BRAVE FC Letter to FFXIV (Security system glitch)

[iMustafa18]

Dear Square Enix (FFXIV Team Developers)

Greetings from [Edited by Moderator], Better known as my online ID in Final Fantasy XIV “Lionel Lightshield, Founder of The Zodiac Brave Free Company “BRAVE”. I would like to first command and appreciate the work you all put into making this game the beautiful game it is today, I have been playing ever since A Realm Reborn release acrossing through Heavnsward and Storm Blood and absolutely looking forward for the release of Shadowbringers. Great content allowed me to a nice opportunity into making a big and nice community within the game to enjoy and share the experience at most level.

In regards to my letter, however, I am approaching with all respect to discuss an issue that occurred in game on June 4th, 2019. We discovered that a trusted member of our FC's account unfortunately got hacked, resulting an incident where a total of 190,000,000 Gil, which was saved over a very long time by the donations of multiple FC Members, was stolen from the Free Company Chest. The victim's account has since been re-secured by a password change and the addition of a security token, which is something we are now requiring for all high-ranking members of the free company.

The method by which this incident occurred is what is making us concerned and is why we are approaching for the developers for cooperation in solving this issue. Our FC contains 10 ranks, with the top 4 ranks designated as management roles, giving these ranks access to certain settings (mostly the ones related to member and free company management) that the rest of the members cannot use. We have Gil withdrawal access limited to only three people in the two highest ranks, the Free Company Master and the two other leaders. However, the member who's account was hacked had permissions to promote/demote members, which we discovered (after the fact) meant that they could promote themselves or other players to any rank in the free company except for FC Master, meaning they were effectively able to give or gain access to any and all permissions that were not exclusive to the FC Master. Because of this, the hacked account was able to invite a new member to the FC, promote the member to the second-highest rank (which was above their own rank), then the new member was able to withdraw the Gil from our chest, after which they were discharged by the hacked account.

We are unsure if the game's official team is aware of such a scenario, but we would still like to point it out, as well as try to find a solution since this incident created chaos within a very friendly FC that has been around for over four years. Our security within the FC was taken very carefully, according to the maximum possibility that the game allows us to. This has become an emergency situation with unfortunately bad timing, especially considering the short amount of time left before the release of the new expansion, Shadowbringers. We tried to reach an in game GM via reports as soon as we discovered the issue and they escalated the issue to a GM supervisor, but we have yet to be contacted or told of any developments by them ever since. Please work with us to come up with the best possible solution to minimize the losses, and hopefully fix some of the Free Company settings to avoid such problems in the future, for both our Free Company and the free companies of players around the world.


Sincerely,
In game FC leaders:
Lionel Lightshield
Devil Johan
Stella Iris

[Dynratygus]

Thank you for posting in the Final Fantasy XIV Technical Support Forums.

We apologize for any inconvenience that has occurred when playing Final Fantasy XIV. Unfortunately the issue you are describing is not a technical issue. I will be moving this thread to "General Discussion".

Hope to see you online!

[linay]

Maybe they should make it so you can't promote over your rank. Either way, I think that permission should only be given to the next rank down from the FC leader at most and not any rank below that.

[NessaWyvern]

Yeah, being able to promote over your current rank always baffled me about FCs.

[Rosentretter]

What happened to you and your FC is very unfortunate. I just wanted to point out the coincidence on Free Company name and Tag, we created the Zodiac Braves in Twintania yesterday, of course we didn't knew there were more FCs with that name.

If it helps, this situation will help us to be careful with everything FC related. I hope you can find a solution to your problem, I bet it feels really bad. Tell us how it goes!

[Yshnal]

We reported this ages ago, and it hasn't been fixed yet. At this point I doubt that they'll get to it, and I want to think that it's due to a good reason and not just because they haven't bothered to do it. I mean, it makes absolutely no sense that anyone can promote any character beyond their own rank, when I think that it should always be limited to a max of their own rank-1.

[Nedkel]

I would like to know how your friend got his account hacked.

[Canadane]

This isn't broken, it's just a misunderstand about how FC ranks works.
There's only two FC ranks. Master and not-master. You can divvy up privileges among different ranks but if you give one promotion or demotion allowance, they can go above and below their number designation, because to anyone who isn't the FC master, they are equals.
Again, while it's caused problems, the system is working as intended.

As for you getting hacked, be wary of suspicious twitch streams I guess. It's apparently becoming much more common, a friend of mine who I thought was a lot more smart about these things had it happen to him and his FC last week. Something like 40 million gil gone in a drunken stupor. The problem with the way these work is that even a one-time password authentication can't stop them. You're putting your info, OTP included, into a not-SE website, which just automatically attempts the info into the game client on the hackers computer. And after that it's too late.
At least, that's going to be my educated guess in how that all happened due to the severity of the number of issues these Twitch streams with fake links have been popping up more recently.

[Avidria]

This isn't broken, it's just a misunderstand about how FC ranks works.
There's only two FC ranks. Master and not-master. You can divvy up privileges among different ranks but if you give one promotion or demotion allowance, they can go above and below their number designation, because to anyone who isn't the FC master, they are equals.
Again, while it's caused problems, the system is working as intended.

Wow. That's a pretty darn silly way to have the ranks set up in system where permissions are assigned by rank. WTH?

[Valkyrie_Lenneth]

Wow. That's a pretty darn silly way to have the ranks set up in system where permissions are assigned by rank. WTH?

Honestly, the ranks work fine. Just don't give people the ability to change ranks, outside of like, 1 other person. My FC is pretty much only made up of RL friends, and we only have 2 people with rank promotion privileges, me and the master. Only 4 of us can withdraw gil. me, the master, her husband, and another friend. Only 2 of us can relocate the house.

Its not so much paranoia as it is precaution and being smart. We don't have a reason to relocate, so no one can. We don't have much gil in the chest, but few can access it. Accidents can happen even with friends, so we are careful.