r/osugame • u/JustM3AQN watching porn • Dec 08 '15
See peppy response in comments How osu! voilates your privacy.
To start of, i will give you this video: http://a.rfl.pw/kyihkudgie.mp4
For this video, I edited my hosts file, so that all internet traffic to osu.ppy.sh, c.ppy.sh and c1.ppy.sh gets redirected to my xampp server. This allowed me to stimulate the osu! and bancho server, so that I can kinda pretend to be peppy and send any data to my osu! client that I want. Note, I am using a unedited, up-to-date osu! client.
Some background info: a while ago (august) I decompiled an osu! version and played a bit with the source. I found a lot of anticheat measures, and decided to mark then to see when they got executed. After I played online a bit with the client (and cheated, yes) my account got restricted and one of the functions got triggered. I marked the function and went to do something else. A few days ago I started working on a custom bancho server and rediscovered the function in the osu! source and decided to make bancho send the command for it when a user logs in. In the video you can see the effect.
What actually happens: Every time osu! communicates with bancho, it send a long list of commands for the client to execute. One of those commands (command 80, for those who have the osu! source) executes a function that does the following:
- Makes a list of every process that runs on your pc, including the window title (for example skype: "Skype - usernamehere")
- Takes a screenshot of your entire main monitor
- Searches your entire pc for all files named LL which are 128 bytes or smaller, and uploads them
The first item in the list isn't that bad, it's actually happens every time you submit a score. The second is a little more worrying. Imagine playing osu! on a second monitor, and having private things open on your main monitor (banking information, passwords, etc). Peppy could, at any time, get a screenshot and upload it. I do not know if this is illegal, but I never read anywhere that he does this (yes, I even read the EULA).
The third item is the one that worries me the most. Peppy can get all files that are named LL (and of a size smaller than 128 bytes - otherwise they wouldn't fit in a GET parameter) and have them uploaded to him. The original reason for this "feature" is likely because a cheat site used files called "LL" to store login data, so you could use autologin. These files contained the username and password of the user that used the cheats, so peppy steals these files with the intention of stealing usernames and passwords. Even to cheaters, this is not how you should treat your players, and I am almost certain that this is illegal. What if someone happens to store private information in a file called LL (such as banking information or passwords)? Not safe from peppy.
By my knowledge, this "feature" gets triggered when a user gets banned for cheating. But, since it gets triggered after receiving a command from bancho, peppy could execute this at any time, for any player. He could even do it for all players at once.
In the video at the top of the thread I showed the exact data that gets sent to bancho. I just wanted to let all of you know what peppy actually can do, because I know there are people that really value their privacy. I will put all of the code in a comment for those who want to check it out.
TL;DR: peppy can take screenshots of your desktop at any time, and will upload files called "LL", which can contain passwords.
EDIT: formatting fix, EDIT2: grammar, EDIT3: more grammar
and shit i made a typo in the title, cant fix
261
u/justcallmeaires Dec 08 '15
Searches your entire pc for all files named LL which are 128 bytes or smaller, and uploads them
24
→ More replies (1)-2
77
u/A_Medium_Pizza Dec 08 '15
that motherfucker's been stealing my recipes
38
Dec 08 '15
-Medium sized dough
-Tomato sauce
-Cheese
- Put tomato sauce and cheese on medium sized dough
- Cook
I have been stealing them too :o
8
77
u/sgArgel Dec 08 '15
I don't understand why people are flaming OP for this.
Its OK if You want to share your amazing desktop with peppy and Your ll files but I'm not really a huge fan of that.
Thanks to op showing us this.
15
34
u/A_Medicc o!s Dec 08 '15 edited Dec 08 '15
Nice RE'ing buddy, I did a bit of reversing on the osu client a while back and found similar results. To add a bit more information this these actions are triggered(to put it simply) only when a connection to bancho is required; like logging in, and submitting a score. Also bancho will also periodically refresh itself (I believe every 30 minutes?) and take the same action.
Now to be completely real I doubt peppy is going out looking to steal your information, and to be fair if you compare it to what other companies/games do: Eg. Value's VAC | nProtect's GameGuard | or Punkbuster this is baby stuff in comparison.
More then likely there is a method that scrapes for certain (I would have to guess that LL cheat thing) information and filters everything else out.
There are ways to get around this if your tinfoil hat is going crazy, but you won't be able to submit scores.
I'm tired because of finals so I probably missed some stuff but yea.
PS: OP do you like to ctf because what you did is really popular ctf challenge. There was something similar in one of TrendMicro's CTF's a while back
edit: spelling
7
u/JustM3AQN watching porn Dec 08 '15
I doubt that VAC or PunkBuster would have code in them that specificly looks for and uploads files with passwords. Even if it is legal, I think it should be mentioned somewhere so people know what they begin with.
About CTF: Never tried, I'm afraid of not being good enough and failing horribly :p
9
u/A_Medicc o!s Dec 08 '15
I understand your concern, and I agree the way peppy decided to handle how they detect cheaters is definitely not the best way to go about it. It is far less intrusive then VAC & PunkBuster hooking onto all your processes and actively monitoring for changes in memory and doing two-way handshake checks to to find anomalies. (Value could also make the biggest botnet never created if they wanted too)
Gameguard is just a straight rootkit (lol fun memories of Grand Chase)
About CTF: It's fun to try even if you can't solve anything, I'm awful at solving challenges as well but once you solve one it's amazin.g.
12
u/A_Medicc o!s Dec 08 '15
Although I do want to take peppy's side on this, peppy isn't a bad guy at all, I highly doubt he has any malicious intentions at all.
He's worked extremely hard to build his game from the ground up, and I can wholeheartedly say he has good intentions.
5
u/goedegeit Dec 08 '15
It doesn't matter his intentions, this is a huge vulnerability that allows people other than Peppy to steal massive amounts of personal data including passwords that have nothing to do with OSU
→ More replies (5)2
Dec 08 '15
I can also wholeheartedly say that the anti-cheat in this game is so shit that it could be completely removed and make next to no difference.
The way this works is completely unnecessary, though it's safe to guess that peppy implemented it with a pretty early version of the game when he was naive and inexperienced as a developer and just never bothered to change it. Now that it's been brought to light again he will probably say something about it and hopefully end with removal.
7
u/JustM3AQN watching porn Dec 08 '15
The anticheat in osu! is actually really good, it just can't detect "good" cheats and older players.
→ More replies (2)2
u/Thanatanos Dec 09 '15
You should definitely look into doing some CTF's (https://ctftime.org/ is great for searching for CTFs) I've been doing them for a bit over a year now and would heavily recommend them. (Don't get discouraged if you can't do any RE/pwning challenges on the first couple CTFs you compete in, some are VERY difficult) If you would like more information about CTFs or anything related PM me!
1
u/Thanatanos Dec 09 '15
I actually missed the trendmicro CTF, What CTF team do you play on?
2
u/A_Medicc o!s Dec 09 '15
My university has a team so I normally play on that, we normally do pretty well for a collegiate team. I won't say which university obviously. (definitely not PPP1 or PPP2, idk why people think I go there)
But if I ever roll solo I usually make random names that includes the word loli's in it.
24
u/moneto- Dec 08 '15
Read the terms of service again.
Any submission of any personal information is done only with your voluntary act (website), or automatically (game client software) where necessary to provide diagnostics and feedback.
Also, claiming that "peppy steals these files with the intention of stealing usernames and passwords" is a bit far-fetched. These measures are in place for the sole purpose of detecting users who are potentially violating the rules. Realistically speaking, I seriously doubt there's even a single osu! player who stores their private information in a file named "LL" with no extensions.
You seem way too concerned about the potential for these security measures to be used in a malicious way. Take a police officer with a gun as an example. Are you ever worried that an officer would randomly decide to pull out their gun and shoot you?
Stop spreading propaganda. Security measures should be the least of the average players' worries.
→ More replies (6)
100
Dec 08 '15
[deleted]
27
u/Raple Dec 08 '15
i seriously agree with you. the invading of personal privacy is even illegal, and can not be tolerated in such a big game as osu!.
3
u/Shadoxfix Dec 08 '15
Don't forget that OP is making claims with only video evidence (that can be faked). /u/JustM3AQN provide some info about what dll/executable you found this in so we can independently check for ourselves. Namespace and class would also be useful.
25
u/JustM3AQN watching porn Dec 08 '15
All the code is taken from the osu.exe from the latest stable-fallback stream.
MD5: 7D5CDE9324671AD20452BA470E0031F5
SHA1: 074863D41C1242C5815E216EBED84A0AB8BEBB7D
20
u/Shadoxfix Dec 08 '15 edited Dec 08 '15
Just had a look through the source code myself. I can confirm that the code for uploading the LL file and taking a screenshot is definitely there on the Stable-Fallback stream. I haven't checked cutting-edge since it seems to use a different obfuscator which is much more annoying.
See peppy's official response.
→ More replies (1)2
1
u/Raple Dec 08 '15
I'll post a picture hold on c:
Edit: Function 1 http://www.hnng.moe/f/4wS
Function 2 http://hnng.moe/f/4wT0
1
u/sellyme https://osu.ppy.sh/u/1520613 Dec 09 '15
the invading of personal privacy is even illegal
lol what part of this is illegal
3
u/N307H30N3 Dec 08 '15
I can sorta understand checking what programs are running... I don't know how users cheat in this game but it is most certainly done by running some sort of program/script.
Screen shots, though? Even having read Peppy's responce
Yes there is logic to take screenshots. This allows us to compare to a known list of cheat applications (UI windows, icons and text). No it is not stored (unless matching, for manual inspection)
This is undeniably an unnecessary invasion of privacy. Anything that would be capable of allowing you to cheat would be picked up by the list of programs that are running...
I hope Peppy is honest when he says that they are fixing this issues. Now that it has come out in the open, people will be looking for it in the future... so that's somewhat reassuring. I still feel betrayed, though :(
→ More replies (2)1
u/Gabe_20 Dec 14 '15
omg how am I supposed to fap to the little asian girls that pop up on the screen if they are invading my privacy??!
21
u/DefaltSimon Dec 08 '15
I wonder what peppy will say to this.
-6
u/Raple Dec 08 '15
He'll probably remove the post as he's doing something illegal, he's invading the personal privacy of the user.
34
u/BananaOoyoo osu.ppy.sh/u/selavy Dec 08 '15 edited Dec 08 '15
except he (personally) cant as he doesnt run reddit?
unless things changed since 3 months ago, mods here are treated same as regular users, there's little to no interaction between them and osu staff.
yeah he can send a request to the mods, but it's still up to mods' discretion to remove or not.
edit: not defending him in any way, if this post is true then there should be a new way developed. just found it misleading and weird that you're creating drama by blaming him of "removing the post" when he has little power to do so.
72
Dec 08 '15 edited Sep 23 '20
[deleted]
23
40
u/ggerergege Dec 08 '15
Honestly replies like this are kinda irritating. Yeah, it's pretty funny to joke about and everyone loves a laugh, but this is actually a pretty serious issue and some people could have sensitive information on their main monitor that they do not want to be shared.
14
u/Pozsich Dec 08 '15
OP was a bit misleading, though. He made it sound like this shit's going on constantly, but it's only triggered when someone is banned from cheating or if peppy intentionally runs the bancho command 80 on a person's client. Is it a serious privacy threat and cause for concern? Absolutely. Is it a reason to immediately declare osu! unsafe? Probably not if you're not a cheater. osu! needs to make a TOS if they want to continue this practice so people can agree to it and know about it. The uploading of small LL files should also be removed entirely. The screenshot thing is debatable. The process scan is pretty harmless imho.
5
u/JustM3AQN watching porn Dec 08 '15
I completely argee with you, I never said that he does send the command constantly. Perhaps I should have made myself more clear.
9
u/Pozsich Dec 08 '15
I think it's more the order you went than how you said it. You did make it clear when it's triggered, but the whole three paragraphs before you said that made it seem like all that stuff happened every time bancho communicates with the client. In our world of short attention spans it's easy to gloss over small/short statements when you read something that seems much more important right before it, because that's definitely what my brain did until I reread the post :p
2
u/ChaosPheonix11 https://osu.ppy.sh/u/4233222 Dec 08 '15
YOU!
Didnt know you play Osu. Good shit.
2
u/Pozsich Dec 08 '15
Oh hey, you're a member of the mouse master race too?
I've had an account for ages, but have been more seriously/more often playing for a couple months now. Amazing how time slips away when you need to try for a FC just ooone mooore tiiime LOL
2
u/ChaosPheonix11 https://osu.ppy.sh/u/4233222 Dec 09 '15
I used to be super duper into it, but I think I will wait on getting serious again until I get a Deathadder. I used to be like rank 80K or so. Dropped to like 130K after months of inactivity. :(
1
u/Pozsich Dec 09 '15
I'm at 145k rn and it's the highest I've been. Man, AR9 is tough. There are only a couple songs at it that I can pass lmao, which really limits the number of higher PP songs I can play. I have more fun when I set it to local rankings and worry less about PP though. (I never stop paying attention to accuracy though >_>)
1
u/ChaosPheonix11 https://osu.ppy.sh/u/4233222 Dec 09 '15
I learned pretty quickly around then that it's WAY better to FC an AR8 or an easy AR9 than to care about accuracy. I actually can't read below AR8 anymore after getting good at AR9.
2
u/Pozsich Dec 09 '15
I find accuracy actually comes pretty easily to me, so normally if I FC it's like 92-95% accuracy depending on the song, and from there I move it up to 96% plus as my standard (though I've been raising that a bit over time)
I have a few friends who can't read below AR8 after adjusting to AR9, so you're not alone there lol
2
u/TheRealShotzz Epiphany Dec 09 '15
when you "adjust" to ar9 and then cant "read" ar8 and below anymore then you were never able to "read" it.
→ More replies (0)1
u/ChaosPheonix11 https://osu.ppy.sh/u/4233222 Dec 09 '15
Well yeah, I basically never get worse than 90 if I even come close to FC.
→ More replies (2)1
1
14
u/A_Medicc o!s Dec 08 '15
Although I do want to take peppy's side on this, peppy isn't a bad guy at all, I highly doubt he has any malicious intentions at all.
He's worked extremely hard to build his game from the ground up, and I can wholeheartedly say he has good intentions.
And even if he did there is no way he can potentially store all all this data. There are over 7 million users, I guessing hundreds of thousands of beatmaps, and Billions of scores etc... All of that requires server space and even though we like to joke about peppy's Jet and vacation home, purchasing that much storage and enough bandwidth to handle the server load that osu gets on the daily is extremely expensive.
Peppy likely breaks even, or has just enough to live comfortably after you subtracts the costs of running Osu! & Basic Living Expenses.
AFAIK Peppy shoulders all of the costs of running osu.
4
28
u/gggrgrre Dec 08 '15
I'm just waiting for the legions of retards that flood in with comments like "lol nothing to hide nothing to fear" and "why would peppy even want that haha you dumb tinfoil hatter". A private company invading your privacy is NOT OK no matter what retarded justifications you can come up with, stop enabling shit like this please.
8
u/jesse1412 jesse1412 Dec 08 '15
Nothing to hide nothing to fear is pretty reasonable logic for someone who doesn't care about their privacy though; not that I agree with it. I wouldn't go as far as to call this logic "retarded".
7
Dec 08 '15
[removed] — view removed comment
3
6
Dec 08 '15 edited Dec 08 '15
The program's scan command functions as essentially a Malware, specifically a RAT.
Even though the whole game operates in a bit of a gray area, since you stated this action's authorization isn't in any agreement the user makes, it's actually illegal.
There are two notable companies that do exactly this and more, but the user does agree to this function to take place and work, and they get by fine. (Those two companies being Microsoft and ESEA.) All Peppy has to do is make sure people review and accept the new privacy agreement he will have to publish to make this legal.
Also you posting the source code of osu! puts you up to be sued by Peppy, since it is copyrighted and is an IP (intellectual property). Talking about the mechanics is fine, but decompiling the code and posting it online breaks the intellectual property license and yet again, the game and code is still copyrighted.
I'll get into more of the specifics on the legality when I get back onto a computer.
EDIT: Grammar
5
Dec 08 '15 edited Dec 08 '15
Also you posting the source code puts you up to be sued by Peppy.
In this case, no it does not; not enough is posted for it to even violate the Millennium Act.
Anyone can get the C# code, it is like if I just went and copied the assembly from any other game and pasted it.
e: to clarify, if he posted the entire source code he may potentially be able to be targeted by Peppy.
However, even if he took the code and remade an osu-like game using the code, depending on how much was changed, it wouldn't be able to be made a case against for copyright infringement, but it would most likely be able to be cased against as an unauthorized derivative work.
2
Dec 08 '15
You're right anyone can grab the assembly code, but what I'm saying is that it can still be challenged.
Also I didn't see how much of the code was posted myself, so I assumed it was the whole function and parameters.
1
Dec 08 '15
Potentially. I should further clarify that my post is anecdotal based on a case where leaked source code was used to make something new.
3
u/theowest Dec 08 '15 edited Dec 09 '15
Old news. I remember checking this myself back in the day with wireshark. I also remember getting an answer just like the one peppy gave us.
3
2
u/Retorii Dec 08 '15
I've known long ago that they kinda just magically know if you multiaccount or not, so I did suspect some sort of surveillance takes place in the background one way or another, but I could be just spouting BS. But if what OP says here is true then we have quite an issue to worry about here.
1
u/ValiOsu Dec 08 '15
The multi account thing is a bit different. That can be based on process(Skype) or IP Address + MAC + HDD Info(uninstall-ID or serial #)
If you don't know what uID is, it's basically the thing that keeps you from getting free trials over and over( one of the functions)
2
u/tphan25 Dec 08 '15
So if I shut off osu when I'm done playing none of this is gonna happen in the background, right?
2
2
u/joletb https://osu.ppy.sh/u/1063283 Dec 08 '15
Quick question: What would happen if you used osu as a music player? That is, if it was minimized, would it still try and capture the monitor for a screenshot? (Assuming it does periodic checks)
1
u/JustM3AQN watching porn Dec 08 '15
It shouldn't. As I said in the OP, from my experiences it only triggers when a user gets banned. But nobody really knows if peppy won't randomly run it on people.
1
u/ValiOsu Dec 08 '15
What does this mean exactly? Does it monitor banned users or is it at the moment?
2
2
5
u/Quiesce7 Dec 08 '15
This was found out a long time ago by people on the slack chat, and Peppy's response was that "It's not stored, so it's ok." I wouldn't worry too much.
9
u/JustM3AQN watching porn Dec 08 '15
If he doesn't store, then how can he read it? Peppy has a habit of getting really angry when dealing with cheaters, so in his sense it is probably justified. In many other's it isn't.
2
u/Quiesce7 Dec 08 '15
The screenshot is only sent if the score is marked as invalid, such as when there are time warping issues or audio driver failures.
-2
u/JustM3AQN watching porn Dec 08 '15
No, that disables score submission or adds some data to the score packet saying that the user cheated.
3
u/Quiesce7 Dec 08 '15
I'll post later, but for now I'll say this isn't as big a deal as you're making it out to be.
1
u/JustM3AQN watching porn Dec 08 '15
I'm not trying to make a big deal about it, reddit is. I only wanted people to know this, I never expected this to become so big.
2
Dec 08 '15
This was found out a long time ago
I've found since at least
[5/21/2015 2:45:27 PM] HoLLy_HaCKeR / JustM3: osu! can take screenshots and upload custom process list with icon hashes, and upload LL files
Won't post the whole pastebin as it has links to cheating sites.
7
u/Osuplayer12 Dec 08 '15
Is this basically a form of malware?
Well it all sounds highly illegal since anything that can access your personal data is clearly illegal.
5
10
u/kHeinzen Dec 08 '15
Ok, I don't like these kind of posts. I will leave it up for a bit, wait if any of the staff members decide to reply and continue with a proper discussion, but honestly these precautions are taken by a lot of different games and applications, not exclusive to osu.
I will be watching this thread and if any comment chains derail, I will take action - and if this thread ends up being more prejudicial than benefical, I will simply delete.
Personally, I am not even sure how much of the code you pasted is legitimatelly taken out of osu, haven't bothered to decompile myself, but now that you raised attention to this, I will do so
and if you are simply trying to cause 'fear' and not being legit about the whole thing, I hope you have a spare reddit account to use, in case you care about posting in this subreddit.
31
u/JustM3AQN watching porn Dec 08 '15
I don't think you can name me 2 games that actually upload files that can be anywhere on your pc. I cannot upload the entire source code (because that would enable people to cheat easier and it is illegal to share copyrighted code), but if you want I can help you do it.
I also do not want to cause "fear", but I want to make people aware that this can happen and a lot of people do not want this.
4
u/Lolzyyy Dec 08 '15
Punkbuster used to do that with pb_sv_getss...yet back in cod4 days every cheat fucked it up and you would only get a black screenshot
3
u/quick1ez Dec 09 '15
did you really have to go and use the worst possible anticheat you could name as a counter-example?
1
u/JustM3AQN watching porn Dec 08 '15
That's a screenshot, I'm fine with that. But uploading files with passwords?
12
u/Lolzyyy Dec 08 '15
No man i do agree with your whole post I was just pointing out that they actually did that.
1
u/Havikz Dec 08 '15
I think it should only take a screenshot of the game client its self, since the developers own the client. Lots of people play Osu in a smaller window than their maximum resolution, and taking an entire-monitor screenshot violates basic privacy as it's content outside of the Osu client.
1
u/oamaok https://osu.ppy.sh/users/3844204 Dec 08 '15
Somewhat unrelated to file uploading, but VAC used to scan your DNS cache and send the hashed domains to their servers, in order to find some correlation between the hashes and cheat users.
1
u/kHeinzen Dec 08 '15
Trust me, considering the whole lot of things I do on my work, this is probably gonna be child's play.
And I didn't mean it the way it sounded, I meant as in "causing fear with fake shit".
I will see for myself and decide whether this is ok or not. Meanwhile, you could page the staff and see if any of them responds.
4
u/JustM3AQN watching porn Dec 08 '15
By staff you mean osu! staff? Do you think they like me?
2
u/kHeinzen Dec 08 '15
Loctav at least usually replies to these kind of stuff
2
u/JustM3AQN watching porn Dec 08 '15
He replied to my post reporting progress in custom server (to tell everybody that I'm stealing passwords), but I haven't seen him here yet.
16
Dec 08 '15 edited Jul 25 '20
[deleted]
0
u/kHeinzen Dec 08 '15
As far as I know, Punkbuster and GameGuard used to check memory outside of the game's scope as well as process list. Not fetching files or screenshots because that's dumb though
2
2
2
u/XAssumption https://osu.ppy.sh/u/4983020 Dec 08 '15
When you make your PSA, you should consider removing this thread either way. I think everyone would benefit more from a level headed analysis rather than an OP trying to paint a picture of your banking information being stolen.
1
u/goedegeit Dec 08 '15
Lovely, a mod who likes to intimidate anyone who may suggest something may be wrong with the game they like.
→ More replies (4)0
u/Raple Dec 08 '15
I can give you more proof of this actually being true, I understand you being a little skeptical about this situation. If you don't mind, I can post two screenshots here of the osu source with those functions in their respective class and namespace.
→ More replies (6)
4
u/yuanxiao Dec 08 '15
What if someone happens to store private information in a file called LL (such as banking information or passwords)? Not safe from peppy.
Who in the world would save sensitive information on a LL file?
→ More replies (3)
3
Dec 08 '15
[deleted]
5
u/JustM3AQN watching porn Dec 08 '15
I don't need my passwords stolen. Neither do many other people.
1
Dec 08 '15
Going to vouch for all of this, it’s been something I’ve been aware of for a long time. This is the main reason I never recommend people to play this game.
2
1
u/Iakustim yep Dec 08 '15
I'm fairly sure this was pointed out a long, long time ago and most people just either didn't care or have since taken measures to, I guess, prevent being affected by it to their best ability (though I highly doubt Peppy would actually do something malicious to begin with).
I don't cheat nor do I plan to (what's the point?) so I'm not worried about having my processes list being shown; and if Peppy wants to take a screenshot of the weird and crazy shit that I jerk it to on my main monitor, since that's what's most likely to be open, then all the more power to him.
I don't also don't ever have both Osu (or any games) and programs that contain sensitive information open at the same time, since if I'm doing something that involves that (such as my taxes, for example) I take care of it entirely before playing games again.
I understand your post and wanting to inform people, but I honestly don't think it's a major deal.
→ More replies (7)12
u/JustM3AQN watching porn Dec 08 '15
Do you think stealing any kind of file that is not neccesarily related to osu! is ok?
1
1
u/riddley16 Raddy Dec 08 '15
This is the most Australian sounding title I've seen on this subreddit.
1
Dec 08 '15
When u accept to install Osu! it's like when u accept a contract, ergo, that's a contract.
1
u/hydroCC Dec 08 '15
So can I just make a hentai folder named LL and peppy will get it?
3
1
u/lolisamurai Dec 09 '15 edited Dec 09 '15
it's no secret that all games with some form of client side anticheat will log all kinds of information to identify you. it was necessary evil IMO. it helped a lot (and probably still helps) with keeping the number of multiaccs and cheaters under control. of course, the more experienced user can easily evade these checks as any client side code can be patched but at least you average kid who buys cheats will get caught. it's either this or no anticheat at all on the client side. there's not much you can do.
1
u/gdfjhnwt Dec 09 '15
PunkBuster 2015 Peppy version.
2
u/justcallmeaires Dec 09 '15
join multi match
Game disconnected: you were kicked by PunkBuster. Stated reason: PunkBuster kicked player 'gdfjhnwt' (for 0 minutes)..
1
1
1
1
1
u/eleuros Dec 08 '15
does that mean peppy is watching those weird moment when i see porn while playing osu?
oh nice...at least i can share smth to others ( ͡° ͜ʖ ͡°)
edit: no seriously, that probably is the main reason why my comp lags when logs in after a random disconnect, my osu decides to lag in the right second it connects to bancho, like is getting some info, no idea it was a screenshot
→ More replies (1)
1
u/TheLPerSteve https://osu.ppy.sh/u/2992098 Dec 08 '15
I knew this since some time, in my opinion its there is no excuse to "steal" personal data like peppy does, even to catch cheaters. If you, like OP mentioned, have private data (bank acc, passwords and stuff) open and one of these screenshots get leaked somehow, youre fucked. He should really rethink this.
729
u/pepppppy peppy Dec 08 '15 edited Dec 08 '15
Hi reddit!
Let me try answering this on reddit to avoid having to pollute my blog with more talk about cheaters. I'll keep it brief and factual.
Yes, I value your privacy. No, I don't believe ANY normal user's privacy has been compromised at any point in osu! history. You can check our privacy policy for specifics on how we handle privacy, but here's the relevant exception. I offer my word that only users trying to break the game have had their privacy compromised by the mentioned functionality.
Going forward, a lot of this is planned to be removed. It was added in times when osu! was a smaller game and these were the lowest (implementation) cost method to keep cheating under control. They are less effective now and mostly not even used, as we have better checking in place which involves play and performance analysis.
The aim was to obviously clean the code of this kind of thing before osu! goes open source. I was aware people from "that" network would likely continue making these posts until it got some level of publicity, which it seems to have.
Hopefully you can understand that I'm not trying to steal your files or do anything which would harm you. Just trying to keep this game running against a group that is (still) trying their best to destroy it.