Final Fantasy 14 communities panic as it turns out change to blacklisting, meant to help reduce stalking, also lets players use mods to track their alts

Final Fantasy 14 communities have been in a bit of a commotion lately—as a recent mod stepping into the limelight has exposed a vulnerability in the way Square Enix has handled its new-and-'improved' blacklist feature. In essence, this solution to the game's stalker problem has inadvertently made it very easy for ToS-violating (but currently untraceable) players to uncover all of their target's alternate characters.

A fuller explanation requires context. Firstly, while mods in Final Fantasy 14 are against the terms of service, a ton of players use 'em anyway. This is because Square, at present, operates on a sort of 'don't be an idiot' policy.

The official stance is that mods are forbidden and you should not use them under any circumstances. Under the table, however, Square has stated that it can't spy on your computer to see what you're using. Instead, it will simply punish you if you're either obviously cheating, which is detectable through common sense, or if you're reported for it. For example, if you use an addon that tracks DPS numbers, you're fine, but if you flame someone for their DPS sucking? They can report you, and you'll be banned.

This has led to a thriving modding community that Square can't bring the hammer down on, exactly, even if it's led to controversies and disappointments before. Doing so would basically nuke the entire roleplay community, for instance, where the use of cosmetic mods is commonplace for harmless visual tweaks (like, say, playing a hyur with pointy ears) to Second Life-tier monstrosities of wobbling flesh. That's to say nothing of the accessibility and quality of life functions mods can offer—not that I'd know—like basic fixes and ping corrections to FF14's netcode.

Why are people worried?

The mod in question, here, is a plugin called PlayerScope. Previously only used by a small group of players, its mod author, who goes by the name Generall on its official Discord, has recently been taking steps to unveil it for "public" use. This has caused a hubbub among FF14 communities like r/ffxivdiscussion, which has its pitchforks sharpened.

PlayerScope, to put it simply, scrapes an "account ID" (one which FF14 saves locally from things like the in-game search function) and uploads it to a server—allowing anyone with the plugin to see every single character attached to that ID. Put simply, a player with PlayerScope installed can see every single alt you have.

This hidden variable was changed from being character-wide to account-wide with Dawntrail and the increased power of the blacklist function, as stated by a player who'd warned said subreddit about six months prior, who wrote: "One could make a tool that would log Account IDs and match them with character names. With this database, it's obviously possible to figure out alt characters if they were ever online."

Dalamud, a popular launcher for addons—which isn't associated with PlayerScope, to be clear—also had some players in an understandable panic flocking to its Discord to ask questions. In response, a mod from the server corroborates the above information: "AccountID was introduced with Dawntrail, but you can't hide that information from a plugin because the game already knows it/receives it in plugins. Should [Square Enix] have devised a better system to resolve that server-side instead of client-side? Yeah. Probably."

An extra point of controversy comes from the PlayerScope plugin's author itself who, in an attempt to mitigate accusations of being a stalking enabler and the like, has created an opt-out system. In an announcement to their Discord, they write: "You won’t need to install the plugin to hide your characters. You’ll be able to set your character’s visibility to private through the ⁠set-profile-private channel." As for why it's not opt-in, Generall states that if this were the case, "[the mod] wouldn’t work effectively, because the data pool would be too limited".

Who's in the wrong here? Well, it's sort of an ethical quagmire. This tool does, in theory, enable stalking—something Final Fantasy 14 has unfortunately had a long history of troubles with, due to some arcane and strange attitudes to its friend list function (blacklisting doesn't remove you from their friend's list in turn, for some reason). The new blacklist features render you blissfully unaware of this fact, mind, erasing the blocked character and their alts from your client under most circumstances.

Even with these improvements, though, the only way to fully vanish off your stalker's radar is to make an alt character, something which this mod circumvents. Having to give your account ID to its author just to stop it tracking you is no comfort, either, asking victims to essentially place their fate in the hands of a stranger.

And yet, the way it's described, getting this account ID from the client isn't even particularly hard. All that has to happen is for the target to be online at the same time as you, and the game client will send that number your way, at which point, an addon can pick it up. It's also apparently being used by other addons for less nefarious reasons.

All this to say, even if PlayerScope vanished, another addon could still be created by bad actors. The miqo'te is sort of already out of the bag, and PlayerScope can at least be said to have made an attempt to mitigate it. 'Other people can make this', however, isn't always a great reason for 'I might as well make it, anyway'.

If you were to ask me, I'd say Square ought to've kept addons in mind when designing the functionality of its new blacklisting system—it feels like it's somehow severely underestimated the technological savviness of a modding community it's largely, and even understandably, ignored. But knowing how dramatic these mod disputes tend to be, I have to wonder how long we'll stay under the rule of live and let live.