just posting to see if anyone notices any kinks. i hope to have this up by tonight.
On the date of December 11th, 2007 malicious code was discovered on popular FFXI resource site ffxi.somepage.com that subjected users to a security exploit through Realplayer software. Through this website, persons able to manipulate the security exploit gained unauthorized access to over one hundred accounts, and were able to change relevant membership information resulting in the permanent transfer of these accounts, with the intent of sale or other use. Additionally, there seems to be a new, unidentified threat with a dramatically increasing number of stolen accounts being reported every day. Unfortunately, due to Playonline account policies these players, who are the victims of a security exploit created through legitimate software, have almost zero recourse in recovering their rightful accounts. This petition is a proposal on changes that we as the players, and in many cases victims, rightfully deserve.
Problems: The Lack of a Reasonable Process of Account Recovery
Currently, players have close to zero options when their accounts are stolen. The only chance of recovery these victims have is to make an inquiry with Playonline Customer Service. However, under Playonline policy, these victims have no plausible way in which they can prove their valid ownership. Existing Playonline policies require information regarding a player’s name, address, and most importantly, credit card information. However, the first action taken with a compromised account is to change that very same information, creating a situation in which legitimate players are locked out of their accounts. The only records that players can possibly use in their defense are of complete irrelevance, specifically the policy requiring current credit card information. Proof of names, past addresses, and financial transactions even dating back for years is considered immaterial evidence and made completely unimportant. We, as players, have zero defense in this regard and are completely vulnerable to fraudulent activity.
Additionally, Playonline policies advise players to contact the local police and internet authorities for help, acknowledging that it is indeed a case of identity theft. However, having to rely on elaborate and drawn-out legal processes is simply not practical. Without a form of immediate recovery, compromised accounts can have their contents completely stripped before the original owner ever sees it again. Their characters, built up over years in most cases, can easily be destroyed within the time it takes to obtain a court-ordered subpoena. Moreover, there is no guarantee that the authorities will take the case into legitimate consideration. Authorities may (and often) question its validity because it is based on a game, even though the case falls under identity theft. Having to resort to legal processes that take substantial time, subjects our accounts to devastation, and subjugates us players to being mocked is both unreasonable and unfair.
Also, it is often the case during a request for help that Playonline Customer Service representatives impose an inconsistent and seemingly arbitrary standard upon the players. In many instances these same representatives are both belligerent and insulting towards those trying to find help. Rather than being treated respectfully, players are instead accused of using illegal third party-programs and in some cases, accused of selling their accounts to Real Money Traders. The representatives often seem to operate under the notion that their policies insulate them from having to provide service or respect to those who have lost their accounts, especially when they believe that the victims themselves were a part of fraudulent or suspicious activity. Furthermore, requests to speak with supervising representatives are typically met with the response that “they’re too busy,” or that “they’ll just say the same thing I did.” Follow-up calls from the supervisors are non-existent even when they have been arranged and guaranteed by the representatives, lending even more to the uncooperative and hostile atmosphere that we players are subjected to. While some players do find help and are able to successfully retrieve their accounts, the inconsistency with representatives, in that they are either helpful or hurtful, is simply unexplainable. Allowing some players to re-obtain their accounts while leaving others victimized and snubbed is demoralizing to us all. This inexplicable discrimination as well as the extremes in attitudes from representatives is completely unacceptable. It seems quite obvious to us that our attempts, in the face of the only people who can possibly help us, are in vain.
Solutions: Fair Demands for Relief
Though the situation has worsens daily and an increasing number of players are losing their accounts, we feel that there is still a chance to make things right. Additionally, we believe that there are many, quite reasonable solutions for stronger account safeguards.
1. First, we respectfully, but rightfully, demand the fair return of the stolen accounts. The victims have unfairly lost their accounts due to circumstances in which they had no tenable link to. These victims should be allowed to show some form of past records in order to prove their legitimate ownership.
2. Second, we respectfully, but rightfully, demand extra methods of protection in overseeing our accounts. We would like to see changes that allow us to provide prior history of addresses, credit card information, or some other type of proof over the phone. Since knowledge of the security exploit became public, the vast majority of players have advocated for the inclusion of more private safeguards, such as questions about a mother’s maiden name, original Playonline registration codes, or our own-pre-approved question. Having a valid method of identification that is known only to us, accessible only to Customer Service Representatives and inaccessible via our own computers would establish account privacy in the two safest locations possible: directly with the player or within the Playonline system. Implementing typical security measures found in other MMORPG’s, credit cards, banks and virtually all other accounts guarding against identity fraud would provide us with a traceable, provable, and reliable method of protection.
Implications and Final Thoughts
As we are now, many innocent players have lost their accounts through circumstances in which they were unknowingly attacked by malicious users and had no way to fight back. Though we have been able to generally isolate the Realplayer incident for the time being with strong community support, there are many players who are still reporting the theft of their accounts on a daily basis. The atmosphere within the general community has regressed from one of interest, exploration, and enjoyment over the new expansion to one of paranoia, vulnerability, and fear over losing their accounts. The ones responsible for the assaults on our accounts have been successful without being subject to any form of punishment, and will most certainly look for new avenues and new programs in which they can freely attack again. This most recent wave of attacks came through the use of a reputable community site, legitimate media software (popularly used for over ten years), and a web-browser that is installed in every single instance of Microsoft Windows XP and Vista. Knowing that they were successful without repercussion, these malicious users will no doubt look for more loopholes and security exploits within the everyday software that we use. Knowing that we are powerless once compromised, they will never stop looking for ways steal from us. The community has developed a lack of trust that continues to widen day by day, and is only worsened by the negative attitudes of Playonline representatives. As we are now, no player truly feels safe, because we simply aren’t.
Square-Enix has committed itself in trying to eliminate the practices of Real Money Trader activities and has been extremely successful, removing several billions of gil from the economy and severely crippling RMT industries through their work. While we have always been thrilled to hear about the Special Task Force’s latest accomplishments, we cannot help but express an equal amount of disappointment, disgust, and despair with the way Playonline treats us. Additionally, Playonline policies not only undermine Square Enix’s end-goals of RMT elimination, but they also encourage the theft of our accounts. Commitment by Playonline instead needs to be parallel with other anti-RMT policies by shielding us, not exposing us. Better methods of theft prevention as well as account recovery would establish a powerful deterrence against those trying to sell compromised accounts. The sale of accounts, which Square-Enix strictly forbids, would have absolutely no basis on the internet market. Knowing that the original owner could re-obtain their account at any time, no person would ever wish to buy an account, and as a result, thieves would have zero financial gain from continuing their practice. Playonline’s ease of access to accounts and its lack of resistance in changing personal information only provide avenues for the very market that Square-Enix clearly disallows.
We, as the players, are not interested in a radical change in Playonline policies. Rather, we are simply looking for a commitment in protecting our accounts, or rather, identities. While on the surface Final Fantasy XI is just a game, to us it is considerably more than that. For many of us FFXI has been a place to meet new people, build communities, and develop lasting friendships. For us, FFXI is a world in which we’re allowed to develop, maintain, and devote ourselves to our own individual identities. However, by not giving us a chance to recover our rightful characters and by not providing us with adequate means of protection, we are at the mercy of devious behavior. Moreover, by not allowing us these changes, Playonline policies only serve to further the cause of Real Money Traders, and only encourage them to continue stealing. These policies provide them with an internet marketplace in knowing that once they’ve stolen an account, it will be theirs forever, to use or sell as they wish. By not giving us the necessary change which we are pleading for, we as the players are being deprived of our hard work, characters, and identities.
Kisada of Quetzalcoatl
On the date of December 11th, 2007 malicious code was discovered on popular FFXI resource site ffxi.somepage.com that subjected users to a security exploit through Realplayer software. Through this website, persons able to manipulate the security exploit gained unauthorized access to over one hundred accounts, and were able to change relevant membership information resulting in the permanent transfer of these accounts, with the intent of sale or other use. Additionally, there seems to be a new, unidentified threat with a dramatically increasing number of stolen accounts being reported every day. Unfortunately, due to Playonline account policies these players, who are the victims of a security exploit created through legitimate software, have almost zero recourse in recovering their rightful accounts. This petition is a proposal on changes that we as the players, and in many cases victims, rightfully deserve.
Problems: The Lack of a Reasonable Process of Account Recovery
Currently, players have close to zero options when their accounts are stolen. The only chance of recovery these victims have is to make an inquiry with Playonline Customer Service. However, under Playonline policy, these victims have no plausible way in which they can prove their valid ownership. Existing Playonline policies require information regarding a player’s name, address, and most importantly, credit card information. However, the first action taken with a compromised account is to change that very same information, creating a situation in which legitimate players are locked out of their accounts. The only records that players can possibly use in their defense are of complete irrelevance, specifically the policy requiring current credit card information. Proof of names, past addresses, and financial transactions even dating back for years is considered immaterial evidence and made completely unimportant. We, as players, have zero defense in this regard and are completely vulnerable to fraudulent activity.
Additionally, Playonline policies advise players to contact the local police and internet authorities for help, acknowledging that it is indeed a case of identity theft. However, having to rely on elaborate and drawn-out legal processes is simply not practical. Without a form of immediate recovery, compromised accounts can have their contents completely stripped before the original owner ever sees it again. Their characters, built up over years in most cases, can easily be destroyed within the time it takes to obtain a court-ordered subpoena. Moreover, there is no guarantee that the authorities will take the case into legitimate consideration. Authorities may (and often) question its validity because it is based on a game, even though the case falls under identity theft. Having to resort to legal processes that take substantial time, subjects our accounts to devastation, and subjugates us players to being mocked is both unreasonable and unfair.
Also, it is often the case during a request for help that Playonline Customer Service representatives impose an inconsistent and seemingly arbitrary standard upon the players. In many instances these same representatives are both belligerent and insulting towards those trying to find help. Rather than being treated respectfully, players are instead accused of using illegal third party-programs and in some cases, accused of selling their accounts to Real Money Traders. The representatives often seem to operate under the notion that their policies insulate them from having to provide service or respect to those who have lost their accounts, especially when they believe that the victims themselves were a part of fraudulent or suspicious activity. Furthermore, requests to speak with supervising representatives are typically met with the response that “they’re too busy,” or that “they’ll just say the same thing I did.” Follow-up calls from the supervisors are non-existent even when they have been arranged and guaranteed by the representatives, lending even more to the uncooperative and hostile atmosphere that we players are subjected to. While some players do find help and are able to successfully retrieve their accounts, the inconsistency with representatives, in that they are either helpful or hurtful, is simply unexplainable. Allowing some players to re-obtain their accounts while leaving others victimized and snubbed is demoralizing to us all. This inexplicable discrimination as well as the extremes in attitudes from representatives is completely unacceptable. It seems quite obvious to us that our attempts, in the face of the only people who can possibly help us, are in vain.
Solutions: Fair Demands for Relief
Though the situation has worsens daily and an increasing number of players are losing their accounts, we feel that there is still a chance to make things right. Additionally, we believe that there are many, quite reasonable solutions for stronger account safeguards.
1. First, we respectfully, but rightfully, demand the fair return of the stolen accounts. The victims have unfairly lost their accounts due to circumstances in which they had no tenable link to. These victims should be allowed to show some form of past records in order to prove their legitimate ownership.
2. Second, we respectfully, but rightfully, demand extra methods of protection in overseeing our accounts. We would like to see changes that allow us to provide prior history of addresses, credit card information, or some other type of proof over the phone. Since knowledge of the security exploit became public, the vast majority of players have advocated for the inclusion of more private safeguards, such as questions about a mother’s maiden name, original Playonline registration codes, or our own-pre-approved question. Having a valid method of identification that is known only to us, accessible only to Customer Service Representatives and inaccessible via our own computers would establish account privacy in the two safest locations possible: directly with the player or within the Playonline system. Implementing typical security measures found in other MMORPG’s, credit cards, banks and virtually all other accounts guarding against identity fraud would provide us with a traceable, provable, and reliable method of protection.
Implications and Final Thoughts
As we are now, many innocent players have lost their accounts through circumstances in which they were unknowingly attacked by malicious users and had no way to fight back. Though we have been able to generally isolate the Realplayer incident for the time being with strong community support, there are many players who are still reporting the theft of their accounts on a daily basis. The atmosphere within the general community has regressed from one of interest, exploration, and enjoyment over the new expansion to one of paranoia, vulnerability, and fear over losing their accounts. The ones responsible for the assaults on our accounts have been successful without being subject to any form of punishment, and will most certainly look for new avenues and new programs in which they can freely attack again. This most recent wave of attacks came through the use of a reputable community site, legitimate media software (popularly used for over ten years), and a web-browser that is installed in every single instance of Microsoft Windows XP and Vista. Knowing that they were successful without repercussion, these malicious users will no doubt look for more loopholes and security exploits within the everyday software that we use. Knowing that we are powerless once compromised, they will never stop looking for ways steal from us. The community has developed a lack of trust that continues to widen day by day, and is only worsened by the negative attitudes of Playonline representatives. As we are now, no player truly feels safe, because we simply aren’t.
Square-Enix has committed itself in trying to eliminate the practices of Real Money Trader activities and has been extremely successful, removing several billions of gil from the economy and severely crippling RMT industries through their work. While we have always been thrilled to hear about the Special Task Force’s latest accomplishments, we cannot help but express an equal amount of disappointment, disgust, and despair with the way Playonline treats us. Additionally, Playonline policies not only undermine Square Enix’s end-goals of RMT elimination, but they also encourage the theft of our accounts. Commitment by Playonline instead needs to be parallel with other anti-RMT policies by shielding us, not exposing us. Better methods of theft prevention as well as account recovery would establish a powerful deterrence against those trying to sell compromised accounts. The sale of accounts, which Square-Enix strictly forbids, would have absolutely no basis on the internet market. Knowing that the original owner could re-obtain their account at any time, no person would ever wish to buy an account, and as a result, thieves would have zero financial gain from continuing their practice. Playonline’s ease of access to accounts and its lack of resistance in changing personal information only provide avenues for the very market that Square-Enix clearly disallows.
We, as the players, are not interested in a radical change in Playonline policies. Rather, we are simply looking for a commitment in protecting our accounts, or rather, identities. While on the surface Final Fantasy XI is just a game, to us it is considerably more than that. For many of us FFXI has been a place to meet new people, build communities, and develop lasting friendships. For us, FFXI is a world in which we’re allowed to develop, maintain, and devote ourselves to our own individual identities. However, by not giving us a chance to recover our rightful characters and by not providing us with adequate means of protection, we are at the mercy of devious behavior. Moreover, by not allowing us these changes, Playonline policies only serve to further the cause of Real Money Traders, and only encourage them to continue stealing. These policies provide them with an internet marketplace in knowing that once they’ve stolen an account, it will be theirs forever, to use or sell as they wish. By not giving us the necessary change which we are pleading for, we as the players are being deprived of our hard work, characters, and identities.
Kisada of Quetzalcoatl
