Slashdot Mirror
Activision Blizzard Secretly Watermarking World of Warcraft Users
New submitter kgkoutzis writes "A few days ago I noticed some weird artifacts covering the screenshots I captured using the WoW game client application. I sharpened the images and found a repeating pattern secretly embedded inside. I posted this information on the OwnedCore forum and after an amazing three-day cooperation marathon, we managed to prove that all our WoW screenshots, since at least 2008, contain a custom watermark. This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time. It can be used to track down activities which are against Blizzard's Terms of Service, like hacking the game or running a private server. The users were never notified by the ToS that this watermarking was going on so, for four years now, we have all been publicly sharing our account and realm information for hackers to decode and exploit. You can find more information on how to access the watermark in the aforementioned forum post which is still quite active."
The difference with digital camera watermarking is that EXIF is a (not always obvious depending on the UI, and sometimes less standard that it ought to be) standardized metadata storage system. The internet is rife with amusing mistakes made by people who don't know about exif and upload anyway; but that's a UI/user problem. The fields are well known, easily viewed and edited with commonly available software, and not designed to be covert or strip-resistant in any way. Some imaging devices are, quite arguably, excessively chatty by default, and that is a legitimate concern given user ignorance; but there isn't anything sneaky about the technology.
Watermarks, at least in this incarnation, are designed to be covert, strip-resistant, and are not intended for the creator of the image to be aware of.
This is a 'prisons and fortresses share certain architectural similarties; but do not share purposes' situation...
"This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time."
And, without a password to go with that user ID, none of these are what one should reasonably consider "personal" or "sensitive" in the first place.
IMHO, in terms of privacy concerns, this is a non-story. Simply presenting it to Slashdot as a neat graphical hack would make more tinfoil-free sense.
~ Whence do you come, slayer of men, or where are you going, conqueror of space?