Patch 7.2 account protection is not working.

[Calandir]

People found a way to bypass security in 7.2 patch, roughly 24-26h after it was implemented. Stalking plugin still works and if you logged in at 7.2, they have data of your account.

This is honestly just baffling to me. I remember when SE went after and banned people for NSFW pictures on twitter, or streamers who used parsers or markers. And yet where there is group of people making tools to see your whole account, they do nothing and ask community to stop. Those people should be banned, and potentially sued.

Let me just warn people, that if software like this already exists, what will come next? what other skeletons are in SE security closet? Should be expect new hacks to boot code on our PC? Not to mention there are fishy mod links and mods that have malware and harmful code in them.

Why is security of FFXIV and implication of TOS so lackluster?

Edit: Plugin is still being worked on and improved on. Other groups are developing plugins that can do much, much more. If SE won't take action, we will be having data-breach in near future. Just warning people, I know I will get same treatment as person who told about blacklist issues when DT came out, and now ''Cummunity'' insulted them and spitted on them for daring to critique FFXIV and warn people. Only when Stalking pluging got so big, Devs had to open their mouths about it, did Cummunity react.

Community is reason this game won't evolve and won't do better.
PS: Don't use credit card to buy Crysta on Mog Station.

[Alternity]

The security of most things online are at least as bad if not worst than this, it's not as big deal as people make it to be.

[Calandir]

Originally posted by Alternity:

The security of most things online are at least as bad if not worst than this, it's not as big deal as people make it to be.

We're not far away from people having access to your account due to client backdoors. It is bigger than you think and what people think. And it could get game in legal trouble, as it's unprotected. And there are talks about Mog station website having nasty things in backend as well.

[Alternity]

Originally posted by Calandir:

Originally posted by Alternity:

The security of most things online are at least as bad if not worst than this, it's not as big deal as people make it to be.

We're not far away from people having access to your account due to client backdoors. It is bigger than you think and what people think. And it could get game in legal trouble, as it's unprotected. And there are talks about Mog station website having nasty things in backend as well.

I think you overestimate the general security that exists online.

[Raansu]

Most overblown issue ever.

[Calandir]

Originally posted by Alternity:

Originally posted by Calandir:

We're not far away from people having access to your account due to client backdoors. It is bigger than you think and what people think. And it could get game in legal trouble, as it's unprotected. And there are talks about Mog station website having nasty things in backend as well.

I think you overestimate the general security that exists online.

In any other company, the servers would be taken down day 1 to make sure the issue can be patched, whereas SE allowed this to continue for 8 months to begin with and still failed at their own wannabe cryptography.

This can lead to some really nasty situation if SE won't react properly, people will abuse the opening and will push it further and further. Especially now after lackluster response.

[Alternity]

Originally posted by Calandir:

Originally posted by Alternity:

I think you overestimate the general security that exists online.

In any other company, the servers would be taken down day 1 to make sure the issue can be patched, whereas SE allowed this to continue for 8 months to begin with and still failed at their own wannabe cryptography.

This can lead to some really nasty situation if SE won't react properly, people will abuse the opening and will push it further and further. Especially now after lackluster response.

I don't think that is true at all considering the amount of cheap companies that exists.

I have no doubts that some, a relatively low number of companies compared to the total amount, would do that, but nowhere near my mind is the thought that the majority would do this.

If you put your credit card online, no matter if it's Square Enix, Amazon, Google, or a random chinese company, you have the same risks. This is the world we live in.

[Lixire]

Seems like while they did add protection around the data. it was also reservable which is absolutely embarrassing for SE and it blows my mind how it went past testing

Tho about the game security in general. FFXIV doesn't require any heavy permissions and everything runs within the user mode with admin access only required for patching and installing the game and parts of the game that use user input like chat/pf listings are sanitized as well. Your IP address and your account credentials that are being sent to the server are also encrypted using TLS 1.2

Speaking of Mods/cheats including malware is basically user error and this is why Dalamud warns the user about using addons from non official repos. You can play games like Valorant with the most aggressive kernel level anti cheat but infect yourself by using a random "free cheat" that had a crypto miner/keylogger whatever in it

You in general should keep your OS updated at all times, do not run everything as administrator for "better performance" and be mindful of what are you running

[Calandir]

Originally posted by Alternity:

Originally posted by Calandir:

In any other company, the servers would be taken down day 1 to make sure the issue can be patched, whereas SE allowed this to continue for 8 months to begin with and still failed at their own wannabe cryptography.

This can lead to some really nasty situation if SE won't react properly, people will abuse the opening and will push it further and further. Especially now after lackluster response.

I don't think that is true at all considering the amount of cheap companies that exists.

I have no doubts that some, a relatively low number of companies compared to the total amount, would do that, but nowhere near my mind is the thought that the majority would do this.

One thing you should NEVER do is try to invent your own "clever" cryptography or obfuscation algorithm for sensitive information. ALWAYS follow established industry standard best practices and use established algorithms that have undergone years of intense scrutiny and battle testing.

Better yet, don't send sensitive information to the client at all. There is no reason for the client to have access to the account ID, even obfuscated. Account blacklisting should have been processed entirely on the server side, and if there is a performance hit to the servers, SE should just accept it and get stronger hardware if necessary.

SE isn't some cheap company, they have money and I assume basic knowledge of cybersecurity, this stuff isn't some rocket science, you're learning this pretty early in cybersecurity studies.
What this is in my opinion is lack of senior devs at the wheel, DT was given to new batch of developers and writers to potentially learn and improve, and this are the result. Hole in security and mostly negative reviews.

[Alternity]

Originally posted by Calandir:

Originally posted by Alternity:

I don't think that is true at all considering the amount of cheap companies that exists.

I have no doubts that some, a relatively low number of companies compared to the total amount, would do that, but nowhere near my mind is the thought that the majority would do this.

One thing you should NEVER do is try to invent your own "clever" cryptography or obfuscation algorithm for sensitive information. ALWAYS follow established industry standard best practices and use established algorithms that have undergone years of intense scrutiny and battle testing.

Better yet, don't send sensitive information to the client at all. There is no reason for the client to have access to the account ID, even obfuscated. Account blacklisting should have been processed entirely on the server side, and if there is a performance hit to the servers, SE should just accept it and get stronger hardware if necessary.

SE isn't some cheap company, they have money and I assume basic knowledge of cybersecurity, this stuff isn't some rocket science, you're learning this pretty early in cybersecurity studies.
What this is in my opinion is lack of senior devs at the wheel, DT was given to new batch of developers and writers to potentially learn and improve, and this are the result. Hole in security and mostly negative reviews.

Ok. You can continue to believe that there are companies that operates 100% safely online, I'll continue to believe otherwise and take appropriate precautions when I interact with any remote device.

[Lixire]

Originally posted by Calandir:

Originally posted by Alternity:

I don't think that is true at all considering the amount of cheap companies that exists.

I have no doubts that some, a relatively low number of companies compared to the total amount, would do that, but nowhere near my mind is the thought that the majority would do this.

One thing you should NEVER do is try to invent your own "clever" cryptography or obfuscation algorithm for sensitive information. ALWAYS follow established industry standard best practices and use established algorithms that have undergone years of intense scrutiny and battle testing.

Better yet, don't send sensitive information to the client at all. There is no reason for the client to have access to the account ID, even obfuscated. Account blacklisting should have been processed entirely on the server side, and if there is a performance hit to the servers, SE should just accept it and get stronger hardware if necessary.

SE isn't some cheap company, they have money and I assume basic knowledge of cybersecurity, this stuff isn't some rocket science, you're learning this pretty early in cybersecurity studies.
What this is in my opinion is lack of senior devs at the wheel, DT was given to new batch of developers and writers to potentially learn and improve, and this are the result. Hole in security and mostly negative reviews.

You can use all of the tech and standards and still mess up due to terrible implementation which is what happened in this case
But overall, when you log in to the game. you go through the authentication in a different server which returns you a valid SID (token) in order to log in into the game
So no, no one will actually steal your log in credentials even if they have your account ID of FFXIV and if you feel concern then I strongly suggest (and you should have done it anyway) but enable 2FA on your SE account

I agree, Blacklisting should be done differently and SE should be called out for messing up but I highly doubt that the game has RCEs and etc in there

[weiss]

Originally posted by Calandir:

People found a way to bypass security in 7.2 patch, roughly 24-26h after it was implemented. Stalking plugin still works and if you logged in at 7.2, they have data of your account.

This is honestly just baffling to me. I remember when SE went after and banned people for NSFW pictures on twitter, or streamers who used parsers or markers. And yet where there is group of people making tools to see your whole account, they do nothing and ask community to stop. Those people should be banned, and potentially sued.

Let me just warn people, that if software like this already exists, what will come next? what other skeletons are in SE security closet? Should be expect new hacks to boot code on our PC? Not to mention there are fishy mod links and mods that have malware and harmful code in them.

Why is security of FFXIV and implication of TOS so lackluster?

very old news o.o

[Calandir]

Originally posted by Lixire:

Originally posted by Calandir:

One thing you should NEVER do is try to invent your own "clever" cryptography or obfuscation algorithm for sensitive information. ALWAYS follow established industry standard best practices and use established algorithms that have undergone years of intense scrutiny and battle testing.

Better yet, don't send sensitive information to the client at all. There is no reason for the client to have access to the account ID, even obfuscated. Account blacklisting should have been processed entirely on the server side, and if there is a performance hit to the servers, SE should just accept it and get stronger hardware if necessary.

SE isn't some cheap company, they have money and I assume basic knowledge of cybersecurity, this stuff isn't some rocket science, you're learning this pretty early in cybersecurity studies.
What this is in my opinion is lack of senior devs at the wheel, DT was given to new batch of developers and writers to potentially learn and improve, and this are the result. Hole in security and mostly negative reviews.

You can use all of the tech and standards and still mess up due to terrible implementation which is what happened in this case
But overall, when you log in to the game. you go through the authentication in a different server which returns you a valid SID (token) in order to log in into the game
So no, no one will actually steal your log in credentials even if they have your account ID of FFXIV and if you feel concern then I strongly suggest (and you should have done it anyway) but enable 2FA on your SE account

I agree, Blacklisting should be done differently and SE should be called out for messing up but I highly doubt that the game has RCEs and etc in there

I do use 2FA. The premis of my post is mainly that there are gaps in security of client and mog station website that can be exploited. And there is group of very dedicated people, who want to crack it and spend absurd amount of time finding a way. We're talking beyond stalker plugin at this point. This is why it's such a big issue, is because people are working around a clock to find way in, and to my knowledge they started to make even more sophisticated hacking tools.

[Lixire]

Originally posted by weiss:

Originally posted by Calandir:

People found a way to bypass security in 7.2 patch, roughly 24-26h after it was implemented. Stalking plugin still works and if you logged in at 7.2, they have data of your account.

This is honestly just baffling to me. I remember when SE went after and banned people for NSFW pictures on twitter, or streamers who used parsers or markers. And yet where there is group of people making tools to see your whole account, they do nothing and ask community to stop. Those people should be banned, and potentially sued.

Let me just warn people, that if software like this already exists, what will come next? what other skeletons are in SE security closet? Should be expect new hacks to boot code on our PC? Not to mention there are fishy mod links and mods that have malware and harmful code in them.

Why is security of FFXIV and implication of TOS so lackluster?

very old news o.o

Well not so old. CBU3 did "fix" the issue that allowed the leaking of account IDs within the game but turns out it wasn't fixed properly and the issue happens again.

[Raansu]

There's ZERO account information on character ID's. It is only character information and that ID has ALWAYS been publicly accessible because its a simple folder with the ID in your documents folder that the game fetches and has always been easily scraped.

The reaction to the plugin is completely overblown. So what if they have my character ID and know the names of my retainers? They are blacklisted and disappear from my screen so what does it matter? They can't do anything with that information and I can't see their character or read their chat messages. They don't exist anymore.

[Lixire]

Originally posted by Calandir:

Originally posted by Lixire:

You can use all of the tech and standards and still mess up due to terrible implementation which is what happened in this case
But overall, when you log in to the game. you go through the authentication in a different server which returns you a valid SID (token) in order to log in into the game
So no, no one will actually steal your log in credentials even if they have your account ID of FFXIV and if you feel concern then I strongly suggest (and you should have done it anyway) but enable 2FA on your SE account

I agree, Blacklisting should be done differently and SE should be called out for messing up but I highly doubt that the game has RCEs and etc in there

I do use 2FA. The premis of my post is mainly that there are gaps in security of client and mog station website that can be exploited. And there is group of very dedicated people, who want to crack it and spend absurd amount of time finding a way. We're talking beyond stalker plugin at this point. This is why it's such a big issue, is because people are working around a clock to find way in, and to my knowledge they started to make even more sophisticated hacking tools.

There are gaps in every online service out there, including the very one we are using right now to comment on. no security is perfect and it all depends which measures the service takes to protect its data in terms of how they store the data and what mitigations there are

Yes, I know about PlayerScope and how people did fork the Github repo before it went down and created versions that offer more features to track more character specific data. it sucks and you ain't wrong but I don't expect to see RCEs or anything critical all of the sudden popping off as you log in through an issued token/SID, the game doesn't expose your IP addresses, user Inputs are sanitized and the set of permissions to launch the game is very limited and everything is done on user mode + the game doesn't host any other service on your machine.

I would argue that other games like League of Legends have a much larger attack surface area compared to FFXIV for example.
But just as I mentioned before. Don't launch the game as administrator, keep your OS updated and be mindful of what you execute on your computer. if you use addons by any chances then stick to Dalamud's official ones and if you decide to use a custom repo then be sure to know what are you exactly doing