Player Portal Privacy Problem

[Seven Sons of Sin]

Isn't it bad form that the would-be victim has to go out of their way? Why is the onus on the individual that is targeted?

It seems backwards to me that "if you feel like you're being targeted/metagamed against, let's just wave our hands and make you disappear from the portal."

That's hand-waving, not eliminating the problem.

...and couldn't it be considered a bad form to ask a staff that works for free to change a working system in a way that would also drastically reduce the QoL gameplay experience of the entire playerbase in order to prevent a highly theoretical scenario that you yourself can easily prevent in multiple ways?

I feel like you're trying to dig at me here.

Maybe there needs to be clarity, because as of right now, the impression received is,

> player has strong concerns about their information, about other players collecting their information, building a profile, and using this for in-game reasons
> the DM response is, if you have this concern, opt out of using this service so other players cannot do this to you

Is the the DM response also that you if you have this concern, you should report it? Is this a reportable offense? Can a player report another player if they believe they've been targeted by this super creepy, super problematic information-gathering activity?

And "drastically reduce the QoL gameplay experience" is hyperbolic at worst, and super debatable at best. The portal is an OOC add-on that helps share information. It literally has nothing to do with the game.

[-XXX-]

The portal is a nice feature that helps players to get together in game without the need of using some third party service like discord (and needless OOC chatter).
Understandably it works better when players are made visible by default than the other way around.
There IS a way to conceal one's online presence on the portal, if desired.

What I was arguing was that the person who is expressing a concern like the one that is being discussed here is placing an additional demand so they indeed should be the one getting out of their way to actually type that -dissaportal command (it's possible to even custom text macro it onto the toolbar if a person is super lazy)

Honestly, I don't see any problem with how things are now whatsoever.

[Rigela]

The -dissaportal command is persistent, so you only ever need to type it once thankfully.

[Royal Blood]

The reality that I learned about NWN is that tech savy people have tools they can use to track you in the NWN world and affiliated tools. As weird as that is I do not think the information can be particularly useful to anyone. Log in times, character names, etc. It is some meta info and it could be used to target people. But I think the 'idea' of it is a lot scarier than the practicality of it.

There's is a huge opening with this kind of thinking to allow your play time to get corrupted with fear and concern. But I wouldn't let that be the case. Any IG action affected by OOC meta I think stands out really clearly and the staff can take action. If you have concerns you can totally report it. I think the premier fear is that some OOC group of people will congregate to affect your RP and target you. But, in reality, their tools for doing so are limited. They have information maybe but there's no way to act on it.

My own thinking on it is that I don't care lol. If someone wants to go through the effort of tracking information to be malicious then they are laughable and need to take a break or something. For real, it's an 18 year old game. The RP is fun and exciting and if things become so personal that you need to develop 3rd party tools to track people so you can hurt them? Take a break and cool off. It's not worth it. I choose not to let it bother me. And anyone who has or would track me is welcome to do so because it means absolutely nothing.

[ReverentBlade]

I wasn't aware of -dissaportal, and I've made sure to utilize it. Thank you. That said, in my nearly two decades of DMing on this game, I've had to ban several creepers on various servers that would have absolutely used these tools and metadata to harass and stalk people in the real world. IE, being able to predict when someone might be logged in and at home, or outside of the house.

Internet privacy is a real concern and every vulnerability has consequences.

[The Rambling Midget]

Internet privacy is a real concern and every vulnerability has consequences.

This is why I keep my online gaming identity separate from my RL identity, and my Arelith identity separate from both of those. No offense to the community, but the internet as a whole and especially addictive online RPGs attract a lot of mentally and emotionally troubled people, and some of them have lashed out pretty severely at our community and individual members. Using alternate identities, revealed only to those you trust absolutely, allows you to have a high degree of freedom without putting yourself at great risk.

I know I sound like an old fuddy duddy, but I grew up at the same time as the internet, and the healthy dose of concern instilled in me by the early alarmists has saved me from more than a few problems that I know about, and probably even more that I don't. It's become almost a social expectation for children to start plastering their lives all over the internet for strangers to gawk at, from a very young age, but for anyone concerned about their privacy, it's never too late to reinvent your online persona in a way that offers you more security and peace of mind.

Thankfully, Arelith has made it pretty easy to disappear. You can use a different login with every character, if you feel like it. -dissaportal is very handy. And if you feel you're being targeted, there's no doubt in my mind that the staff will put investigating that ahead of someone else's third hair color change this week.

[ReverentBlade]

Isn't it bad form that the would-be victim has to go out of their way? Why is the onus on the individual that is targeted?

It seems backwards to me that "if you feel like you're being targeted/metagamed against, let's just wave our hands and make you disappear from the portal."

That's hand-waving, not eliminating the problem.

...and couldn't it be considered a bad form to ask a staff that works for free to change a working system in a way that would also drastically reduce the QoL gameplay experience of the entire playerbase in order to prevent a highly theoretical scenario that you yourself can easily prevent in multiple ways?

No. It isn't, XXX. The staff has taken *such* a hard-edge "protect the children" stance on everything else, privacy absolutely shouldn't be an exception. There's a standard that's been set. If the server is going to explicitly cater to children, this is kind of what it looks like.

[Dreams]

The problem with an opt-out system is that not everyone is aware that they are on the portal to begin with. Not everyone uses the forums. Not everyone who uses the forums realises how the portal works. Not everyone knows how the information can be tracked, compiled and abused.

An opt-out system is appropriate for an informed population. This is not an informed population. Opt-in, however, helps those players who don't mind it and find it to be a very helpful feature or idea. An announcement could very easily draw attention for those who want to opt-in.

[Halibutthead]

the portal has been there for years. the means of doing something with it has existed for even longer. while i don't have a spacebook, twatter, rebbit, or any other major social media account (go ahead and feel special, arelith) because of privacy concerns, i find it interesting that it took someone mentioning a particular use of the collected metadata for people to be interested, and now we need to "protect the children."

now, i get it. i really do. i won't give the zukk my name, address, phone number, social security number, mother's maiden name, email, job history, residence history, or you know... what people freely hand over to a company who got caught selling information to 3rd parties, but... my playtime on a video game? i can't understand why anyone would care about *that*

[Gouge Away]

The problem with an opt-out system is that not everyone is aware that they are on the portal to begin with. Not everyone uses the forums.

I don't know how concerned I can be about a player who never checked the forum to see a portal but plays enough to worry someone might be watching to see if they are online? Even if some players aren't active on the forum they're going to check the wiki or news feed some times. If they don't, they are very very unusual and I envy their restraint for not visiting it 20 times a day.

I think it's a disservice to very real and very scary RL privacy concerns to call this a privacy concern. If you're worried about your character's name being seen on the portal there is a way to avoid that, and if you're involved enough in the game that you have a reason to hide your online time you probably know a thing or two about how Arelith works. The only thing that might be lacking generally is awareness -dissaportal exists.

[Dreams]

The only thing that might be lacking generally is awareness -dissaportal exists.

Which is basically the reason it should be opt-in.

[Gouge Away]

Or make its existence a login or status message, raising awareness of a command doesn't mean we have to make invisibility the default.

This really wasn't the dire problem it's presented as right now a week ago and it won't be when there's a new issue on the forums next week. The portal is fine, mostly, and we're better off with it than without.

[Frailman]

It's honestly not much of a problem at all. The only problem I see is that it can lead to an unfair advantage in getting a shop/quarter, which is what I was trying to highlight. The data you can get from the portal is simply CharacterName+AccountName+CurrentTimestamp. That's it. It's not a big deal. It's not really privacy at all, there's no private information to be collected.

[Shadowy Reality]

It's honestly not much of a problem at all. The only problem I see is that it can lead to an unfair advantage in getting a shop/quarter, which is what I was trying to highlight. The data you can get from the portal is simply CharacterName+AccountName+CurrentTimestamp. That's it. It's not a big deal. It's not really privacy at all, there's no private information to be collected.

I am with you here. This is not the first time something like this came up. At some point in the past Cihparg had a tool online that basically told you, for each login name, which characters were played, total playtime, character creation date and when the player was last seen online.

There was a huge backlash, with people not wanting that information to be public. There is basically no personal information. It's the login name, which is not personal, your character name, which is not personal and your play times, which are not personal, because you are logging in to a public server, where anyone can see when you join or leave.

There is very few you can do with this. At most you can find interesting cases, like in the original quote. Finding out when a player plays is not that hard, you don't need a tool for this. At the end of the day, the portal is useful. I look at the portal often, sometimes I decide to login because certain characters are online, or because there are enough characters online that I might find roleplay.

[Liareth]

An opt-out system is appropriate for an informed population. This is not an informed population. Opt-in, however, helps those players who don't mind it and find it to be a very helpful feature or idea. An announcement could very easily draw attention for those who want to opt-in.

The value of the portal hinges on the majority using it. Opt-in neuters its usefulness to achieve a (very questionable, IMO) privacy benefit.

[let it trip]

And I bet they stocked the shop with 20 lots of Magical Cloak (this item was found in the Skull Crags region.) Scum.

[The GrumpyCat]

I must admit I'm in the camp that doesn't really have a problem with the Portal as is.
*You can use -dissaportal to vanish if you wish.
*I find the portal increadibly useful for spotting if someone I know is out and about on it. I don't have a lot of time to play, like many others- so this is an invaluble tool to me. I wouldn't say anything so dramatic as 'if we got rid of the portal it would be the end of Arelith' or anything, but I genuinly belileve we'd see a large decrease in player numbers. And that isn't something I often say.
*I'm not sure what information the portal collects that could be considered terribly sensative. Character names and Logins, but players can change either of these at will. And the former is easily available via In Game player lists.

The most delicate thing is log in times - but I'm sure you could get that from other sources too. I'm really not seeing the big deal here.

[AstralUniverse]

I dont have a personal problem with how the portal functions. If anything, I kinda like that there's no way to tell what server I'm on anymore.

However, I think I'm on the camp that says -disapporal should be the default opt, ESPECIALLY because a large portion of the playerbase doesnt know what it is. If they knew what it is, they could have a choice. Since they dont have a choice currently, the default should be the privacy. And I'd be feeling weird if I knew someone out there is tracking my playing hours and my shops/quarters through a platform I'm not even familiar with or know I show up on.

[MalKalz]

As mentioned previously, there is only limited information that they can gather: Character Name, Player Name and current timestamp (when you login to the point you log out).

They cannot gain anything that is private or otherwise personal - your CD Key and IP Address are otherwise protected.

And, the information they can scrape can be gathered even in game if they were on the same server by logging their chat client.

The opt-out feature still remains the best course of action. Those that are concerned can use the feature to disappear on the portal, while enabling the majority to remain.

[The GrumpyCat]

And I'd be feeling weird if I knew someone out there is tracking my playing hours and my shops/quarters through a platform I'm not even familiar with or know I show up on.

Ok so this is one small aspect I don't entirely understand. (And I'm picking up on you, but this is a sentiment I've seen elsewhere in this thread so please don't feel singled out. You just happened to be the post above me)
I'll clarify.

And I'd be feeling weird if I knew someone out there is tracking my playing hours

- Ok yeah that's a little odd, and maybe creepy I'll grant.

and my shops/quarters through a platform I'm not even familiar with or know I show up on.

This is possibly the aspect that confuses me.

I'd feel marginally irritated if people were using this to grab quarters that came up for sale, using meta means, before anyone else had a chance at them, that's irritating.

But as for -My- quarters? So long as I'm constantly refreshing them, then my log in times hardly matter.

The only way this matters, re grabbing quarters, is if you are literally logging in once per week/two weeks to refresh them, and are worried you occasionally miss the 'deadline' by an hour or so, in which case someone tracking you would know the vulnerable spots.

Frankly - if that is the concern then I'm not really sure that you deserve to have a quarter.

Want to make sure that people won't do this to your quarters? Easy! Log in regularly, play, and use your property! Sorted!

[Tarkus the dog]

Man good to know the next time I get a shop/quarter, my character is probably being tracked by a hacker from Belarus.

Now THAT'S why I play Arelith, to amass information on virtual property.

[Irongron]

When I saw the title of this thread my first thought was that we were suffering from some awful data-breach.

Now that's not the case, and I'm not going to ask the portal becomes opt in. This looks seriously overblown.

I might ask the team to but a random 1-48 hour extension on property time-outs though.

[Dedman1234]

I might ask the team to but a random 1-48 hour extension on property time-outs though.

This is a great idea. I would extend that policy to quarters being released the normal way to prevent hogging them... or at least, make it harder to hand over the lease between buddies. You know, give the actual landlords some time to process paperwork and clean up all the blood and unsettling scrawlings on the floor the last tenant left. Can't have a paladin getting attacked in his home by his own ham sandwich, because the necromancer living there before enchanted the place to animate any corpses inside, can we?

It would make selling quarters "The RP-with-me way" significantly harder, though it is a pretty small sacrifice, I think.

As for the portal leak, I too think it is being blown out of proportion. The idea that the portal can be used to track someone IRL is not very likely to hold any merit. If someone manages to find where ya live, your IP address, and basically dox ya (nothing they can do using the portal), then you are screwed already. The supposed rascal will NOT need the portal page to tell what is your daily routine.

[Quidix]

Isn't the underlying issue here that 1) a lot of people want a shop, 2) there are not enough shops in good locations, 3) the mechanics for getting a shop are a pain [ie check and click a sign again and again, or hope to get insanely lucky], and 3) there is no IC way to find out when shops become available.

What about adding an NPC which you could pay [10k] gold to find out which, if any, shops become available in the area within the next 24h? Maybe a separate option to pay [25k] for shops within 6h. This means those that are keen to to find a shop have a legit way to in character find out.

[The GrumpyCat]

What about adding an NPC which you could pay [10k] gold to find out which, if any, shops become available in the area within the next 24h?

Not -quite- what you are looking for - but many (all?) settlments have a property registry, where you can pay a small amount of gold to view what properties are up for sale within a settlment. This includes shops.