SE Please start caring about your players privacy.

The response is a joke and I expected more regarding this issue. They're basically taking the easy way out, being oblivious to the actual cause of this entire mess. Cool, they take it down, maybe sue the crap out of the creator and then? Forks and Packetsniffers will still work, the issue will not be fixed and the stalkers will continue with what they're doing because the IDs will still be sent. While I agree that the creator should face legal action it is also of importance to actually fix the actual issue which allows the functionality of such stalking mechanisms. It's just insane...

I appreciate the response (even if I don't agree that they are doing much against it) but... why was this posted on here and with *no* post on the Lodestone? Most people won't see this unless they get told about it (I only knew it was posted because I saw it being talked about on Reddit).

The response reminds me of the copy and pasted response to the ddos.
"we're working on it lol"

"The Development and Operations teams are aware of the situation and the concerns being raised by the community and are discussing the following options:
Requesting that the tool in question be removed and deleted.
Pursuing legal action."

Or, and hear me out Yoshi, how about you don't let the client know about account IDs at all? You can get rid of this tool, throw lawyers at the developer, only for another guy with a chip on his shoulder to make a similar tool, especially since the data is already out on the internet ready for someone else to take advantage of. This is a very weak, short-sighted response, the only real fix is to reassess the implementation of the new blacklist and move towards a more server-side implementation. If you really, really don't want to do that, then you'd have to compromise on only blocking characters rather than account IDs, which defeats part of the purpose of even having these blacklist changes anyway; just bite the bullet and begin implementing server-side blacklists.

The only way to reverse the damage done completely is to revert the blacklist change and add anti-cheat. Square will never do that, so its GG.

It doesn't matter that they want to pursue legal action to stop the spread. This tool will be passed around through other means that they can't track I'm sure. And since they don't seem to want to revert the change, the amount of new account IDs gathered will only continue to grow. This is what happens when you decide to profit off the dark side of the community instead of trying to mitigate them as much as possible.

Quote:

---

Originally Posted by NaoSen

Pre-DT
1. Location Sharing
2. Friends List being one sided, allowing someone removed to still track you.
3. Eternity ring only affecting the person who ends the marriage.
4. Inability to block or kick someone from your house
5. No alt protection.

Current-DT System
1. Location Sharing
2. Friends List being one sided, allowing someone removed to still track you.
3. Eternity ring only affecting the person who ends the marriage.
4. If third party tools are used person able to track retainers, alts, past character looks, past character locations and more.

---

Big laugh, dude it's a game no one's coming for you at night. Just don't pay attention to them/blacklist jesus :D

"privacy" lololol over a toon that will cease to exist in 10-15years, your personal info is safe no worries.

Quote:

---

Originally Posted by Saraide

This has always given me the impression that the devs just kinda dont see anything wrong with stalking in general.

---

stalking in real life is creepy and a big issue, "stalking" as in following/looking someone in a VIDEOGAME, which btw, you can blacklist and permanently remove the character of your sight. I mean, you can theoretically be "stalked" on any games online but it's just a toon ffs as long as your IRL info is safe idgaf, they can follow me as much as they want

Quote:

---

Originally Posted by TheDustyOne

"The Development and Operations teams are aware of the situation and the concerns being raised by the community and are discussing the following options:
Requesting that the tool in question be removed and deleted.
Pursuing legal action."

Or, and hear me out Yoshi, how about you don't let the client know about account IDs at all? You can get rid of this tool, throw lawyers at the developer, only for another guy with a chip on his shoulder to make a similar tool, especially since the data is already out on the internet ready for someone else to take advantage of. This is a very weak, short-sighted response, the only real fix is to reassess the implementation of the new blacklist and move towards a more server-side implementation. If you really, really don't want to do that, then you'd have to compromise on only blocking characters rather than account IDs, which defeats part of the purpose of even having these blacklist changes anyway; just bite the bullet and begin implementing server-side blacklists.

---

Agreed. Just another reason for people to quit their sub.

"We don't want to fix the code, so just stop using it or we'll sue you."

Yoshida's fucking around and they're gonna find out.

Since all tools are already forbidden, i dont expect only this tool to be taken out. They are in contact with their legal team, right? So i expect an all out war against plogons and mods. Like with Nintendo. Cease and Desists will fly left and right. Especially since a lot of criticism towards too relaxed safety measures has surfaced and so many call for anti cheat or something to punish tool users harder. People want Square to enforce their stance towards tools.

It is so ironic that the response got buried into the 2nd page already
Good job <3

We don't know the extent they're going to. It could be a "we're going after Dalamud" collectively but they're being vague as per the usual PR veil. That said, a forum post that's already slipped to the obscurity of page 2 is a terribly mute precedent to set for something that's gotten a massive portion of the playerbase pissed off and/or nervous. At least pin the thread lmao.

Regardless, choosing this approach exclusively over actually fixing the problem that enabled this in the first place is absolutely mind-blowing. Yes, the PlayerScope dev should absolutely face consequences but as many have said, that's cutting off one head of the many the hydra undoubtedly now has. I could give benefit-of-the-doubt and say that they'll do more than they're saying publicly and keeping that quiet will stop perpetrators from getting ahead of the game, but we're long past that at this point imo. This is just extremely typical avoidance from SE/CS3 regarding issues with the game which have been piling up for years. This has already taken 2+ weeks to respond to, and it's clear they don't understand the full extent of the issue either.

It's ultimately a product of them refusing to act for far too long. I'd like to say that for once, it's not hyperbolic to say that consequences could be further reaching than just one plugin despite the effect that could have on player numbers if Dalamud were to be shafted. However, it is extremely on-brand for SE to blame the playerbase above fixing anything themselves so it's entirely possible nothing happens and time inevitably moves along. Previously they have:

- Banned for QoL plugins then added them themselves.
- Blamed the playerbase for having "bad internet" during the EW launch error 2002 fiasco only for them to eventually find a bug in their server code.
- Threatened us with stopping development of content types over their inability to moderate cheaters (yes, obviously cheating is laughably stupid so players shouldn't do it, but the root of the problem is not being addressed)
- Indirectly told us that we're the problem when they couldn't balance jobs properly during Abyssos (and still can't). This point is far less problematic obviously, but it's another example of blaming the playerbase first.

Now we've got another disappointed dad post about third-party, all while nothing is ever done.

Personally I've given up.

Quote:

---

Originally Posted by Serenaya

We don't know the extent they're going to. It could be a "we're going after Dalamud" collectively but they're being vague as per the usual PR veil. That said, a forum post that's already slipped to the obscurity of page 2 is a terribly mute precedent to set for something that's gotten a massive portion of the playerbase pissed off and/or nervous. At least pin the thread lmao.

Regardless, choosing this approach exclusively over actually fixing the problem that enabled this in the first place is absolutely mind-blowing. Yes, the PlayerScope dev should absolutely face consequences but as many have said, that's cutting off one head of the many the hydra undoubtedly now has. I could give benefit-of-the-doubt and say that they'll do more than they're saying publicly and keeping that quiet will stop perpetrators from getting ahead of the game, but we're long past that at this point imo. This is just extremely typical avoidance from SE/CS3 regarding issues with the game which have been piling up for years. This has already taken 2+ weeks to respond to, and it's clear they don't understand the full extent of the issue either.

It's ultimately a product of them refusing to act for far too long. I'd like to say that for once, it's not hyperbolic to say that consequences could be further reaching than just one plugin despite the effect that could have on player numbers if Dalamud were to be shafted. However, it is extremely on-brand for SE to blame the playerbase above fixing anything themselves so it's entirely possible nothing happens and time inevitably moves along. Previously they have:

- Banned for QoL plugins then added them themselves.
- Blamed the playerbase for having "bad internet" during the EW launch error 2002 fiasco only for them to eventually find a bug in their server code.
- Threatened us with stopping development of content types over their inability to moderate cheaters (yes, obviously cheating is laughably stupid so players shouldn't do it, but the root of the problem is not being addressed)
- Indirectly told us that we're the problem when they couldn't balance jobs properly during Abyssos (and still can't). This point is far less problematic obviously, but it's another example of blaming the playerbase first.

Now we've got another disappointed dad post about third-party, all while nothing is ever done.

Personally I've given up.

---

Going scorched earth on Playerscope or plugins in general at this point would accomplish nothing because the compiled databases are already as big as the LuckyBancho census, and completely detached packet sniffers would still exist, but it's easier than actually fixing the problem and admitting their mistake. They'll probably add Denuvo or EasyAntiCheat and say they fixed everything.

Quote:

---

Originally Posted by Daralii

Going scorched earth on Playerscope or plugins in general at this point would accomplish nothing because the compiled databases are already as big as the LuckyBancho census, and completely detached packet sniffers would still exist, but it's easier than actually fixing the problem and admitting their mistake. They'll probably add Denuvo or EasyAntiCheat and say they fixed everything.

---

I mentioned this earlier already but adding anti-cheat won't prevent the plugins from harvesting data because the information is sent through the network, meaning that if you know what you're looking for, you can use any other app like Wireshark to look it up. What's gonna happen is that someone will make a standalone app and continue harvesting data while SE pretends to care about its userbase.

What the Producer Response proves is that either Yoshida does not have a full technical understanding of the problem - i.e., that there is currently an exploit within the game that is caused by sending all of the player character data client-side, and users who are ignoring the ToS have been taking advantage of that exploit - or that CBU3 has decided to omit that this was caused by improper technical design. Neither of those is going to win favor back with the community, especially when all of the points Yoshida listed in their action plan do not indicate any immediate steps to take, but at least if he had acknowledged it was a technical problem that would have indicated some transparency on the matter.

So the team is confident that it's not a security issue that could cause the player's PII to be compromised and it's only the character data that was exposed as of now. Well, what was the point of implementing the blacklist feature in the first place? To mitigate stalking incidents in-game that escalated into the real-world, wasn't it? Did CBU3 decide it wasn't worth it to revert how the player character data was handled prior to Dawntrail because they are aware that the old design was also extremely poor and did nothing to prevent in-game stalking anyway? If so, what is their reasoning for deciding that the current state of passing the data client-side is somehow better? None of that is in the response.

What I wanted to see was that the team recognized this as an issue that requires a short-term plan as well as a long-term one and I don't see that here. CBU3 only provided minimal tools to mitigate stalking because of their poor feature design prior to the blacklist update, many players were already aware of that prior to this expansion. It's the fact that this was supposed to help address that issue, and has now caused a new issue on a much larger scope purely through the implementation alone, that I have a problem with.

If the users abusing the leaked data are located outside of Japan, what legal recourse does Square Enix even have? Even then, I would be willing to accept that they examined legal options and found no viable ways to pursue the issue if they had also included what they were doing to address this from a technical standpoint, because at it's core this is a technical design flaw. Instead Yoshida's response makes it seem like this is a one-time isolated issue caused solely by this particular third-party tool that broke the ToS and they are proceeding in accordance with that description. That isn't acceptable.

I want further details on what CBU3 plans to do to update the client-side handling of the data in addition to the Producer Response.

Yoshi P just wants play whacka-mole with "hostile" plug ins rather than ADDRESS THE PROBLEM. As usual, lip-service to our issues followed up by no action. It's a Yoshi P trademark at this point. I will honestly be surprised when the day comes that he *actually* addresses our concerns for real.

Dear EN Forum Members
The issue of this tool was also featured in Yahoo! Japan News.
*ttps://news.yahoo.co.jp/articles/0440d97676d3f961aacd80e750486e95e12719be

The news article includes a detailed description of the tool, the announcement on the PD forum, and user concerns.
There are also stories of people who learned of the tool's existence through this report, installed it without much thought, and had their personal information stolen.

My contract is about to expire, so I don't know how long I can comment, but I want to let you know that most JP players share the same thoughts as EN players.

As you probably already know, the correct link is to replace * with h.

I'm using a translator, so there may be inaccuracies or rudeness in the text.

Quote:

---

Originally Posted by Violet

Dear EN Forum Members
The issue of this tool was also featured in Yahoo! Japan News.
*ttps://news.yahoo.co.jp/articles/0440d97676d3f961aacd80e750486e95e12719be

The news article includes a detailed description of the tool, the announcement on the PD forum, and user concerns.
There are also stories of people who learned of the tool's existence through this report, installed it without much thought, and had their personal information stolen.

My contract is about to expire, so I don't know how long I can comment, but I want to let you know that most JP players share the same thoughts as EN players.

As you probably already know, the correct link is to replace * with h.

I'm using a translator, so there may be inaccuracies or rudeness in the text.

---

thank you for continuing to update us, I appreciate you and your efforts!

Quote:

---

Originally Posted by Archeron

Square Enix doesn't care about Privacy. They allowed the Blacklist to be one of the most ineffective tools on any MMORPG for a decade. The only thing worse than the way SE designed the blacklist, is the community finding ways to CONTINUE their predatory stalking behaviours. Really fantastic community we have on this game. I'm half annoyed with Square Enixes fumbling of basic privacy with their awful coding, and half annoyed that we have dedicated communities on this game to enable this behaviour, and no one is ever held accountable for their behaviour.

---

The legal action they're considering would set a precedent to deter those from trying it, but what they really need to do is a better revamp how the system works for sending information. It should've all been server-side from the start, instead of sending something that was probably unencrypted or not well encrypted from the jump. If Square's IT department is what I expect, then I'm honestly not surprised by the huge foresight. What they need to realize is that the cat is out of the bag and people aren't going to stop just because "good pweyas would nevah do dis :3c " kind of mentality. Being able to capture the packet being sent and obtain the kind of information isn't even the worst thing that could start happening. Sure, those stalkers should be systematically rounded up and thrown into an asylum where they belong, but now this is going to be a race that I thing square enix isn't wanting considering by how things currently are that their work force seems stretched so thin.

Someone commented on the JP forums that there's yet another forked database with about 145,000 names registered, all done with Python. The people are clearly seeing YoshiP's message as a joke (because it is) and are, in fact, creating more because this is just another challenge to them.

On the other hand, that post got deleted by the JP moderators because it seems they're going scorched earth, claiming the post "intereferes with service operations".

Quote:

---

Originally Posted by Rehayem

Someone commented on the JP forums that there's yet another forked database with about 145,000 names registered, all done with Python. The people are clearly seeing YoshiP's message as a joke (because it is) and are, in fact, creating more because this is just another challenge to them.

On the other hand, that post got deleted by the JP moderators because it seems they're going scorched earth, claiming the post "intereferes with service operations".

---

this could lead to the Streisand effect. perhaps they should keep trying to sweep it under the rug to piss more people off.

https://www.pcgamer.com/games/final-...eator-to-stop/

Quote:

---

...speaking during the latest Letter from the Producer livestream, Yoshida revealed counter-measures would be introduced, starting in Patch 7.2 releasing in late March.

Community producer Toshio "Foxclon" Murouchi ...reassuring players that the plugin's exploit begins and ends at character information...."However, we are taking it seriously because it is not good to read that internal connection … we are not very comfortable with it."

Murouchi clarified that the team wants to "keep the same level of the blacklist function," but it seems like additional steps are being taken to try and keep account IDs away from prying hands in the future.

Translations courtesy of the Final Fantasy 14 Discord server offer a little more insight into Yoshi-P's thoughts, with him telling viewers: "I am very disappointed that this kind of tool exists, but we will be improving the system going forward," while later adding "Obviously we as a dev team are not ignoring this, I cannot say how far we're going but with Patch 7.2 we are taking steps to counteract this."

---

Quote:

---

Originally Posted by Shnrnr

https://www.pcgamer.com/games/final-...eator-to-stop/

---

So basically absolutely nothing new and nothing will be done, this is just like the DDOS "counteractions", nothing happens. SE's motto is "wait it out until people stop talking about it".

The second you get online and go anywhere your privacy is forfeited honestly doesn't matter what SE does if someone really wanted to they could get w/e they want off someone

Quote:

---

Originally Posted by Shnrnr

https://www.pcgamer.com/games/final-...eator-to-stop/

---

"... ends at character information"

But it gets the unique account identifier tied to a player's service account....................

Quote:

---

Originally Posted by Shnrnr

https://www.pcgamer.com/games/final-...eator-to-stop/

---

With 7.2 right around the corner, I guess we'll see if Yoshida's word about these "counter-measures" is actually worth anything. Personally, my faith is at rock bottom, and I'll believe it when I see it.

I don't care about any of this ... I don't bother anyone and no one bothers me. That's 90% of the player base you other 10% get a room.

Quote:

---

Originally Posted by sagacious

I don't care about any of this ... I don't bother anyone and no one bothers me. That's 90% of the player base you other 10% get a room.

---

Thanks for telling us.

your welcome peaches (kisses) :)

Quote:

---

Originally Posted by WutWut

With 7.2 right around the corner, I guess we'll see if Yoshida's word about these "counter-measures" is actually worth anything. Personally, my faith is at rock bottom, and I'll believe it when I see it.

---

Countermeasure:

uwu pwweaassee don't install third pawwwty pwwogons or we will be vewwy vewwwy MAD >:O and maybe we will even SUE you!! >:O >:O

And not to be too political but it reminds me of the politicians who vow to fight whatever enemy by sending a sternly worded letter or statement.

Quote:

---

Originally Posted by Clockworks

So basically absolutely nothing new and nothing will be done, this is just like the DDOS "counteractions", nothing happens. SE's motto is "wait it out until people stop talking about it".

---

And the genie is basically out of the bottle too, like basically everyone who played in the last few months is already scraped unless they're just hiding in their house the entire time....

Though I suppose there is probably a large amount of players who are doing exactly that since there's nothing to do in the game anyways lmao. The last few months before I quit I was literally just raidlogging into my house and joining my static private PF and doing some boring ass raid. And a ton of people just log in, enter their house, check for demolition canceled message, then log off for 1.49 months. So I guess the game is so boring that they'll actually miss a lot of people LOL.

Look they are trying it a third time:

https://na.finalfantasyxiv.com/lodes...1e1d0a8d2efdd8

Lets see if its need more than an google sheet to bypass it this time :rolleyes:

Quote:

---

3. Eternity ring only affecting the person who ends the marriage.

---

Hey Square Enix, If you're reading this I have a very valid and sustainable idea to fix privacy and stalking issues related to Eternal Bond so listen up.




Add a new section to the Mog Station called "Manage Eternal Bond".

If a customer goes to the page and they have no active Eternal Bonds it should say "No active Eternal Bonds were found on this service account."


This page should display

- Name of Characters on your service account who have an active bond and the character they're bonded to.
- Anniversary date of each characters bonding.
- Package tier purchased for the specific bonding (Free, Gold, Platinum)


There should also be a button next to each bond listing named "Dissolve Eternal Bond"


Pressing Dissolve should come up a Disclaimer saying -


Eternal Bonds created using paid packages are ineligible for refund.

Dissolving this Eternal Bond is permanent and cannot be reversed.

Please click the box that says "I understand" and press "Next" to continue"



Once the Dissolve is confirmed, the bond should be immediately broken and BOTH characters Eternity rings should be removed and replaced with Replicas that do not have the teleport effect.



That way they can still use the ring for glam purposes but lose the stalker potential from the teleport.





Someone having the ability to click a button and teleport to my exact location EVEN after I've cut contact with them just doesn't sit right with me and is a huge reason why I won't engage with the system.