Re: Regarding the Use of Third-Party Programs and Player Safety

[brinn12]

Every developer must account for "cheaters", not just gaming developers. No anti-cheat software in the world would account for a poorly designed software, with a poorly written code that sends sensitive information to clients.

[VerdeLuck]

Anyone suggesting anti-cheat software either does not know or does not care that any information dealing with basic account security should not be left raw and unencrypted and handled purely client side. There's a HUGE host of problems and issues associated with various levels of anti-cheat software, things that you absolutely do not want to consent to having installed on your platform, and yet we have some big brains in this thread who think it's the answer?

SE should be handling sensitive information server side, or at the very least encrypting the information. The fact that some people are suggesting "oh use anti-cheat" instead of acknowledging the actual issue is beyond incomprehensible. Just because you think such a thing would stop SOME people, that still does not deal with the root issue of player safety. Sure, maybe you are weeding out some people who cannot find such a thing easy, but you are still allowing access to sensitive account data. You are not dealing with the core problem, you are suggesting a solution that does nothing to fix the issue.

Again, account information should not be raw, unfiltered, unencrypted, and sent to every client. It has nothing to do with whatever third party tools people are using and it has everything to do with how SE has decided to leave account safety to chance in the wind.

The "sensitive account data" isn't PII, it's a reference number that is useless outside of SE's internal DB. Again this kind of posting is concern trolling to cast doubt because a segment of players really really do not want cheats or plugins like this banned.
But that's 100x harder whenever the game's files are completely insecure, there's no checks on memory being accessed or tampered with, and packets are out in the open. Anticheat is the first step to deal with this and actually get some control on the game and the community from the rampant abuse and cheats that are going around.
You can remove the account ID from the client, but then it just shifts and people will still make programs like this and spread them through dalamud to harass and stalk other players. Cracking down on these plugins will remove them from the hands of the majority of players, a few people will still have them but we won't have a crowdsourced harassment plugin in the hands of a large chunk of the game when it's significantly harder to inject or install it.

[Espon]

If you leave your keys in the car, and the car unlocked we generally still arrest the car-thief that steals it.

Arresting the thief afterwards does not prevent your car from being stolen in the first place.

You shouldn't focus on just punishing those that break the rules, you prevent them from breaking the rules in the first place. Anti-cheat does not fix the underlying problem which is the fact that AccountIDs are being given to the client.

[BigCheez]

Act works strangely you dont need to download it you can also just get website to get that info.

That... isn't true.

It needs to be running locally on your machine and either hooks into the game process or scrapes network data.

Any websites that you might be thinking of require a log that was generated using the ACT program to function.

[VerdeLuck]

Arresting the thief afterwards does not prevent your car from being stolen in the first place.

You shouldn't focus on just punishing those that break the rules, you prevent them from breaking the rules in the first place. Anti-cheat does not fix the underlying problem which is the fact that AccountIDs are being given to the client.

Anticheat fixes the underlying issue that the game's memory is entirely unsecured and able to be easily read and tampered with. This would not be as big of an issue for sure if there was more security preventing mods and plugins in this game.

[ExcellusUltimus]

Arresting the thief afterwards does not prevent your car from being stolen in the first place.

You shouldn't focus on just punishing those that break the rules, you prevent them from breaking the rules in the first place. Anti-cheat does not fix the underlying problem which is the fact that AccountIDs are being given to the client.

You can and should do both.

[Chaincat]

Anticheat fixes the underlying issue that the game's memory is entirely unsecured and able to be easily read and tampered with. This would not be as big of an issue for sure if there was more security preventing mods and plugins in this game.

Anticheat does nothing to encrypt or secure the game's memory. It just prevents you from tampering with it as easily as we currently can.

[VerdeLuck]

Anticheat does nothing to encrypt or secure the game's memory. It just prevents you from tampering with it as easily as we currently can.

Lmao what do you think anticheat does? it scans for files and memory that's been tampered with and checks if anything other than the ffxiv program is accessing the memory allocated to ffxiv.
Securing the memory is like 99% of what anticheat does.

[Rehayem]

Lmao what do you think anticheat does? it scans for files and memory that's been tampered with and checks if anything other than the ffxiv program is accessing the memory allocated to ffxiv.
Securing the memory is like 99% of what anticheat does.

The current issue with the ID's placed on account is being sent through network to your client, meaning anti-cheat wouldn't prevent someone from making a standalone app to harvest the data.

[ExcellusUltimus]

Lmao what do you think anticheat does? it scans for files and memory that's been tampered with and checks if anything other than the ffxiv program is accessing the memory allocated to ffxiv.
Securing the memory is like 99% of what anticheat does.

It would appear we're discussing this with people who third party programs and are unwilling to stop.