SE Please start caring about your players privacy.

[WutWut]

The radio silence from Square Enix days later, on a vulnerability that has already leaked the privacy of thousands of players (there was a public pastebin list floating around one of the first days of this), is pretty damning in my eyes. Any other company would have made some sort of statement, rather than just quietly deleting a forum thread and leaving us to assume the worst. Not only has that data been leaked, its in a public, searchable database. That is insanity, and trying to slip this under the rug is completely unacceptable.

I am also tired, and this will probably be the tipping point that causes me to unsubscribe if it continues to go unaddressed. I refuse to give money to a corp that just doesn't care about the privacy of its users, which is what the radio silence says to me.

[Clockworks]

The radio silence from Square Enix days later, on a vulnerability that has already leaked the privacy of thousands of players (there was a public pastebin list floating around one of the first days of this), is pretty damning in my eyes. Any other company would have made some sort of statement, rather than just quietly deleting a forum thread and leaving us to assume the worst. Not only has that data been leaked, its in a public, searchable database. That is insanity, and trying to slip this under the rug is completely unacceptable.

I am also tired, and this will probably be the tipping point that causes me to unsubscribe if it continues to go unaddressed. I refuse to give money to a corp that just doesn't care about the privacy of its users, which is what the radio silence says to me.

750 000 characters have been scanned to this day according to the developer of it.

That says enough lol, and that is with only 17 people scanning, once again according to the developer.

Now imagine when this goes in full release and is available to every single user that wants to get it.

[Shialan]

Yeah, this is a worst case scenario.

Already 750k characters scanned... Which means that their data is out there and no one can erase it. And even if SE would nuke the GitHub page, you can be 100 % sure that people already forked the plugin.

Also, if the developer really is from the EU, you can be sure that almost every character on there is in this database if you played in the last days.

[Kaurhz]

Yeah, this is a worst case scenario.

Already 750k characters scanned... Which means that their data is out there and no one can erase it. And even if SE would nuke the GitHub page, you can be 100 % sure that people already forked the plugin.

Also, if the developer really is from the EU, you can be sure that almost every character on there is in this database if you played in the last days.

There was no other outcome to this tbh.

In regard to this matter SE need to do a damn sight more than just nuking the GitHub page tbh.

[Yodada]

F*** it. Gonna file a complaint about SE based on breach of GDPR. Its up to the authorities to decide how to proceed with Square. Couldnt care less if Square gets fined. The Radio Silence is unacceptable.

[Archmortal]

Let's assume account ID shuffling is too hard. They still need to get rid of the vulnerability, and they could still provide name changes. The Blacklist hiding people isn't a bad idea on paper, but it cannot work on this account-wide basis because it still enables abuse from someone using it maliciously. And then it's already been talked about, all the crap with even blacklisting not taking you off of friends lists and the like. Just bad design that FFXIV is not nearly old enough to be excused for. The devs need to be taking this very seriously. I believe they do take the general idea of harassment and stalking seriously. That they answer feedback about implementation for things like Duty Finder/Frontlines shows they've been aware of the need for these considerations. But then why did they decide to send raw, unhashed account data client-side when they KNOW mods and plug-ins are extremely prevalent? Whatever mindset or oversight of account security protocol led to that needs to be fixed in their offices as much as the security vulnerability itself needs to be fixed.

[Argantaelle]

Well, the addon GitHub page got nuked, so developers of similar addons will go underground, and players will not have an option to opt out anymore.

I sincerely hope that SE will take measures to hide account IDs from plain sight.

[Eyrilona]

This thread is a lot younger than the CAR threads, and also your alts being public isn't a problem unless you have terrible friends that won't leave you alone or don't want anyone to know that you have a secret ERP alt.

Or are a woman and therefore by default on the radar of an entire subcommunity of degenerates that people like to pretend doesn't exist.

[Clockworks]

Well, the addon GitHub page got nuked, so developers of similar addons will go underground, and players will not have an option to opt out anymore.

I sincerely hope that SE will take measures to hide account IDs from plain sight.

Damage was already done tbh, but better late than never, I dont expect SE to take any responsibility though regarding the account ID's being basically leaked and people's alts.

[Lilapop]

Or are a woman and therefore by default on the radar of an entire subcommunity of degenerates that people like to pretend doesn't exist.

It's a good thing us women know how to blacklist/block people too.