Final Fantasy 14 has a technical problem—it’s been ongoing for a few months now, but the jist of it is this: A change to the game’s blacklist system, designed to help reduce stalking, accidentally opened the door for modders to obtain info on every character their targets had, making them more vulnerable than they were before. Square Enix tried to fix the issue, but it didn’t work.
At the time of writing, FF14’s client sends a scrapable (but hidden) account ID to a client when a player, say, pops up on a search list. This ID has some layers of obfuscation on it, but as seen in the link above, it’s long since been cracked.
There are positives to the intent behind the system Square made. Regardless of whether a stalker has access to someone’s account ID (and thus, their alts), that player still won’t see their character in the world. But the reality has been an unfortunate tale of Creative Studio 3 repeatedly missing the mark.
At the centre of this controversy lies (lied, now) PlayerScope—a mod that would scrape these account IDs into a database which could then be accessed through the mod. Its author, Generall, attempted some half-hearted token gestures of caring about privacy which, to be clear, weren’t good enough—such as suggesting that stalking victims hand them their account IDs to get them removed from the mod.
Which is a lot of trust to put in a complete stranger, especially one who made the thing that’s making you more vulnerable. Well, PlayerScope is no more. According to the mod’s creator on the PlayerScope’s Discord, they were sent a cease & desist order.
“Due to a formal cease and desist notice I received, I’ve made the decision to permanently shut down the PlayerScope project and all of its supporting infrastructure,” writes Generall, revealing they’ve gone all scorched earth on it.
“The web backend has been taken offline. All stored data, including character and user records have been permanently and irreversibly deleted. The plugin files have been completely removed from GitHub and GitFlic, and have also been fully erased from my personal server. As of this announcement, I no longer host, maintain, or distribute any part of the PlayerScope plugin.”
So that’s it, right? Unfortunately, no. One head of the hydra’s been cut off, but there’s still a dozen hidden underwater.
The problem is that, even before PlayerScope brought this vulnerability into the public eye, it’s very likely that bad actors had figured it out beforehand—getting access to people’s account IDs and using private tools or third-party mods to trail victims.
It’s good that Square Enix is shutting down public efforts—but it needs to be doing more than simply sending cease & desists or asking nicely. Make no mistake, this is a blunder on the studio’s part. While third-party tools are against FF14’s terms of service, you can’t code a game under the assumption that no-one will break them. Bad people will always exist—and it’s Square’s responsibility to make sure their targets are protected properly.
Read the full article here
