Square Enix wants you to forget that the stalking issue still isn't fixed

[angelar_]

The fact that they "solved" the problem using in-house cryptography is just embarrassing and they should feel embarrassed.

Wishful thinking but there is no "not make it easier" for them. SE didn't suddenly "activate" something that brought PlayerScope to prominence.

Lol, yes they did. People didn't just suddenly go "oh! what if I made a stalking mod after 12 years of the game's lifespan!" It's well known that SE changed how they handle the blacklist on the back end works in Dawntrail and now serve the player's account ID that was previously handled client-side.

[Havenchild]

The fact that they "solved" the problem using in-house cryptography is just embarrassing and they should feel embarrassed.



Lol, yes they did. People didn't just suddenly go "oh! what if I made a stalking mod after 12 years of the game's lifespan!" It's well known that SE changed how they handle the blacklist on the back end works in Dawntrail and now serve the player's account ID that was previously handled client-side.

The information being used has ALWAYS been available/analyzed via mods. You are far misinformed on the subject if you believe this JUST started lmao. The ONLY reason this got attention is because of PlayerScope, which combined what took 5 mods into 1..

[WutWut]

Just gonna quote myself from the thread back in January. My opinion is largely the same, except replace days later with 3 months and counting now:

The radio silence from Square Enix days later, on a vulnerability that has already leaked the privacy of thousands of players (there was a public pastebin list floating around one of the first days of this), is pretty damning in my eyes. Any other company would have made some sort of statement, rather than just quietly deleting a forum thread and leaving us to assume the worst. Not only has that data been leaked, its in a public, searchable database. That is insanity, and trying to slip this under the rug is completely unacceptable.

I am also tired, and this will probably be the tipping point that causes me to unsubscribe if it continues to go unaddressed. I refuse to give money to a corp that just doesn't care about the privacy of its users, which is what the radio silence says to me.

I have found myself playing less and less lately. The more I step away, the more I question why I put any of my free-time towards a MMO that has become a stalker's paradise, with no accountability for some of the really shady stuff people have been doing for years. But if they didn't say any mean words in chat, guess there's no reason to ban them!

[Alice_Rivers]

Wishful thinking but there is no "not make it easier" for them. SE didn't suddenly "activate" something that brought PlayerScope to prominence. The ENTIRE game is designed around recognition of a central ID number to your character/account. How do you think the game keeps track of your achievements, your raid progress, your friends and blacklists etc even despite changing your character name? How does your lodestone still attach to your account?

It's because the central ID number does NOT change and that is what the mods go after, which cross reference both forums and lodestone. Any encryption of said data is easily brute forced by a devs infinite time vs SE's dev limited time. There is no such thing as an arms race that SE can win here. To think such is simply delusional and unrealistic, moreso when you have the existence of Lodestone.

You can blacklist sure, but someone who is adamant on stalking can just make a new acc, and you can BL again / SE can IP ban them, and you can still circumvent that as well. It's pointless. No company has ever solved harassment 100% that didn't require national registry numbers to make accounts (ie SSN, or Korea's ID/Phone government registry confirmations)

I think most understand that it's beyond anyone's ability to prevent stalking altogether barring tracking every human's every movement, act and viewed item. However, as others have pointed out, there was no need for SE to send account information of any kind to the client. Yes determined offenders would almost certainly have found some way around that problem, but at the very least it would be making it harder and not easier.

[Kaurhz]

I think most understand that it's beyond anyone's ability to prevent stalking altogether barring tracking every human's every movement, act and viewed item. However, as others have pointed out, there was no need for SE to send account information of any kind to the client. Yes determined offenders would almost certainly have found some way around that problem, but at the very least it would be making it harder and not easier.

The only rationale they have for sharing the account ID client-side is to mitigate the server costs, and instead to offload that cost onto the client, whilst also coming at the expense of potentially making it significantly easier to stalk, harass and track other players.

It's not an impossible task, it's obviously one that comes with costs, but apparently potential player safety and privacy doesn't rank highly enough on their agenda for what constitutes a good business case.

Technical debt is always going to occur, it's just a question of which debt you want to take on, and for the case with this game, they more often than not elect to take the worst forms of technical debt, all under the guise of simplistic and cheap solutions, hence why we have a public shared accountID (Not character, mind you), and hence why they also doubled down on this solution by doing an in-house obfuscation system that was defeated by a mere spreadsheet in a couple of hours.

[flowerkatie]

The data that's being targetted has always been available since the beginning of mods.

I'm sorry Haven but you're a complete clown, you're so confidently incorrect on this thread, time after time ... after time. This data was not always available, this much is known as fact by anyone with knowledge on the topic. Feel free to read the official statement of the developers of the third-party framework every mod is built upon. They said themselves that, and I quote "With the introduction of the new blacklist features in Dawntrail, the game servers now send Content IDs and Account IDs for players in certain conditions.".

This data was made viewable by complete oversight and laziness, the truth is—for a blacklist feature to work across multiple characters*, you'll always be able to tie somebody to their alts. Even without mods you could blacklist somebody and then see what other characters disappear (etc...). You keep mentioning lodestone which does not deliver or make accessible cross-account identifiers the same way this new system does.

The information being used has ALWAYS been available/analyzed via mods. You are far misinformed on the subject if you believe this JUST started lmao. The ONLY reason this got attention is because of PlayerScope, which combined what took 5 mods into 1..

Oh the irony of "You are far misinformed on the subject if you believe this JUST started lmao." and "The information being used has ALWAYS been available/analyzed via mods.". Please read the statements of the third-party framework developers. Whilst some information this plugin uses was available originally, the main topic of this discussion of the people you're arguing with is about Account IDs which were not always available.

If you're going to try and downplay the real concerns of people, at least know what you're talking about, please.

[Lizzit]

What a pathetic state of affairs.

your character looks like iron man

[Havenchild]

This data was made viewable by complete oversight and laziness, the truth is—for a blacklist feature to work across multiple characters*, you'll always be able to tie somebody to their alts. Even without mods you could blacklist somebody and then see what other characters disappear (etc...). You keep mentioning lodestone which does not deliver or make accessible cross-account identifiers the same way this new system does.



Oh the irony of "You are far misinformed on the subject if you believe this JUST started lmao." and "The information being used has ALWAYS been available/analyzed via mods.". Please read the statements of the third-party framework developers. Whilst some information this plugin uses was available originally, the main topic of this discussion of the people you're arguing with is about Account IDs which were not always available.

If you're going to try and downplay the real concerns of people, at least know what you're talking about, please.

I love the confidence in this "third-party" for you whereas I have been a part of a discord community for awhile now that has advertised mods available that can be traced back to the SB/SHB doing the same capability.

Off the top of my head? There's PlayerTrack, which literally alerts you in game of a person's name and server change, Bancheck /Banlist -mod that alerts you if you are in a party with someone that was on your banlist but switched their name etc (usually in the instance)

Both of these existed long before the drama with PlayerScope and Dawntrail. You can literally search up PlayerTrack. Its existed since 4-5+ years ago. It filters through lodestone the exact same way PlayerScope does and that's how it can give you the updated info.

If you want to soundoff that idk what im talking about at least make sure you can't be proven to be an uninformed idiot in seconds with a Google Search.

[Daralii]

I love the confidence in this "third-party" for you whereas I have been a part of a discord community for awhile now that has advertised mods available that can be traced back to the SB/SHB doing the same capability.

Off the top of my head? There's PlayerTrack, which literally alerts you in game of a person's name and server change, Bancheck /Banlist -mod that alerts you if you are in a party with someone that was on your banlist but switched their name etc (usually in the instance)

Both of these existed long before the drama with PlayerScope and Dawntrail. You can literally search up PlayerTrack. Its existed since 4-5+ years ago. It filters through lodestone the exact same way PlayerScope does and that's how it can give you the updated info.

If you want to soundoff that idk what im talking about at least make sure you can't be proven to be an uninformed idiot in seconds with a Google Search.

If you genuinely think that all Playerscope does is scan Lodestone profiles, you're very confidently ignorant as to how it works.

[Havenchild]

If you genuinely think that all Playerscope does is scan Lodestone profiles, you're very confidently ignorant as to how it works.

Never said as such but do try again. I have stated several times that PlayerScope merely combined into one what several mods already did. Please read any of my previous posts.

The main point I am stating is that the "stalking" aspect of this and specifically the fact that it actively alerts the user of any name‐server changes/cross references their lodestone info is not NEW. Mods can also be used to pinpoint the exact location of a searched for user (long as they are on current server). Old mods, all of them. PlayerScope is just a cleaner all in one mod that released relatively recently.