Final Fantasy 14 Community Expresses Worries About Security Update in Patch 7.2

Patch 7.2 for Final Fantasy 14 was rolled out with the intention of fixing a security loophole that allowed unauthorized mods like PlayerScope to track players without their permission. But surprisingly, those security measures were outsmarted rather quickly, as a programmer revealed that these updates from Square Enix didn’t hold up for long. She openly discussed on social platforms how she and fellow players managed to reverse-engineer the changes introduced in the patch.

Released on March 25 after a marathon maintenance session, Seekers of Eternity—also known as Patch 7.2—brought along a slew of updates. Besides the new Cruiserweight tier in the Arcadion raid series and further unfolding of Dawntrail’s main storyline, there were significant tweaks made to the Jobs. Notably, the Black Mage got a boost in attack speed and power, while the Pictomancer saw a reduction in their burst damage due to extensive player feedback. Importantly, the patch also aimed to shield players’ account ID details from potential threats by applying encryption layers.

Despite these efforts, Square Enix’s security enhancement appears to have been compromised. In a sit-down with PC Gamer, programmer NotNite revealed how she and her team cracked the modifications aimed at account confidentiality. The new protective layer intended to obscure account IDs was dissected using an algorithm, and tests on consenting friends confirmed the system’s vulnerability within just a few hours, as detailed by NotNite on Bluesky.

It’s important to note that while the exact method used to overcome Square Enix’s security was not revealed, NotNite hinted that mods like PlayerScope, which can access these account details, might soon be updated once the decryption algorithm is fully understood. Fears regarding the PlayerScope mod aren’t new, as it can potentially link all characters to a single player account, thereby enabling malicious tracking or harassment.

NotNite suggested that Square Enix’s security efforts might have been constrained by time and resources. Back in January, the company acknowledged the presence of PlayerScope and reiterated its zero-tolerance stance on mods and third-party tools, as expressly stated in their terms of service. While the Patch 7.2 notes did mention changes to the Account ID system could temporarily affect the display of certain player names, Square Enix assured players they could recreate any affected content.

After running her tests, NotNite called for Square Enix to halt the transmission of sensitive data to game clients altogether. Combined with the recent issues surrounding DDoS attacks on the game’s servers, the community eagerly awaits the company’s response to these challenges.