluctant to spend millions on globally migrating their servers to better hardware in unison simply to facilitate a blacklisting feature. Reasonable to be fair.

---

There wouldn’t have been any need for migration if they had done it correctly the first time. But as I mentioned in my response to Rueby, this situation is already out of hand. From my perspective, here’s what might happen: the game could lose even more players because people will feel unsafe or get stalked. New players might hear about these issues and decide not to even start, which could push FFXIV further toward a free-to-play (F2P) model.

If that happens, they might begin selling quality-of-life features in the shop, eventually transitioning fully to F2P and suffering the same fate as Aion. I really hope I’m wrong about this. Still, if people leave, they’re going to lose those millions of dollars anyway, so I’m not sure what’s the bigger risk in the end.

Maybe I’m wrong, and nothing will happen. Maybe SE will manage to quietly sweep this under the rug and move on successfully. But right now, the uncertainty is troubling.

Quote:

---

Originally Posted by Dante131

There wouldn’t have been any need for migration if they had done it correctly the first time.

---

You've misunderstood me. You said they should just get new hardware to support managing the blacklist server-side, instead of running what you think is hardware from 2010. I'm saying getting new hardware is probably very expensive, just for this little feature.

Quote:

---

Originally Posted by Dante131

Of course, it wouldn’t fix the issue entirely it would only prevent it from growing worse. Honestly, I don’t know what kind of solution could truly fix this... It might not even be recoverable at this point. You could try taking down databases one by one, but somewhere out there, someone will have a backup and figure out how to avoid getting caught next time.

The more I think about it, the more depressing it becomes. Not so much for myself because who would even care enough to stalk me? but for many others, this is a huge issue. And the sad reality is that it might not be fixable anymore. Maybe if decisive action had been taken quickly, things could have been mitigated, but now it’s too late. The damage is done that’s the most realistic way I can put it.

I fear there will eventually be a network where all this information is readily accessible. If someone truly wants to stalk you, they’ll find a way. Maybe some of us got on the list because we are talking in threads about it. Like a "Revenge" act i dont know how this people think so yeah .... happy times.

---

Nothing short of taking the servers and perhaps lodestone down would've 'stopped' this, but even then, what next? The dev is 100% throwaway account, so forget legal action if that's even ever on the table.

It being removed won't deter people who forked it and/or intend to use it privately....

Unless SE changes the way the blacklist works and also finds a way to invalidate all the data that has been scraped....it's all useless. I don't want to come off as hopeless but if accoundIDs are immutable and our only recourse is to throw more money at SE for their oversight. Then yeah, nah. This is SE's fault first and foremost, why did they make this feature with this kind of risk (even if this was the only efficient course of action), it's not like they have not been implementing qols from third party tools.

More than ever we actually need the account wide blacklist to stay.

I don't feel like logging in anymore...

Quote:

---

Originally Posted by Exmo

You've misunderstood me. You said they should just get new hardware to support managing the blacklist server-side, instead of running what you think is hardware from 2010. I'm saying getting new hardware is probably very expensive, just for this little feature.

---

Sorry if I misunderstood or wronged you, it wasn’t intentional. But it’s strange how I always hear, “That’s too expensive.” If it’s just for something as simple as this, you don’t need a hyper-powerful server. I work with hosting servers in my company, and I can tell you that our entry-level server, with a bunch of GB of RAM and several TBs of storage, costs about €50 a month. Are you telling me they can’t work out a contract with a hardware provider (as they’ve done in the past) to handle a system like this, maybe even with one or two smaller auxiliary systems?

The issue with FFXIV is that, for years, the management’s attitude has been, “FFXIV isn’t allowed to spend money.” But milking one project without reinvesting will inevitably lead to problems and now we’re facing a really big one.

Quote:

---

Originally Posted by Rueby

Nothing short of taking the servers and perhaps lodestone down would've 'stopped' this, but even then, what next? The dev is 100% throwaway account, so forget legal action if that's even ever on the table.

It being removed won't deter people who forked it and/or intend to use it privately....

Unless SE changes the way the blacklist works and also finds a way to invalidate all the data that has been scraped....it's all useless. I don't want to come off as hopeless but if accoundIDs are immutable and our only recourse is to throw more money at SE for their oversight. Then yeah, nah. This is SE's fault first and foremost, why did they make this feature with this kind of risk (even if this was the only efficient course of action), it's not like they have not been implementing qols from third party tools.

More than ever we actually need the account wide blacklist to stay.

I don't feel like logging in anymore...

---

i am sorry to read this ...

Quote:

---

Originally Posted by Dante131

i am sorry to read this ...

---

Don't be, I'm sorry I got frustrated...

I was brainstorming ideas, but depending on the technicality, wouldn't it be possible to encrypt those unique identifiers? That maybe would most likely kill the bad. Or randomize the identifiers?

Quote:

---

Originally Posted by Rueby

I don't feel like logging in anymore...

---

I'm already logging in a lot less, I have a few very specific things to login for, but I used to AFK in game and such which is no more.

This content drip that we are getting has frustrated me to no end, is like "Your release cycles dumb but you look like you have semi-good intentions even if I have no idea why you are doing things this way".

This blacklist issue just feels like a "Yeah we don't really care about you either, just keep giving us your money and we'll get away with as much as we can" slap in the face.
I mean it's a business, so I don't really expect the company to care beyond what they have to but it's at least better than some other ones out there, or so I thought.

Quote:

---

Originally Posted by Dante131

Sorry if I misunderstood or wronged you, it wasn’t intentional. But it’s strange how I always hear, “That’s too expensive.” If it’s just for something as simple as this, you don’t need a hyper-powerful server. I work with hosting servers in my company, and I can tell you that our entry-level server, with a bunch of GB of RAM and several TBs of storage, costs about €50 a month. Are you telling me they can’t work out a contract with a hardware provider (as they’ve done in the past) to handle a system like this, maybe even with one or two smaller auxiliary systems?

The issue with FFXIV is that, for years, the management’s attitude has been, “FFXIV isn’t allowed to spend money.” But milking one project without reinvesting will inevitably lead to problems and now we’re facing a really big one.

---

I think the actual challenge here is more akin to "how do we design a server that does all of the blacklisting logic, and how does it provide the game client with information about what currently logged on characters are blocked." Thats a huge (not in terms of gigabyte stored, but in terms of amount of entries) database constantly evaluating information. And if we delegate it to an external server - does it communicate with the server, or the client? How would it do that? What exactly would happen when said server is unreachable for whatever current reason?

Those are questions a software architect would have to ask themselves, and then provide solutions for.
I'm in no way saying SqEx should not have done this, quite the opposite - this is what I would expect as a paying customer to happen, really. Just saying that the development costs of that feature is a bit more costly than just the acquisition of additional hardware.

Quote:

---

Originally Posted by NaoSen

I'm already logging in a lot less, I have a few very specific things to login for, but I used to AFK in game and such which is no more.

This content drip that we are getting has frustrated me to no end, is like "Your release cycles dumb but you look like you have semi-good intentions even if I have no idea why you are doing things this way".

This blacklist issue just feels like a "Yeah we don't really care about you either, just keep giving us your money and we'll get away with as much as we can" slap in the face.
I mean it's a business, so I don't really expect the company to care beyond what they have to but it's at least better than some other ones out there, or so I thought.

---

If they actually cared about the consumer beyond just "Give me your money", then at the very least courtesy statement will have already followed acknowledging the issue, and impact to the users, in my opinion. This would have happened days ago.

I just feel sorry for the users that don't necessarily engage with content creation or Reddit/Forums that are blind to the issue.

Quote:

---

Originally Posted by Rehayem

I was brainstorming ideas, but depending on the technicality, wouldn't it be possible to encrypt those unique identifiers? That maybe would most likely kill the bad. Or randomize the identifiers?

---

At the absolute most you could make Account ID's different to each person's FF account, this would eliminate sharing of Account ID's however over time the tool would naturally build its own database of name <-> id pairings just like they doing right now.

Quote:

---

Originally Posted by Kaurhz

If they actually cared about the consumer beyond just "Give me your money", then at the very least courtesy statement will have already followed acknowledging the issue, and impact to the users, in my opinion. This would have happened days ago.

I just feel sorry for the users that don't necessarily engage with content creation or Reddit/Forums that are blind to the issue.

---

I'm at least not affected by people knowing information about my alts or where I go, what I do etc... It feels creepy and I dont like it but its not going to cause me any problems.

Could you imagine Asmongold (I'm sure everyone knows who this is but if they dont, any game he plays he gets swarmed by fan's) still played FF and had a "On Stream" character and a "Private Play" character, within 24h his "Private Play" character would be leaked and there would be a video out there from him that gets 500k+ views on it. Then people would know for sure.

Quote:

---

Originally Posted by Dante131

Sorry if I misunderstood or wronged you, it wasn’t intentional.

---

You didn't wrong me, it's ok.

Quote:

---

But it’s strange how I always hear, “That’s too expensive.” If it’s just for something as simple as this, you don’t need a hyper-powerful server. I work with hosting servers in my company, and I can tell you that our entry-level server, with a bunch of GB of RAM and several TBs of storage, costs about €50 a month. Are you telling me they can’t work out a contract with a hardware provider (as they’ve done in the past) to handle a system like this, maybe even with one or two smaller auxiliary systems?

The issue with FFXIV is that, for years, the management’s attitude has been, “FFXIV isn’t allowed to spend money.” But milking one project without reinvesting will inevitably lead to problems and now we’re facing a really big one.

---

For something like this blacklist feature, I don't imagine they would want a dedicated server with an API.

I can only speculate but I imagine what we're talking about is this. Say you're standing at Limsa Lominsa aetherite plaza. For every player at that plaza, the server would have to do a check for every other player at the plaza to see if they've been blacklisted. This has to happen extremely regularly, every second or every five seconds max, to account for the chance that you added someone present to your blacklist since the last check. Remember that each later can have 200 blacklisted players. That's a lot of checks every second. If "the server" needs to poll another dedicated server to perform those checks, that's large overhead for every call. It's probably more likely you would put the check into the same central process where "nearby players are generated", reducing the expense of it, but that means you need to upgrade each server representing a world within each data center. Effectively, upgrading existing architecture, rather than another node on the periphery.

Caveat - completely speculating as to how the servers are currently architected so all of this could be wrong. But given how often the devs cite software difficulties as an obstacle for new features, I wouldn't be surprised if the internals aren't "properly" distributed.

Quote:

---

Originally Posted by Dante131

Sorry if I misunderstood or wronged you, it wasn’t intentional. But it’s strange how I always hear, “That’s too expensive.” If it’s just for something as simple as this, you don’t need a hyper-powerful server. I work with hosting servers in my company, and I can tell you that our entry-level server, with a bunch of GB of RAM and several TBs of storage, costs about €50 a month. Are you telling me they can’t work out a contract with a hardware provider (as they’ve done in the past) to handle a system like this, maybe even with one or two smaller auxiliary systems?

---

A mmo is quite different workload than doing something such as hosting websites, where the workload is punctual. Small costs can add up quickly if you have to pay them on every server tick for every player.

And in fact, it's not just something you pay only once for each player. In a MMO, whenever you need to deal with a specific interaction that may occur between two characters (for example, did character A blacklist character B?), you create a situation where server CPU usage to handle a group of players in range of one another increases quadratically aka "number of players squared" (you have N players seeing one another: each player needs to perform this check for all other players, so that's N*N checks).

That's not to say that handling blacklisting on the server side would necessarily be prohibitively expensive, but I can see them being circumspect. However the fact that they went with a client-side implementation that leaks account IDs does seem to indicate that they're a bit naive when it comes to security and confidentiality.

Quote:

---

Originally Posted by Exmo

You didn't wrong me, it's ok.


For something like this blacklist feature, I don't imagine they would want a dedicated server with an API.

I can only speculate but I imagine what we're talking about is this. Say you're standing at Limsa Lominsa aetherite plaza. For every player at that plaza, the server would have to do a check for every other player at the plaza to see if they've been blacklisted. This has to happen extremely regularly, every second or every five seconds max, to account for the chance that you added someone present to your blacklist since the last check. Remember that each later can have 200 blacklisted players. That's a lot of checks every second. If "the server" needs to poll another dedicated server to perform those checks, that's large overhead for every call. It's probably more likely you would put the check into the same central process where "nearby players are generated", reducing the expense of it, but that means you need to upgrade each server representing a world within each data center. Effectively, upgrading existing architecture, rather than another node on the periphery.

Caveat - completely speculating as to how the servers are currently architected so all of this could be wrong. But given how often the devs cite software difficulties as an obstacle for new features, I wouldn't be surprised if the internals aren't "properly" distributed.

---

The frequency devs cite such difficulties is one reason for the skepticism that they're real in many instances.

Quote:

---

Originally Posted by Dante131

And the sad reality is that it might not be fixable anymore.

---

Nah it's totally fixable. It's just a question of whether SE will try or not. The radio silence isn't a good look, nor is the continued advertisement of the free log-in campaign after news of this broke.

Quote:

---

Originally Posted by Archmortal

Nah it's totally fixable. It's just a question of whether SE will try or not. The radio silence isn't a good look, nor is the continued advertisement of the free log-in campaign after news of this broke.

---

JP thread has people expressing their frustration and anger at SE's silence, so we're basically all in the same boat.

Quote:

---

Originally Posted by Archmortal

Nah it's totally fixable. It's just a question of whether SE will try or not. The radio silence isn't a good look, nor is the continued advertisement of the free log-in campaign after news of this broke.

---

This depends on what I’m referring to specifically, the fact that data has been collected and continues to be collected. At some point, the damage becomes irreversible because the data is already out there, and there’s nothing that can be done to undo it.

Quote:

---

Originally Posted by Rehayem

JP thread has people expressing their frustration and anger at SE's silence, so we're basically all in the same boat.

---

I really appreciate how much more solidarity they have with each other in their thread.

Quote:

---

Originally Posted by Dante131

This depends on what I’m referring to specifically, the fact that data has been collected and continues to be collected. At some point, the damage becomes irreversible because the data is already out there, and there’s nothing that can be done to undo it.

---

Yeah, that can be fixed. Step 1 is to fix the blacklist so all this account information is properly protected. Step 2 SE just has to change the associated ID numbers on our characters/accounts so that the database is fully inaccurate. Step 3 is for anyone with concerns to do a name change (which is why I keep saying SE should provide one for each character for free after they've done as much damage control as they can), which effectively puts us back where we were before the stalkers started farming the data. Whatever's left are problems that already existed which could also be reasonably fixed if SE prioritized them.

Step 2 is the big question mark because that's the bulk of the workload. As long as those things happen in that order, this specific vector for harassment is completely eliminated. It can't undo any harassment stalkers have already inflicted in the last week, or for however long it takes before Step 2 is done, that's true. But the database itself would no longer be a threat. If SE fails to do Step 2, then we'll have lasting problems.

Quote:

---

Originally Posted by Archmortal

I Step 1 is to fix the blacklist so all this account information is properly protected.

---

Can you explain how you would do that?

Quote:

---

Originally Posted by Exmo

Can you explain how you would do that?

---

SE has people that are paid to figure that out. Or are they too much of a small indie company ? Literally every MMO has account info protected.

Quote:

---

Originally Posted by Exmo

Can you explain how you would do that?

---

Yeah, with all due respect it is on SE to figure this out, they are the ones being paid to do so. If a company of this size cannot properly protect data and leaves privacy exposed to such a degree, then frankly said company should not be anywhere near an online game, especially an MMO of this size.

If a company synonymizes Privacy concerns with "We can't do that", then it's a gigantic problem.

Quote:

---

Originally Posted by Kaurhz

Yeah, with all due respect it is on SE to figure this out, they are the ones being paid to do so. If a company of this size cannot properly protect data and leaves privacy exposed to such a degree, then frankly said company should not be anywhere near an online game, especially an MMO of this size.

If a company synonymizes Privacy concerns with "We can't do that", then it's a gigantic problem.

---

I'll wait for Archmortal's reply, thank you.