Patch 7.2's Account ID protection measures have already been circumvented

[ServerCollaps]

are people scared of getting their erp and pvp alts exposed or whats the matter of everyones panic?

[Rehayem]

are people scared of getting their erp and pvp alts exposed or whats the matter of everyones panic?

The problem: Many Final Fantasy XIV players have a habit of stalking other players due to various reasons to the point where you can't play the game without being harassed on a daily basis. It already happened outside the game, and in the future, will end up with someone getting hurt, or even possibly die.

The attempted solution: the blacklist revamp was a response to the article I linked, but SE has no Q&A or IT-team to test their services and code. What ends up happening, is that they have linked a specific unique identifier to your account, sent over by network and stored locally on your device. By seeing what the unique identifier is, you can see that account's characters, retainers, creation time, live-location and so on. This is what a particular plugin can do, and people have been warned since DT's release that this is a ticking time bomb.

SE's piss-poor "new" attempted solution: because SE has shown little care, they only gave empty threats to the plugin's developer with a lawsuit (good luck on that lmao) and promised a solution for 7.2 to patch the hole. They created an in-house wannabe cryptography that was cracked within 24 hours rather than use something that's industry standard for better security.

This was already talked to death, but it shows how weak the code already is at this point, and believe it or not, this will get worse. Eventually.

[Neoyoshi]

Stop relying on a system that clearly isn't working as intended.

Human intervention is the only real solution to this; if people are being put into situations of harassment, stalking, being threatened, etc, it's needs to be reported and dealt with properly by an actual human-being.

[brinn12]

are people scared of getting their erp and pvp alts exposed or whats the matter of everyones panic?

You do realize that some of the people stalking have had restraining orders issued against them in real life, right? Legit court cases.

[kajv95]

are people scared of getting their erp and pvp alts exposed or whats the matter of everyones panic?

Explanation: Final Fantasy XIV has had a stalker problem for a long while. If you haven't heard of this, it's because it doesn't affect a large amount of the playerbase, but it does still happen. Reporting for harassment usually doesn't help unless they say bad words, and the lodestone basically makes stalking through servers and name changes painfully possible. While the blacklist update was meant to help (not just making a blacklisted player vanish, but also their entire service account meaning they can't just hop on an alt and continue), this update had the added benefit for the stalker party that the unique identifier for an account is now broadcast to every player in the zone you're in.

This probably doesn't seem like a big deal until you've had to deal with it yourself. Because just like everything else in this godforsaken game, the blacklist is a one-way street. They can still see you, follow you, and decide to talk shit about you to every single person you might be talking to or meeting. They can continuously attempt to damage any and all social relations you might have in this MMO, a player-driven and social game. And with the third party tools, you're able to create a "stalker network" as it were, tracking people everywhere on a player level. And using the broadcasted unique account identifier, they can do it with any character on that service account you might be playing on, with zero repercussions, because most of the time, reporting this kind of behavior doesn't do anything. It's honestly ridiculous.

If this doesn't seem like a big deal to you, then, yeah - it probably never will be a big deal to you until you've had to deal with something like that. For others though, such as myself, I'm just not playing any alts (not even on main tbf) until this issue is resolved, which it doesn't look like it ever will at this point.

[Exmo]

The mechanism of the account ID being sent to the client is just the vector used stalker plugin to expose alts. So long as the blacklist feature works globally against a player and all their alts, a malicious player would be relatively easily able to discover the alts of their target. Even if the blacklisting was managed server-side.

[sindriiisgaming]

https://bsky.app/profile/notnite.com/post/3lladdcxq5s2h

The solution is to stop sending IDs to the client in any form. There is absolutely no other solution.

im glad this threat reappeared after it seamed to go back out of earths orbit for a while



Im not trying to downplay the legitimate concern that people have here, and i know theres no NICE way to say this. but i think somebody has to say this, 99% of players in the game will never be effected by this, and honestly, if somebody wants to use a plugin this badly to stalk you, idk man id find it impressive i managed to get that popular.. just dont reply to them, black ignore and move on. its pointless to be upset about things you have No control over.

perhaps this problem should open SE eyes to the fact we need a 2 way BL system. i want to be able to choose who sees me. instead of sticking my fingers in my ears

The problem: Many Final Fantasy XIV players have a habit of stalking other players due to various reasons to the point where you can't play the game without being harassed on a daily basis. It already happened outside the game, and in the future, will end up with someone getting hurt, or even possibly die.

literally, just, ignore them. this isnt going to go into IRL, you cannot link in any way a players account to their account information like name address ect. this is complete hysteria.
also this story has nothing to do with plugins, this is just an off-related case of somebody stalking somebody in the same country as them. people need to remember to exercise caution when meeting others online.

i agree players have a stalking problem, but thats because the game doesn't have a 2way BL system, if it did... people would actually take being BL much more seriously

[Kazuke_Miso]

99% of players in the game will never be effected by this, and honestly, if somebody wants to use a plugin this badly to stalk you, idk man id find it impressive i managed to get that popular.. just dont reply to them, black ignore and move on. its pointless to be upset about things you have No control over.

I mean only <0.1% of people IRL die by getting murdered (at least in first world countries) but we have a whole system that works to prevent murder. You ever wonder why?

[sindriiisgaming]

I mean only <0.1% of people IRL die by getting murdered (at least in first world countries) but we have a whole system that works to prevent murder. You ever wonder why?

Strawman fallacy. im more than happy to hear out a good and solid argument but there is simply no need for that

[Kaurhz]

im glad this threat reappeared after it seamed to go back out of earths orbit for a while



Im not trying to downplay the legitimate concern that people have here, and i know theres no NICE way to say this. but i think somebody has to say this, 99% of players in the game will never be effected by this, and honestly, if somebody wants to use a plugin this badly to stalk you, idk man id find it impressive i managed to get that popular.. just dont reply to them, black ignore and move on. its pointless to be upset about things you have No control over.

perhaps this problem should open SE eyes to the fact we need a 2 way BL system. i want to be able to choose who sees me. instead of sticking my fingers in my ears







literally, just, ignore them. this isnt going to go into IRL, you cannot link in any way a players account to their account information like name address ect. this is complete hysteria.
also this story has nothing to do with plugins, this is just an off-related case of somebody stalking somebody in the same country as them. people need to remember to exercise caution when meeting others online.

i agree players have a stalking problem, but thats because the game doesn't have a 2way BL system, if it did... people would actually take being BL much more seriously

1. It doesn't really if it affects only 1% of players. Generally you would expect a third-party tool to enhance gameplay or facilitate additional features. What the account ID facilitated opened up Pandora's Box, and if people are just going to feign "Well it only affects a small number of people" -> Then this is precisely what will give way for far worse tools to exist in the future. Besides, it's a matter of principle, why should someone else be collecting and processing data which many would deem to be a private or sensitive nature?

2. I mean this with all due respect, and not at all with offense, but you're the last person that should be preaching the choir about "it's pointless to be upset about things you have no control over" - Seeing as you yourself have made threads being just as upset as people here, and arguably over things of which you have absolutely no control over

3. My guy, it doesn't matter if it seeps into IRL behavior or not, people don't come on video games just to be stalked on said video game, or to have to look over their own shoulder on an alt character, because they had to abandon 1 character because of sheer ineptitude around enforcing the Terms of Service with respect to harassment and stalking. Square Enix does far, far little in this respect. Also, if you unironically think that it is absolutely impossible for this to propagate into IRL, then I really don't know what to tell you, even if you were to exercise caution (Which many do).