SE Please start caring about your players privacy.

[programcanaan]

My initial concern with the new blacklist was the prospect that someone was going to exploit and reverse engineer it and intensify the invasive activity. Now more than ever people's sensitive information is vulnerable and the underbelly of the community shows that no low it too low. I can but hope this is swiftly resolved and new strategies and technologies are implemented to protect all the law abiding players. Bonus points if someone gets sued into oblivion.

[Archmortal]

CAN they do it? Are you familiar with the specifics of their system? Is it compatible with everything else and they're just lazy like you say? You're 100% certain?

Of course I'm not familiar with it, but yes I am 100% certain it's within their ability to make that sort of change. However as I said it's a lot of work, I don't know exactly how much because that depends on the specifics of the system. Maybe it's as easy as manually changing the numbers and nothing would break (they'd program something to automate that process but even then it would take time to do it for every account/character), and if it's that easy then not doing it would be so wildly negligent that they have no business continuing to keep the game online with so little concern for player safety. Maybe they'd need to adjust every function that uses it. Maybe some of those adjustments are harder to make than others. Maybe the game's code is such a mess that it's all hard to change. The harder it is, the more work it will take. But it's still just a matter of work. Work they should absolutely do for player safety, but they may not agree with me on the necessity of it.

Maybe they'd rather crack down as hard as they can on any third-party software use and obliterate the Savage/Ultimate raiding scene in the process if they think that's less work. It would be very reasonable for them to decide we can't have nice things after nearing a million accounts have had their detailed character and location history compromised by stalkers. They'd still need to fix the way the blacklist gets account data from the server no matter what though. In fact at minimum they should be rolling back to the old blacklist right now just to stop that database from continuing to grow. I imagine that would need to be rolled out in a patch, or else we'd have seen an emergency hotfix to do it. If Square Enix doesn't do anything at all though this game just becomes a stalker's paradise.

[Rehayem]

Xeno talked about it on his stream but here's a shorter video about it. If anyone's curious how it actually works, Xeno shows a video of a demo around minute 12.

[VanillaWafer]

I think you already know I'm well aware of that.

Do I?

Hi hello, I know we've just started quoting each other, but no, I don't know. I went by what you said in your initial post. Not trying to be mean or sarcastic here and never was it my intention to challenge your intelligence, man.

Mitigating factors still help. None of it will matter if they don't even fix the information vulnerability but if they do at least that much everything else becomes possible to manage instead of being in freefall. The question is will SE dedicate the work to fixing the account ID problem now that so many hundreds of thousands have been compromised. Cuz when I say "let's assume it's too hard" what I mean is "let's assume they aren't willing to do it." They CAN do it, it's well within their ability to do so and for us to lose nothing in the process. But it's a lot of work.

So, how does a name change help, given the fact that your Lodestone ID does not change? You are still discoverable until you put your Lodestone profile to Private, but even then we don't know if it's going to do much of a change. The best move, that I can think of, is to revert back to the old way of handling blacklists until they figure out how to go about fixing the new one. Yes, that is completely lazy for now, but it does mitigate any further damage UNTIL they can roll out a better version.

Sure, they definitely can spend whatever resources to fix their blacklist system, but can they do it in time before everyone's character data gets compromised? I don't think so.

[Dante131]

CAN they do it? Are you familiar with the specifics of their system? Is it compatible with everything else and they're just lazy like you say? You're 100% certain?

It would be crazy if a company this big is not competent enough to work with the code THEY implemented XD. Even if I am not familiar with their systems, I know, as a dev myself, of two ways to fix this BS, but what do I know, right? Like, have an ID on their server side, maybe even with security behind it, and do not start with "the servers can’t handle this" it’s BS. They just don’t want to put some money into hardware that is not from 2010. The other one: revert the change. Rollbacks exist for a reason. The only reason why they wouldn’t do it, even to mitigate until they fix it behind the scenes, would be that they don’t have a backup from before the new BL launched or they don’t know how to do it and I actually don’t know what’s worse. The sad thing is, I could think of all of this. You can, of course, bring some light in here if you know more.

[Dante131]

Do I?

Hi hello, I know we've just started quoting each other, but no, I don't know. I went by what you said in your initial post. Not trying to be mean or sarcastic here and never was it my intention to challenge your intelligence, man.



So, how does a name change help, given the fact that your Lodestone ID does not change? You are still discoverable until you put your Lodestone profile to Private, but even then we don't know if it's going to do much of a change. The best move, that I can think of, is to revert back to the old way of handling blacklists until they figure out how to go about fixing the new one. Yes, that is completely lazy for now, but it does mitigate any further damage UNTIL they can roll out a better version.

Sure, they definitely can spend whatever resources to fix their blacklist system, but can they do it in time before everyone's character data gets compromised? I don't think so.

just to add there is a nono tool which will tell you person changed its name

[Archmortal]

So, how does a name change help, given the fact that your Lodestone ID does not change?

Any iota of inconvenience to the malicious party helps. It's not much on its own and it's bordering on ineffective without SE changing our IDs. But on a large scale that minor inconvenience is the same as adding an extra click to a feature you regularly use. I'm sure we've all seen someone throw their hands up and quit in irrational frustration at minor inconveniences. It wouldn't help against the dedicated problems, but it would reduce the potential volume on a large scale. Stack enough minor inconveniences like that up and it starts to really make a difference. Unfortunately there are only so many tiny inconveniences we can create on our own and for some of it we have to pay money to the company whose lack of account security protocol got us into this mess. SE has to do the bulk of the work to protect us from this crap, and if they don't I'd sooner suggest people outright quit the game or at least switch their sub to a new account than pay for a name change.

just to add there is a nono tool which will tell you person changed its name

Yes, but if SE fixes the blacklist issue that created this problem, it won't be anywhere near as convenient. That's my point. SE still has to fix the blacklist first, or nothing matters.

[Dante131]

Of course. It’s actually a shame that it’s taking them so long to even say something. Other games would have patched it in a hotfix or just rolled it back until they found a solution, but I guess that’s too much to ask from SE. But I guess deleting the threads is more important

[VanillaWafer]

Any iota of inconvenience to the malicious party helps. It's not much on its own and it's bordering on ineffective without SE changing our IDs. But on a large scale that minor inconvenience is the same as adding an extra click to a feature you regularly use. I'm sure we've all seen someone throw their hands up and quit in irrational frustration at minor inconveniences. It wouldn't help against the dedicated problems, but it would reduce the potential volume on a large scale. Stack enough minor inconveniences like that up and it starts to really make a difference. Unfortunately there are only so many tiny inconveniences we can create on our own and for some of it we have to pay money to the company whose lack of account security protocol got us into this mess. SE has to do the bulk of the work to protect us from this crap, and if they don't I'd sooner suggest people outright quit the game or at least switch their sub to a new account than pay for a name change.

I don't think anyone can be fast enough to change their name when all the stalker/tracker/whathaveyou need is your Lodestone Profile ID before you even think about it. This series of numbers in the URL is publicly available.

Could it be possible to have the URL changed to something like /[datacenter]/[server]/[name]? Sure, it's longer than /character/[LodestoneID], but that's probably how I'd go about it. If that name's changed, welp, it's 404'd until someone replaces it.

What you outlined can work if you yourself set your profile to Private if it's that severe, but will the average player do that? Who knows.

[Altera]

Can this cause any issues and get SE in trouble with the EUs GDPR laws about data protection of this plugin can get your account ID data?
I'm wishing FFXIV could go back to how it was when l joined originally in 1.0 and there was zero add-ons or mods as I feel the add-ons seems to cause bigger negatives issues rather than positives. :/