A security vulnerability in Final Fantasy XIV

We’ve come a long way since the days of Limewire, where every download was a roll of the dice between an MP3 of Cascada Every time we touch it A virus that will make your computer usable in name only.

the Cybersecurity landscape It has changed dramatically in the past two decades, and sometimes, something as innocent as an MMORPG opens the door to nefarious acts.

This is exactly what happens in Final Fantasy XIV After players discovered glaring weaknesses they were introduced in Release Downtrell to update.

like Reported on Destructoid, The game made changes to the blacklist system which inadvertently allowed access to much more data than it allowed.

Final Fantasy XIV Players have discovered that some additional components, Like PlayerScopeallow others to see each player’s account ID on the alternate characters, which is A nightmare scenario for harasserst and stalking.

Explanation of the security vulnerability in Final Fantasy XIV

The current iteration of the blacklist feature assigns a unique ID to each account instead of individual character IDs as before.

The change was introduced with Patch Down Trail In July 2024 to make it easier to block interactions from another person as a whole, including their alternate characters.

You may think there is nothing special yet. What makes the new system troublesome is the implementation.

As he explained User Forymanarysanar on Reddit, Blacklist feature in Final Fantasy XIV Works client side. Instead of filtering interactions on the server, it sends you the full data packet and then allows your game instance to sort what to show you based on your settings.

numerous In-game plugins can extract player account IDs, and doing so does not require any direct in-game interaction. As Forymanarysanar explained, “One just needs to open a player search, and the game client will receive the account IDs of everyone who is displayed.”

Recently, another user on Reddit discovered that the PlayerScope plugin could track the account IDs and server IDs of players around you, and the data was stored in a central server.

By having access to someone’s account ID, it makes it impossible to avoid stalkers by creating alternate characterswhere plugins let them know which account the persona is linked to.

The only way to avoid being tracked by PlayerScope is to Unsubscribe by joining the plugin’s Discord serverThis is a move that sparked anger Final Fantasy XIV Communities.

Many are calling for data tracking to be changed from opt-out to opt-in, while others believe the plugin should be removed from GitHub entirely based on terms of service violations.

Square Enix has yet to announce its position on the issue, but there are concerns that it could happen It’s too late to correct like Account IDs detected For more than half a year now, with centralized databases likely already in place.