SE Please start caring about your players privacy.

Quote:

---

Originally Posted by Rehayem

A quick Google search using quotation marks on that particular text to hide yourself reveals a lot of people use it, but it'd be lovely if we could know if it actually works.



I had a couple of thoughts yesterday, and I realize that SE's silence on this actually sets a precedent for its userbase. Since they don't care about solving the issue, this will inadvertently encourage people to use more third party tools, be it NA or JP.

---

My concern on top of this is not only the precedent set for the people that use this tool, but for how far people are willing to go with the development of future third-party tools. Now I understand this tool is extremely bad, but if development and use is going to go completely and utterly ignored as if it doesn't exist, or if it goes completely unchecked like it has done so far, then both will get much worse than they already are. Especially now that someone has opened that pandora's box.

Quote:

---

Originally Posted by Yakiomu

I think Square Enix is ​​not unaware of this problem, but is intentionally ignoring it. The deletion by administrators on the jp forum is proof that Square Enix is ​​aware of the problem.
Why are they ignoring it? I'm worried.
Maybe they don't want to spend time or money on solving the problem?
Even if they have the will, don't they have enough capacity?

---

They aren't going to solve it because it would involve reworking the Blacklist system and Account IDs again. Ignoring the fact that this wouldn't get rid of all of the data that has already been obtained, they would have to make Account IDs invisible to the client and use a different system for Blacklisting which is more resource intensive on the server.
They would also have to re-fix Free Trial Accounts not being able to have mail sent to them after each Maintenance ends (Or preferably make it possible to send care packages to your free trial friends legit...) since Trial Status was linked to Account ID in Dawntrail.

And if they do make it that people you've blacklisted can't see you, like Sugar reccomended them to do, that still won't stop people from being able to see their presence in the world with third party tools. Because that already happens now, if you have someone blacklisted they still show up in a popular glamouring tool's player radar.

Your Account ID cannot be linked back to you in any way. The only way that your characters can be linked back to your personal identity is if you have already posted them online in a way that is tied to your IRL identity.

Quote:

---

Originally Posted by LibitIncarne

snip

---

Nothing you've said is a good enough reason for them to NOT acknowledge the problem and at minimum fix the ID's vulnerability on the client-side. They SHOULD do more than absolutely nothing. Because whether it solves the problem entirely or not, doing more than nothing is what's going to make a lot of people feel a lot safer about it.

Fixing the blacklist's current problem won't undo the scraped data, but it's the first necessary step so people can manage any other steps they feel they should take for their own safety afterward. It would also prevent a copy-cat plugin that DOESN'T have any way to opt out or hide your account (assuming that little trick a few posts back works) from causing this same garbage.

Too much time is passing without an appropriate response from Yoshida and the development team. I don't like it.

Quote:

---

Originally Posted by LibitIncarne

They aren't going to solve it because it would involve reworking the Blacklist system and Account IDs again. Ignoring the fact that this wouldn't get rid of all of the data that has already been obtained, they would have to make Account IDs invisible to the client and use a different system for Blacklisting which is more resource intensive on the server.
They would also have to re-fix Free Trial Accounts not being able to have mail sent to them after each Maintenance ends (Or preferably make it possible to send care packages to your free trial friends legit...) since Trial Status was linked to Account ID in Dawntrail.

And if they do make it that people you've blacklisted can't see you, like Sugar reccomended them to do, that still won't stop people from being able to see their presence in the world with third party tools. Because that already happens now, if you have someone blacklisted they still show up in a popular glamouring tool's player radar.

Your Account ID cannot be linked back to you in any way. The only way that your characters can be linked back to your personal identity is if you have already posted them online in a way that is tied to your IRL identity.

---

I don't think you understand the severity of this issue at all. There's plenty of solutions they can make, for one, they'd need to revert the blacklist changes and remove the unique identifiers from all accounts. They placed them, they can remove them.

Secondly, this tool can see all your characters, retainers, exact location, login/logout times, character creation date and much more, without you even being aware of it.

Just because your account ID cannot be linked to you yet, doesn't mean it's not a ticking bomb ready to happen. If a man in Tokyo was able to stalk a woman in FFXIV first, then in IRL, surely you understand that this tool basically allows you to skip hoops in figuring out who's behind the screen. It will happen eventually, and someone will get hurt.

Quote:

---

Originally Posted by Rehayem

I don't think you understand the severity of this issue at all. There's plenty of solutions they can make, for one, they'd need to revert the blacklist changes and remove the unique identifiers from all accounts. They placed them, they can remove them.

Secondly, this tool can see all your characters, retainers, exact location, login/logout times, character creation date and much more, without you even being aware of it.

Just because your account ID cannot be linked to you yet, doesn't mean it's not a ticking bomb ready to happen. If a man in Tokyo was able to stalk a woman in FFXIV first, then in IRL, surely you understand that this tool basically allows you to skip hoops in figuring out who's behind the screen. It will happen eventually, and someone will get hurt.

---

Man don't push for reverting the blacklist??? The connections made with our chars and accountIDs won't be erased even if they 'fix' the blacklist. No thanks. Holy.
The information is out there, the damage has been done. Stop trying to strip any kind of protection this game has from people. I'm being realistic. I'm done coping that SE can change this.

Imagine someone knows all the info about you and they can freely make alts on their main accs to harass you, now you gotta wait for GM to act instead of being able to blacklist the entire account.

SE doesn't care unless they look racist/-phobic. They won't make an announcement throwing themselves under the bus. What they've been doing is damage control.

Quote:

---

Originally Posted by Rehayem

I don't think you understand the severity of this issue at all. There's plenty of solutions they can make, for one, they'd need to revert the blacklist changes and remove the unique identifiers from all accounts. They placed them, they can remove them.

Secondly, this tool can see all your characters, retainers, exact location, login/logout times, character creation date and much more, without you even being aware of it.

Just because your account ID cannot be linked to you yet, doesn't mean it's not a ticking bomb ready to happen. If a man in Tokyo was able to stalk a woman in FFXIV first, then in IRL, surely you understand that this tool basically allows you to skip hoops in figuring out who's behind the screen. It will happen eventually, and someone will get hurt.

---

It's definitely very easy for people that use the same name in multiple places. There are plenty of people with 15+ years of internet history tied to the same name, and if they used that name for XIV or anything that connects to their character(the forums or Discord, for example), one crazy person can and will trawl through everything they can find to locate one slipup. Something extreme like scrambling every identifier ID and mandating name changes would be a pain in the ass for everyone from the developers to the players, but I can't think of another way to mitigate it at this point, and it's only going to get harder the longer they leave it unaddressed.

On the surface, obviously, they say "3rd party programs bad, don't use them", but absolutely know a ton of people use them [Just look on twitter for like 2 seconds to all the mods people use with characters and QOL features] along with several using things for battle content and whatnot. So it's just one of those "Don't show, don't tell" sort of situations. I am not pointing this out not because of the "Grey line", since that is irrelevant with the current conversation. I am pointing this out because, unfortunately, if they do actually acknowledge this massive issue due to the 3rd party program being used to essentially exploit a problem with the blacklist system that they willingly put in, then I am genuinely expecting nothing more from them then their generic PR copy-paste speak of "All 3rd party tools are bad, so please don't use them", and then they move on with their day.

As much as many would love Yoshi-P and the devs/Square Enix to, well, actually care: they most likely won't care as much as people think they should. I'm not going to downplay any issues people have or argue with people who think this is just a giant nothing burger and everyone needs to stop crying about it or whatever, but you have to really look at it from a track-record of how they treat 3rd party programs as a whole and the mindset they might have when addressing things.

All you really can do now is ask yourself: "Will Yoshi-P and the Devs in it's current state fix this in a timely manner and/or address player's concerns about it and acknowledge the issue? Or will Yoshi-P and the Devs just go "Well, we warned you, we told you not to use 3rd party programs" and just shrug their shoulders and leave it at that and just blame the entire thing on outside programs without even attempting to understand the issue that some players are having with this whole thing the first place?"

This entire issue ultimately stems from how they implemented the blacklist due to the changes they made to it, and it is unfortunately completely up to Yoshi-P and the Devs to fix at this point.

Ah we got a message from yoship about the stalker plugin made for and by stalkers.

Edit: It's not a pinned thread so I'll repost it here:

Quote:

---

Regarding the Use of Third-Party Programs and Player Safety
Hello, everyone. Producer and Director Naoki Yoshida here.

We have confirmed that there exist third-party tools that are being used to check FFXIV character information that is not displayed during normal game play. The tool is being used to display a segment of an FFXIV character's internal account ID, which is then used in an attempt to further correlate information on other characters on the same FFXIV service account.

The Development and Operations teams are aware of the situation and the concerns being raised by the community and are discussing the following options:
Requesting that the tool in question be removed and deleted.
Pursuing legal action.
Aside from character information that can be checked in-game and on the Lodestone, we have received concerns that personal information registered on a user’s Square Enix account, such as address and payment information, could also be exposed with this tool. Please rest assured that it is not possible to access this information using these third-party tools.

We strive to offer and maintain a safe environment for our players, which is why we ask everyone to refrain from using third-party tools. We also ask that players do not share information about third-party tools such as details about their installation methods, or take any other actions to assist in their dissemination.

The use of third-party tools is prohibited by the FINAL FANTASY XIV User Agreement and their usage could threaten the safety of players. We will continue to take a firm stance against their usage.

Naoki Yoshida
FINAL FANTASY XIV Producer & Director

---

Quote:

---

Originally Posted by Naoki_Yoshida

The Development and Operations teams are aware of the situation and the concerns being raised by the community and are discussing the following options:

• Requesting that the tool in question be removed and deleted.
• Pursuing legal action.

---

No consideration of reworking the blacklist feature fixing the amateurish implementation of a security feature that exposes more information than required I see.

To little too late. The Data is already collected anyway.

what a nothing burger statement. fix the exploit that made the plugin possible in the first place.

The epitome example of fixing the symptom rather than the cause.

It won't take long before another unknown party replaces the gap left by this policed tool and resume collecting the internal account ID that's somehow readily available client-side, w/ any packet interceptor tools, then we're back at square one.

Quote:

---

Originally Posted by Rein_eon_Osborne

The epitome example of fixing the symptom rather than the cause.

It won't take long before another unknown party replaces the gap left by this policed tool and resume collecting the internal account ID that's somehow readily available client-side, w/ any packet interceptor tools, then we're back at square one.

---

Because it is no longer talked about does not mean that it has ceased to exist, it is still out there and is continuing to collect data. So it won't necessarily take another replacement, the original is still there.

Quote:

---

Originally Posted by Saraide

Ah we got a message from yoship about the stalker plugin made for and by stalkers.

Edit: It's not a pinned thread so I'll repost it here:

---

kinda mad that i couldn't reply to this thread. i wanted to ask him if he was planning on revamping the blacklist so it worked 2 ways

Quote:

---

Originally Posted by Rueby

Man don't push for reverting the blacklist??? The connections made with our chars and accountIDs won't be erased even if they 'fix' the blacklist. No thanks. Holy.
The information is out there, the damage has been done. Stop trying to strip any kind of protection this game has from people. I'm being realistic. I'm done coping that SE can change this.

Imagine someone knows all the info about you and they can freely make alts on their main accs to harass you, now you gotta wait for GM to act instead of being able to blacklist the entire account.

SE doesn't care unless they look racist/-phobic. They won't make an announcement throwing themselves under the bus. What they've been doing is damage control.

---

That’s a pretty shortsighted view. At the moment there is no escape from a stalker aside from starting a new service account. At least if they fix it so the accountid is hidden, then it would be possible to start new alts without them being tied to the info thats already out there.

AccountID needs to be hidden from the client, prohibiting third parties is already prohibited by the ToS you cannot take legal action against unknown persons if anyone can make their own version of the plugin. Need a fix upstream of the problem no repeating the obvious which is already in the ToS. All plugins are banned, and we should all respect the ToS.

Quote:

---

Originally Posted by Videatur

Because it is no longer talked about does not mean that it has ceased to exist, it is still out there and is continuing to collect data. So it won't necessarily take another replacement, the original is still there.

---

You are correct, it's still out there probably. Just not publicized anymore. I'm just saying that one probably don't even need this original tool when there are other more wildly known, more established packet sniffer tools out there that can be used to pick up the same value.

If there's anything consistent from this incident, apparently SE allows us to stalk, just don't be stupid and upfront about it lol.

I don't really think YoshiP's statement solves the issue at a fundamental level. This person's GitHub repo for the plugin was public. Anyone can copy it. Because of how SE ties everything to your account ID due to the new blacklist system, anyone can still grab this information and do similar things pretty easily. This doesn't address the fundamental, underlying issue.

Quote:

---

The Development and Operations teams are aware of the situation and the concerns being raised by the community and are discussing the following options:
- Requesting that the tool in question be removed and deleted.
- Pursuing legal action.

---

Neither option stopping the game from displaying such information
How does this do anything when it's been forked a million times already and there are already alt servers
The ones who keep quiet can just keep happily doing what they're doing?

Quote:

---

Originally Posted by Rein_eon_Osborne

You are correct, it's still out there probably. Just not publicized anymore. I'm just saying that one probably don't even need this original tool when there are other more wildly known, more established packet sniffer tools out there that can be used to pick up the same value.

If there's anything consistent from this incident, apparently SE allows us to stalk, just don't be stupid and upfront about it lol.

---

Friendlist removal is still one way, right?

Amazing how they make a post addressing this but take absolutely no responsibility for it. The information should not have been visible in the first place.

This isn't really that great...

The fundamental concern should have been stated, and that is.. What are they actually doing about the account ID being exposed in such an insecure manner. I could've understood if they said they would be reverting the changes for the immediate future and exploring other -- and more secure avenues in the meanwhile. I could at least understand this. But they've took no responsibility for this at all.

Requesting the removal of the tool will do nothing, it will just be a... 'Cut off 1 and 2 more shall just take its place' Type situation. I suppose they are hoping that stating they're considering pursing legal action will act as a sufficient enough deterrent from people pushing this boundary in the future, especially if they actually do pursue legal action.

Can't say much more than what people have already pointed out, but I also find it very strange that it's a simple forum post that's gonna get buried in no time as opposed to a lodestone blog post, as well.

Typical inaction. C&D does nothing when it's been forked over and over.

Quote:

---

Originally Posted by Kaurhz

Requesting the removal of the tool will do nothing, it will just be a... 'Cut off 1 and 2 more shall just take its place' Type situation.

---

Yes and no, i am convinced this is not aimed at a specific Plugin but would be aimed against main repo dalamud devs: not cut a branch, get the whole tree and roots out of ground.

The thing is, even if they do that, as long as we have a public ID, everyone who spend some months on programming or just knows the basic of how to read even cheatengine can use the account ID, their approach is really odd

It is sad that Mr. Yoshida hasn't mentioned that such plugins appeared because Account IDs were exposed to player clients.

I hope that Account IDs will be hidden; otherwise, there will be another plugin with the same functionality. And another. And another.

Oh hey, the removal from the friend list working two ways would be nice to have too.

IMO the thing that's actually missing from this announcement is a commitment to help people who are getting stalked.

also lol, "please don't talk about these tools so our bad dev practices won't get called out"

Quote:

---

Originally Posted by Saraide

IMO the thing that's actually missing from this announcement is a commitment to help people who are getting stalked.

---

Easy, turn off the game

SE too afraid to take down all plugins so these things will prob not stop

Quote:

---

Originally Posted by Illao

Yes and no, i am convinced this is not aimed at a specific Plugin but would be aimed against main repo dalamud devs: not cut a branch, get the whole tree and roots out of ground.

The thing is, even if they do that, as long as we have a public ID, everyone who spend some months on programming or just knows the basic of how to read even cheatengine can use the account ID, their approach is really odd

---

That's ultimately the issue, even nuking the plugin launcher will do nothing when the same can be achieved with a packet sniffer like Wireshark.

Account IDs need to not be sent to other people's clients period, or this will always be possible, an anti-cheat would do nothing to stop it either.

Quote:

---

Originally Posted by Saraide

Friendlist removal is still one way, right?

---

Unfortunately, yeah.

Quote:

---

Originally Posted by Straticus

Amazing how they make a post addressing this but take absolutely no responsibility for it. The information should not have been visible in the first place.

---

Not surprising. Same story for DT feedback, same for graphical update fiasco. No self awareness they are willing to admit.

Quote:

---

Originally Posted by Rein_eon_Osborne

Unfortunately, yeah.

---

This has always given me the impression that the devs just kinda dont see anything wrong with stalking in general.

The developers need to alter the way the game handles account information. Anything regarding third party tools is downstream of where the problem resides.

Quote:

---

Originally Posted by SilentLynx

The developers need to alter the way the game handles account information. Anything regarding third party tools is downstream of where the problem resides.

---

Yeah, for every very loud and public plugin there are likely a dozen forks doing the exact same thing. This is CBU3s fault at its core with how they botched the blacklisting system and that needs to be addressed internally. A firm letter wont change things.

At absolute best the current response to this plugin's existence will end up with SE playing whack a mole- constantly trying to take down every new plugin that takes exploits the vulnerability in how the new blacklist is implemented. This is actively dangerous to some users in the game and can cause harrassment.
I'm sorry, Yoshi P's response is simply not good enough here. The blacklist system needs to be changed again so that this vulnerability can no longer be exploited.
I know this post is just making the same point several others have made, and I'm sorry for the repetitive comment. But this is a serious issue- this is much more important than chaotic rewards or job balance or homogenization or any other issue people currently have with the game. This is an extremely serious issue of safety and privacy where the mechanism designed to protect people is making them more vulnerable to the people they're trying to protect themselves from.
I hope Yoshi P is working on a better response that includes taking meaningful action.

I was hoping that post would be made to the lodestone, but I guess posting it in the forums will give them less heat for the moment.

I'm impressed they actually replied lol.

No accountability for their crap code, but oh well, it's better than nothing. Now they just need to patch it.

https://files.catbox.moe/jpmv15.jpeg

The repo has already been forked over a dozen times and is hosted in several countries. Lawsuits won’t do anything. Once again, nothing ever happens. Thanks!