Patch 7.2's Account ID protection measures have already been circumvented

Quote:

---

Originally Posted by sindriiisgaming

im glad this threat reappeared after it seamed to go back out of earths orbit for a while



Im not trying to downplay the legitimate concern that people have here, and i know theres no NICE way to say this. but i think somebody has to say this, 99% of players in the game will never be effected by this, and honestly, if somebody wants to use a plugin this badly to stalk you, idk man id find it impressive i managed to get that popular.. just dont reply to them, black ignore and move on. its pointless to be upset about things you have No control over.

perhaps this problem should open SE eyes to the fact we need a 2 way BL system. i want to be able to choose who sees me. instead of sticking my fingers in my ears







literally, just, ignore them. this isnt going to go into IRL, you cannot link in any way a players account to their account information like name address ect. this is complete hysteria.
also this story has nothing to do with plugins, this is just an off-related case of somebody stalking somebody in the same country as them. people need to remember to exercise caution when meeting others online.

i agree players have a stalking problem, but thats because the game doesn't have a 2way BL system, if it did... people would actually take being BL much more seriously

---

You have clearly never been stalked the way I have when my stalker found my alts with this plugin and has been following me around on alts that should have been hidden. Some guys take rejection to the extreme and don't know when to quit, they have created trial alts just to continue stalking me after blacklisting their main. They follow me and stand next to me looking like Michael Myers and trying to talk to my friends to try and unblock them. I play this game to escape from the stresses of irl, not deal with it in game :(

Quote:

---

Originally Posted by Kaurhz

2. I mean this with all due respect, and not at all with offense, but you're the last person that should be preaching the choir about "it's pointless to be upset about things you have no control over" - Seeing as you yourself have made threads being just as upset as people here, and arguably over things of which you have absolutely no control over

---

So like the other 99% of the threats on this place?

Quote:

---

Originally Posted by Rinoa_353

You have clearly never been stalked the way I have when my stalker found my alts with this plugin and has been following me around on alts that should have been hidden. Some guys take rejection to the extreme and don't know when to quit, they have created trial alts just to continue stalking me after blacklisting their main. They follow me and stand next to me looking like Michael Myers and trying to talk to my friends to try and unblock them. I play this game to escape from the stresses of irl, not deal with it in game :(

---

Please dont make assumptions like that about me, you're not correct. Im a female player too and playing a male character doesn't stop me from encountering those kinds of men, infect i have a guy rn whos been getting very creepy and possessive over me
also how do you know it was through that plugin. how would you even verify that

"I'm not gonna do it, I'm not gonna downplay your concerns!" *downplays your concerns anyways*

Quote:

---

Originally Posted by sindriiisgaming

So like the other 99% of the threats on this place?

---

Assuming you mean threads..

Not really....

One involves offering feedback towards a product they purchased (In most cases)... The other; the category your post falls into, is downplaying a legitimate issue as No point in getting upset about things you have no control over... Which is most akin to the several threads you made about other peoples' Chaotic PFs..

Respectfully, all I am saying is you probably shouldn't be responding in that tone (and in the process downplaying the issue), considering the threads you have made.

Quote:

---

Originally Posted by Kaurhz

Assuming you mean threads..

Not really....

One involves offering feedback towards a product they purchased (In most cases)... The other; the category your post falls into, is downplaying a legitimate issue as No point in getting upset about things you have no control over... Which is most akin to the several threads you made about other peoples' Chaotic PFs..

Respectfully, all I am saying is you probably shouldn't be responding in that tone (and in the process downplaying the issue), considering the threads you have made.

---

Ive already gave you the most applicable advise i can give you, its not like im saying "just deal with it" i legitimately offered you a solution. and im sorry its not a better one but that's SE's fault, not mine

Quote:

---

just dont reply to them, black ignore and move on.

---

Quote:

---

Originally Posted by sindriiisgaming

literally, just, ignore them. this isnt going to go into IRL, you cannot link in any way a players account to their account information like name address ect. this is complete hysteria.
also this story has nothing to do with plugins, this is just an off-related case of somebody stalking somebody in the same country as them. people need to remember to exercise caution when meeting others online.

i agree players have a stalking problem, but thats because the game doesn't have a 2way BL system, if it did... people would actually take being BL much more seriously

---

The creator of the original plugin stated plainly that he created it so that people undercutting him on the MB couldn't hide behind retainer names, so from the start it was a situation where directly interacting with someone was not a factor. The databases created from this incompetence from SE lets aimless lunacy become targeted lunacy, so even if it's very unlikely to result in something like murder, it's something that any company that gave a damn would either seriously try to fix or seriously try to bury for public opinion reasons alone.

Quote:

---

Originally Posted by Daralii

The creator of the original plugin stated plainly that he created it so that people undercutting him on the MB couldn't hide behind retainer names, so from the start it was a situation where directly interacting with someone was not a factor. The databases created from this incompetence from SE lets aimless lunacy become targeted lunacy, so even if it's very unlikely to result in something like murder, it's something that any company that gave a damn would either seriously try to fix or seriously try to bury for public opinion reasons alone.

---

It being created for that purpose is precisely why I never gave the developer any benefit of the doubt when ways to opt out of it became available
It should be something you have to opt in to, but I guess you can't harass people who undercut you by 1 gil if they have to willingly break ToS just to be yelled at by some freak

Quote:

---

Originally Posted by sindriiisgaming

Strawman fallacy. im more than happy to hear out a good and solid argument but there is simply no need for that

---

Bro, just because it affects only a small number of people doesn't mean that they should just get over it and not be upset. Like murder only affects <0.1% of people but are you really gonna say you don't get upset by someone getting murdered lol??

Also, I'm not saying this plugin leads to murder. I'm using murder as an obvious example that harms very few people but we have laws and entire departments aimed at stopping it. Because even if only very few people get murdered, the police and the laws deter criminals from murdering more people.

Quote:

---

Originally Posted by sindriiisgaming

So like the other 99% of the threats on this place?



Please dont make assumptions like that about me, you're not correct. Im a female player too and playing a male character doesn't stop me from encountering those kinds of men, infect i have a guy rn whos been getting very creepy and possessive over me
also how do you know it was through that plugin. how would you even verify that

---

Then you shouldn't be so dismissive if you don't want that kind of response. The alts were on a world my stalker shouldn't have known, they are there next to me again just like on my mains. I even stopped logging in to those alts as their purpose has been defeated.

Quote:

---

Originally Posted by ServerCollaps

are people scared of getting their erp and pvp alts exposed or whats the matter of everyones panic?

---

A lot of it, and I am in this camp, is just people being tired of Square Enix either not thinking, not being competent or not being able to correctly implement based on their current codebase yet doing it anyways creating MORE spaghetti in their spaghetti code.

We get told they have a 10 year plan for the game but how much can you layer on sand before you just cannot proceed any further without having to re-do everything, its very clear when they are trying to make a work around to an existing problem. The making sets of clothing for the wardrobe is clearly an attempt to create more space in the wardrobe, but how come it has to be a complete set ? Why does battle gear not count ? This shows that they are adding new into a already restricted set.
The blacklist having to be client side, on a semi-good code base this would not be a problem to do server side but it must be, are they unable to correctly track who is in an area if they don't interact with anything ? How is it that teleport hacking bots are even able to do that ? Why does being seated make you unable to interact with items such as Wondrous Tails ? Having to close windows before entering a house, glamour dressors having to be in an inn becuse it puts the player alone in their own instance.
An incredible amount of things can be done client side, its why plugins can do basically anything a person dreams up, yet they go and offer up a feature designed for privacy into the waters of it being one more thing for plugins to use.
My very first thought on client side blacklist change when it came out lasted a whole of 2 seconds before being dismissed, "Maybe they can at least make it so that you cannot have a shareable list", "no anything that can be reversed will be and a method to share will exist, its a bad idea". Yet that's what we got. It's a thought that people more experienced with cryptography than I would never even have had in the first place.

They obviously had to take a LOT of shortcuts to release 2.0 in the time they did but its time to stop now, to slow down and do things properly, to fix old systems, however they are not doing this and the blacklist being like this is a good example.

Quote:

---

Originally Posted by Rinoa_353

Then you shouldn't be so dismissive if you don't want that kind of response. The alts were on a world my stalker shouldn't have known, they are there next to me again just like on my mains. I even stopped logging in to those alts as their purpose has been defeated.

---

wait so you saw some player characters next to you and you came to the conclusion it was your stalker? am i missing something, there must be more to this. i don't see how this proves he's using a tool to stalk you.

"Just ignore it" spoken like someone whos never had to deal with their comfy gaming hobby existing under the shadow of someone who just will not leave you or your friends alone and will spend hours if not weeks of their time dedicated purely to screwing with you on multiple alts. Empathy. Learn!

Quote:

---

Originally Posted by sindriiisgaming

wait so you saw some player characters next to you and you came to the conclusion it was your stalker? am i missing something, there must be more to this. i don't see how this proves he's using a tool to stalk you.

---

If I see some player characters next to my ERP spot in Eureka: Anemos that no one ever visits I'll think it's a stalker too!

Quote:

---

Originally Posted by sindriiisgaming

wait so you saw some player characters next to you and you came to the conclusion it was your stalker? am i missing something, there must be more to this. i don't see how this proves he's using a tool to stalk you.

---

Their behavior gives it away, they tracked down my alt's home and ask people around me to unblock him. They create alts with the trial and stalk me that way here and there. Unlike my two mains that have their home addresses in my Adventurer plate and in my sig, my alt doesn't have their home address posted anywhere and only a few of my close friends that don't talk to that guy know they exist until this plugin came into existence. Have you seen how this plugin works? It tracks where I have been at on any character.....

idk why people waste their breath on low empathy posters unable to see past their own nose. you're not going to change their minds, lol. they just want to condescend and feel superior.

Quote:

---

Originally Posted by sindriiisgaming

wait so you saw some player characters next to you and you came to the conclusion it was your stalker? am i missing something, there must be more to this. i don't see how this proves he's using a tool to stalk you.

---

People do get stalked in game and harassed. Weren't you also making claims of being stalked and harassed in your datacenter by people on the forums and from in game groups and welcomed the dawntrail blacklist changes and wanting the devs to change the blacklist features/privacy concerns. And now your downplaying others suffering being stalked saying they need to "just ignore the stalkers and they will leave lolz" and don't think the current blacklist issues need to be fixed because you think it's a waste of time fixing over other things.

so they reset all our blacklist for nothing. got it

LMAO peak sindri behavior

https://i.ibb.co/RTQdQ0nn/Untitled.png

That didn't even take two weeks. :rolleyes:

Quote:

---

Originally Posted by JohnConstantine

https://i.ibb.co/RTQdQ0nn/Untitled.png

That didn't even take two weeks. :rolleyes:

---

This is so upsetting, now I know not to login on any alts and just play on my two mains :(

Promised the friend who paid this sub I'm currently posting on I'll play on the alt if they fix this. He was very adamant that it'd be fixed because Yoshi-P said so. He was hopeful. I was not. He called me out on always being pessimistic. I said I was being realistic.

Whoaaaaaaa look what happened! They ain't fixing shit! How could anyone see this coming! And as an added bonus, looks like the playerbase is back to ignoring it as well!

Quote:

---

Originally Posted by JohnConstantine

https://i.ibb.co/RTQdQ0nn/Untitled.png

That didn't even take two weeks. :rolleyes:

---

Actually asking for an update....

Quote:

---

Originally Posted by kajv95

Promised the friend who paid this sub I'm currently posting on I'll play on the alt if they fix this. He was very adamant that it'd be fixed because Yoshi-P said so. He was hopeful. I was not. He called me out on always being pessimistic. I said I was being realistic.

Whoaaaaaaa look what happened! They ain't fixing shit! How could anyone see this coming! And as an added bonus, looks like the playerbase is back to ignoring it as well!

---

This is so sad to say... I don't even think they are ignoring it at this point... I just think they have stopped caring, because clearly short of there being an objective legal issue due to third-party, then they clearly aren't going to do anything but insist and double down on this design.

Quote:

---

Originally Posted by kajv95

Looks like the playerbase is back to ignoring it as well!

---

This is the key here. The developers wait out everything, if they can get away with it. SE just prays that the playerbase forgets about it one day.

Quote:

---

Originally Posted by kajv95

looks like the playerbase is back to ignoring it as well!

---

because 99% of people dont feel affected and dont care :shrug:

Quote:

---

Originally Posted by kajv95

looks like the playerbase is back to ignoring it as well!

---

What else are they supposed to do at this point? They did protest, Square Enix promised to fix it, and their solution is so hilariously bad on a technical level that its unfathomable how that "fix" even made it into the game. Yet here we are.

The technical ineptitude of the developers is legit scary, and there is a good chance that any further attempts at a fix could just end up making things worse. Imagine an anti-tamper mechanism that autobans people on a false positive with no way to appeal that with the support staff. And yes, I fully expect them to rather implement something shit client side instead of just moving the blocking logic server side and pushing a single bit to the client for each loaded character that determines if said character you encounter is blocked or not.

Quote:

---

Originally Posted by ovIm

What else are they supposed to do at this point? They did protest, Square Enix promised to fix it, and their solution is so hilariously bad on a technical level that its unfathomable how that "fix" even made it into the game. Yet here we are.

The technical ineptitude of the developers is legit scary, and there is a good chance that any further attempts at a fix could just end up making things worse. Imagine an anti-tamper mechanism that autobans people on a false positive with no way to appeal that with the support staff. And yes, I fully expect them to rather implement something shit client side instead of just moving the blocking logic server side and pushing a single bit to the client for each loaded character that determines if said character you encounter is blocked or not.

---

For starters, don't use rot13 cipher, like they did to "fix the glitch". That is the laziest way to do things, yet that's the route they chose. Because they are being lazy with it, downplaying it, and frankly don't care but have to give the impression they do care...

The unnamed plugin has been updated to bypass 7.2's terrible obfuscation method.

https://support.na.square-enix.com/c...382&la=1&fty=2
>Report a case to the Special Task Force
>Report use of third-party software

Upping this one, as threads are getting shamelessly deleted.
If you need to moderate then moderate - state the reason and explain what exactly is breaking forum rules. Silently deleting the whole threads without any trace only highlights incompetence.

Quote:

---

Originally Posted by SongOfTheWind

Upping this one, as threads are getting shamelessly deleted.
If you need to moderate then moderate - state the reason and explain what exactly is breaking forum rules. Silently deleting the whole threads without any trace only highlights incompetence.

---

Their reason is "Disparaging Square Enix" LOL

I don't get it...
What exactly was circumvented and what exactly does it means?
A technical explanation would be great.

Quote:

---

Originally Posted by GiR_Zippo

I don't get it...
What exactly was circumvented and what exactly does it means?
A technical explanation would be great.

---

At the launch of Dawntrail's Early Access, it was discovered that, to facilitate the new Blacklisting features, each service account's unique identifier is being broadcast to everyone within the zone you're in. This unique identifier is used to identify the player on a service account level, meaning every character on that service account shares the same unique identifier.

Some unhinged people created a tool that farms that data to create a database, allowing the users of said tool to track players on a per-user level. This also lets you know which retainer belongs to which player, which de-anonymizes the market board to a great extent and opens the door to harassment.

After the issue was ignored for a long while, originally a statement was made here, basically asking them to kindly stop.
This, of course, did nothing, and there was the outcry that the issue was at a system level. Because it is. So in a Live Letter leading up to 7.2, they announced that they would be implementing measures... for 7.2. Which was still like a month away. People weren't happy with it, but hey, atleast they were doing something, right?

Fast forward to 7.2's release. They delete everyone's blacklist to accomodate for the new system. In reality, all they ended up doing was adding an obfuscation layer to the unique identifier, which was broken within 24 hours. The problem is that this is being handled client side at all, which many users commented on at the time as being the worst possible implementation possible. So the obfuscation layer is fully cracked, the tool updated, and we're basically right back to where we started.

As for what this means; it means there's a database that keeps track of who you are across all your characters and retainers, which can be used very easily for cyberstalking :)

Thank you for the explanation, but after reading some of the posts from NotNite it left me with an other question:

Quote:

---

Originally Posted by kajv95

... all they ended up doing was adding an obfuscation layer to the unique identifier, which was broken within 24 hours.

---

Where did they added the obfuscation layer aka what was obfuscated (memory, networkstream, graphic data) ?

Oh and kind of a confusion:
SE introduced the issue by implementing the Blacklisting?

Quote:

---

Originally Posted by GiR_Zippo

Thank you for the explanation, but after reading some of the posts from NotNite it left me with an other question:

Where did they added the obfuscation layer aka what was obfuscated (memory, networkstream, graphic data) ?

---

The packets of data sent to your client when you blacklist someone, which is what contains the account ID. They used a slapped together homebrew solution instead of something that's actually a reliable staple in the industry, but there's no good reason for this data to be sent to the client at all.

Quote:

---

Originally Posted by Daralii

The packets of data sent to your client when you blacklist someone, which is what contains the account ID. They used a slapped together homebrew solution instead of something that's actually a reliable staple in the industry, but there's no good reason for this data to be sent to the client at all.

---

If I got that right, there is no reason to send this data, they only obfuscated the network data and sending this data was introduced by adding the blacklist feature?

Quote:

---

Originally Posted by GiR_Zippo

Thank you for the explanation, but after reading some of the posts from NotNite it left me with an other question:

Where did they added the obfuscation layer aka what was obfuscated (memory, networkstream, graphic data) ?

Oh and kind of a confusion:
SE introduced the issue by implementing the Blacklisting?

---

The player ID was obfuscated in a very basic calculation that was of course cracked within a day. Even then the obfuscation was static so if you were using the stalker plugin by yourself literally nothing had changed.

Before Dawntrail the blacklist just blocked one specific character, the person that character belonged to could just log in to another character on that same account and talk to you again. SE then changed it so that if you blocked one character you would block that person's entire service account from messaging you. Problem is your client needs to know who to block and who you are blocked by. In a competent game this information would only be handled by the server. SE decided to simply send your account ID to everyone's client. Because SE is now broadcasting your account ID it makes it trivial to find out any and all other characters aswell as retainers you have on your account. If you use an alt to be left alone by a stalker, that stalker now knows that's your alt.

Quote:

---

Originally Posted by Saraide

The player ID was obfuscated in a very basic calculation that was of course cracked within a day.

---

What was to be expected, sadly.

Quote:

---

Originally Posted by Saraide

Even then the obfuscation was static so if you were using the stalker plugin by yourself literally nothing had changed.

---

I read the posts from NotNite and could it be that the "stalker plugin" it self is now using the library NotNite retweeted?

Quote:

---

Originally Posted by Saraide

In a competent game this information would only be handled by the server.

---

Means SE could easily set the visibility from a blacklisted player server side to 0 and suppress the chat messages.
Basically the same situation we have now (he can see you, you can't), just done server sided?

Quote:

---

Originally Posted by Saraide

... If you use an alt to be left alone by a stalker, that stalker now knows that's your alt.

---

Basically an automated version, few ppl did back in the days by lodestone?

Quote:

---

Originally Posted by GiR_Zippo

Basically an automated version, few ppl did back in the days by lodestone?

---

The main difference is that you can set your Lodestone to private, but this packet sniffing method lets people keep lists of all your characters and retainers, and because your service account ID is immutable, no changes you make to your characters or retainers will obfuscate that it's still you. The plugin was also on Github for a while(I think it got pulled around the time SE's "Please stop" statement came out), so it got forked plenty and people have their own databases apart from the main one.

It doesn't matter anymore. If you've played the game in the last 6 months, just assume everyone knows who all your characters are. The important information isn't the arbitrary account id, it's the characters who have it. Obfuscating that and/or changing the internal IDs doesn't change what characters you play.

SE was way too slow to react to this for it to make any difference.

Quote:

---

Originally Posted by Arzalis

It doesn't matter anymore. If you've played the game in the last 6 months, just assume everyone knows who all your characters are. The important information isn't the arbitrary account id, it's the characters who have it. Obfuscating that and/or changing the internal IDs doesn't change what characters you play.

SE was way too slow to react to this for it to make any difference.

---

I haven't logged into my alts since July. I've been wanting to, but this keeps going on :)

Hey I know the stalking situation is bad but remember you can always just buy a new outfit in the cashshop instead! Your money will definitely be spent well on improving the game!