Slashdot Mirror


Activision Blizzard Secretly Watermarking World of Warcraft Users

New submitter kgkoutzis writes "A few days ago I noticed some weird artifacts covering the screenshots I captured using the WoW game client application. I sharpened the images and found a repeating pattern secretly embedded inside. I posted this information on the OwnedCore forum and after an amazing three-day cooperation marathon, we managed to prove that all our WoW screenshots, since at least 2008, contain a custom watermark. This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time. It can be used to track down activities which are against Blizzard's Terms of Service, like hacking the game or running a private server. The users were never notified by the ToS that this watermarking was going on so, for four years now, we have all been publicly sharing our account and realm information for hackers to decode and exploit. You can find more information on how to access the watermark in the aforementioned forum post which is still quite active."

166 of 272 comments (clear)

  1. Other games? by SJHillman · · Score: 4, Interesting

    Is this known to be the case for any other games? IE: Diablo III?

    1. Re:Other games? by Zocalo · · Score: 5, Funny

      I know surfing the web using Internet Explorer can be a bit of an adventure, but even so, I think that's probably the first time I've seen it referred to as a "game".

      --
      UNIX? They're not even circumcised! Savages!
    2. Re:Other games? by Teancum · · Score: 2, Insightful

      Internet Explorer is indeed a game. It is just a game played at a higher level and you are unwittingly a participant in that game acting as a pawn. That you may or may not actually be using that software is itself a part of the game.

    3. Re:Other games? by tepples · · Score: 3, Funny

      So I take it the only way to win IE is not to play. In that case, how does one start with a store-bought PC and download something better such as Firefox, Chrome, or a whole different operating system, without playing?

    4. Re:Other games? by the+simurgh · · Score: 3, Interesting

      i wonder how long till a lawsuit is filled because activision basically gave hackers all the info they needed to hack accounts and never told account holders not to post screengrabs because it contained account info.

    5. Re:Other games? by sarysa · · Score: 1

      That's the problem with soccer. You constantly wait for it, but it never comes...

      --
      Charisma is the measure of someone's ability to lie with a straight face.
    6. Re:Other games? by Anonymous Coward · · Score: 1

      how does one start with a store-bought PC and download something better such as Firefox, Chrome, or a whole different operating system, without playing?

      wget.

      Leave your geek badge at the door.

    7. Re:Other games? by Anonymous Coward · · Score: 3, Informative

      It contains the account name (which cannot be used to login anyways since you have to use a battle.net ID to login now), and the IP of the server you're playing on (which is public anyways), and the timestamp. Not sure if I know what info you're talking about that "basically gave hackers all the info they needed to hack accounts."

    8. Re:Other games? by ildon · · Score: 1

      The account name posted is not what you use to login. If you created an account after the Battle.net 2.0 account merger, you have no way of even knowing what your own "account name" is.

    9. Re:Other games? by ildon · · Score: 1

      Ah, that makes sense.

    10. Re:Other games? by tepples · · Score: 1

      store-bought PC

      sudo apt-get install firefox

      'sudo' is not recognized as an internal or external command,
      operable program or batch file.

      wget http://mirror.csclub.uwaterloo.ca/ubuntu-releases/lucid/ubuntu-10.04.1-desktop-i386.iso

      'wget' is not recognized as an internal or external command,
      operable program or batch file.

      Any store-bought PC not made by Apple will include Windows as its only installed operating system, and I'm not aware of a command-line HTTP downloader client shipped with home versions of Windows.

    11. Re:Other games? by CanHasDIY · · Score: 1

      Yea, I forgot to mention - you need a Linux live CD to do this, and it assumes that you're replacing Windows/dual booting.

      Actually, now that I think about it, with a live CD and flash drive, you can very easily get firefox without ever touching IE; just boot into the live CD system and use its web browser (likely firefox) to hit Mozilla's website and download the firefox install executable, transfer it to the flash drive, then reboot into Windows and install your new software.

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
    12. Re:Other games? by CanHasDIY · · Score: 1

      Also, this.

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
    13. Re:Other games? by tepples · · Score: 1

      Which means that unless one already has a Linux live CD, one would have to download Firefox using the command-line FTP method you mentioned and order a Linux live CD that way, or possibly download a disc image from ftp.ubuntu.com and burn it. But I guess if IE is demoted to "Firefox Downloader", the game is an arguable win.

    14. Re:Other games? by CanHasDIY · · Score: 1

      I personally recommend everyone keep a live CD around for, if nothing else, troubleshooting issues in Windows (i.e., wireless works w/ the live CD but not the Windows install). Heck, I'm pretty sure I've got a Knoppix 4 CD around here somewhere, that thing belongs in a museum...

      The FTP method is probably the most effective way to download FF without ever having to open IE, unless you're just adamantly opposed to the Windows command line (wouldn't blame ya); in that case, you can actually copy/paste the ftp server address into the Location bar at the top of any Windows Explorer menu, and it will open a connection to the server in that window.

      I just prefer command line stuff, makes me feel all hackery :D

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
    15. Re:Other games? by CanHasDIY · · Score: 1

      Live CD and live USB - 'cuz sometimes, having an available CD/DVD burner is handy in a live distro.

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
  2. Cows!! by onyxruby · · Score: 1

    There was an infamous cows shot from a hell level of diablo2 from years ago that my character surrounded by hundreds of cows. Wonder if that if that was watermarked?

    1. Re:Cows!! by zieroh · · Score: 1

      Thanks for your input xxxxxx@xxxxxx.xxx

      That's seriously fucked up.

      --
      People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
  3. Brain encoding. by Valor958 · · Score: 3, Funny

    It's not actually a watermark on the picture. It's a watermark encoded in your brain from playing too much WoW.

  4. Ouch by ledow · · Score: 4, Interesting

    Ouch. That's gotta hurt. I think there's a case for even places like the EU commission there, if people are unknowingly distributing other's data.

    That said, I don't really care because I've never touched WoW. But, yeah, I can see the problem. 4 years of IP -> client records, plus things like date-time stamps. If nothing else, that's a whole host of web-crawling to link people to IP's, accounts.

    You kind of expect it in pre-release reviews or betas or something but in the full client and in every screenshot? Bit nasty.

    More interesting - what other games do that?

    1. Re:Ouch by Anonymous Coward · · Score: 3, Informative

      More then you think. It was a feature in spore. It let you drag the image to the game and the game would pick up the animal in the image. It was an awesome feature.

    2. Re:Ouch by xSquaredAdmin · · Score: 2

      According to the summary it links user IDs to the IP of the server they were on, not the client's IP.

      --
      Crushing dreams at the speed of sarcasm
    3. Re:Ouch by Wovel · · Score: 1

      It's the server IP...

    4. Re:Ouch by cpu6502 · · Score: 2

      This story is hardly news. "A megacorp acts like an asshat and reveals personal data online via photo watermarking." I've come to expect ALL megacorps act like asshats nowadays. It's a challenge to find one that doesn't.

      --
      My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    5. Re:Ouch by theArtificial · · Score: 1

      Ouch. That's gotta hurt. I think there's a case for even places like the EU commission there, if people are unknowingly distributing other's data.

      I can imagine it now, having to get model releases signed for any screenshots which have other characters present. If you look closely at the terms Blizzard specifically tells you that everything is their property (this is apparent if you ever try to sell 'your' account) from the contents of your characters inventory, to the character itself.

      That said, I don't really care because I've never touched WoW. But, yeah, I can see the problem. 4 years of IP -> client records, plus things like date-time stamps. If nothing else, that's a whole host of web-crawling to link people to IP's, accounts.

      The embedded IP address is the IP address of the server the game client is connected to. I imagine this to be a concern if you're operating an unofficial server.

      You kind of expect it in pre-release reviews or betas or something but in the full client and in every screenshot? Bit nasty.

      Initial evidence shows that this only affects JPEG screenshots below quality 10 settings, if you use a 3rd party program such as Fraps to create screenshots you apparently avoid this issue entirely.

      --
      Man blir trött av att gå och göra ingenting.
    6. Re:Ouch by theArtificial · · Score: 3, Insightful

      A megacorp acts like an asshat and reveals personal data online via photo watermarking

      Personal information?

      Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

      The embedded IP address is the IP address of the server you're connected to. IP addresses are not personal information. The account name is not personal. If I follow this logic your email address is personal information, and so is your license plate? From their terms of service:

      For some activities, we may ask you to create a username and password and/or to provide other, non-personal information such as your age, date of birth, gender, and/or game and platform preferences; and, combine such information with your personal information.

      I've come to expect ALL megacorps act like asshats nowadays. It's a challenge to find one that doesn't.

      What do you expect, they're made up of people. I can see this really impacting someone who signed an NDA not to disclose things which they willingly agreed to in the first place. I'm sure you've never played Wow for any period of time because if you had, you'd realize when updates happen to their Terms, they present them to you and require you scroll through them and agree to them before you'll be able to access the game. I don't have some hardon for Blizzard but none of what they're collecting is personal.

      --
      Man blir trött av att gå och göra ingenting.
    7. Re:Ouch by noh8rz10 · · Score: 2

      This story is hardly news. "A megacorp acts like an asshat and reveals personal data online via photo watermarking."

      Well, that's the news, isn't it? I'm familiar with asshat corporations, but not familiar with nefarious jpg watermarking.

    8. Re:Ouch by grim4593 · · Score: 1

      Similarly, NI LabVIEW has the ability to embed program code in PNG screenshots. http://www.ni.com/white-paper/9330/en

    9. Re:Ouch by mcgrew · · Score: 1

      If nothing else, that's a whole host of web-crawling to link people to IP's, accounts.

      IPs have accounts????

    10. Re:Ouch by mibus · · Score: 1

      The embedded IP address is the IP address of the server you're connected to. IP addresses are not personal information. The account name is not personal. If I follow this logic your email address is personal information, and so is your license plate?

      Yes, I consider those things my personal details, along with my street address, phone number, bank account number, etc. etc.

    11. Re:Ouch by theArtificial · · Score: 3, Insightful

      Yes, I consider those things my personal details, along with my street address, phone number, bank account number, etc. etc.

      Something interesting about public information and personal information is it varies from jurisdiction to jurisdiction. Email addresses are used by both individuals and businesses. In the case of politicians or when requesting public records, in many situations emails are public knowledge. Not to mention many email providers provide indexes listing their members which are opt in. Your address is public knowledge as well as personally identifiable and is even listed on the side of your house and often times painted on the curb out front, and probably listed in a phone book. Look out Google Streetview! Your phone number is public knowledge and personally identifiable. It's also spread around when/if you: sign up for any discount memberships through a supermarket, opened a new business, registered a domain name (without the 'privacy guard').

      TL;DR:
      Besides the financial information, it's a legal question and depends where you reside.

      --
      Man blir trött av att gå och göra ingenting.
    12. Re:Ouch by marcansoft · · Score: 1

      Spore did it with alpha channel steganography (alternating between 0xFF and 0xFE alpha).

    13. Re:Ouch by theArtificial · · Score: 1

      Blizzard is not a healthcare provider to their customers (they're arguably detrimental to physical activity wouldn't you say?) and is not subject to HIPPA guidelines for any of their gaming services.

      --
      Man blir trött av att gå och göra ingenting.
  5. Reminds me of the Printer affair by Penurious+Penguin · · Score: 4, Informative

    HP (and others) used to, or maybe still do, use watermarking in printers to hide data revealing time, printer type, etc.
    http://news.cnet.com/8301-10784_3-5811739-7.html
    https://www.eff.org/issues/printers
    ~ Meta data is watching

    --
    Forward! -- Emperor Norton, 2012
    1. Re:Reminds me of the Printer affair by firex726 · · Score: 1

      All printer manufactures do this.
      It's done at the request of the government, for officially anti-counterfeiting purposes.

    2. Re:Reminds me of the Printer affair by TheGratefulNet · · Score: 2

      'request' ?

      yeah, they use pastel colored letterhead and say 'pretty please' when they ask you.

      sheesh!

      FORCED by the gov is more like it.

      --

      --
      "It is now safe to switch off your computer."
    3. Re:Reminds me of the Printer affair by Penurious+Penguin · · Score: 2

      I didn't know all printer manufacturers did; I'll be looking into it further, despite not having a printer for 5 years. The "officially anti-counterfeiting" bit is pretty dubious (as an excuse, not your statement) though. I actually thought their excuse would be The Children. Either way, while I dislike criminal activity, I do like due anonymity.

      --
      Forward! -- Emperor Norton, 2012
    4. Re:Reminds me of the Printer affair by fuzzyfuzzyfungus · · Score: 2

      If memory serves, it isn't actually a factor of printer manufacturer(and/or re-badger); but of the OEM behind the color laser print engine. Apparently there are relatively few of those, and some, thanks to a little leaning from Uncle Sam the details of which have never come to light, include the watermarking 'feature' in all their print engines. Since printer manufacturers can, and sometimes do, switch parts suppliers between models, a given manufacturer might have both bugged and clean hardware on offer at a given time.

    5. Re:Reminds me of the Printer affair by Anonymous Coward · · Score: 4, Informative

      https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-dots
      http://miami.typepad.com/springyleaks/2012/05/foia-release-names-spy-printers.html

    6. Re:Reminds me of the Printer affair by fuzzyfuzzyfungus · · Score: 1

      Some software(Photoshop being the big name; but not exclusive to them) also includes this 'feature'. If you manipulate an image of a major world currency in excessive detail, a neat little binary module included with photoshop will snag you and direct you to this rather bland organization.

    7. Re:Reminds me of the Printer affair by fast+turtle · · Score: 2

      Sorry but it only applies to color printers per International agreements to prevent/track counterfit money

      --
      Mod me up/Mod me down: I wont frown as I've no crown
    8. Re:Reminds me of the Printer affair by tlhIngan · · Score: 1

      The tracking dots are for output devices and apply to all output, counterfeit or not.

      On the input side, there's a pattern of 5 dots on practically all currency that programs like Photoshop and scanners recognize to degrade scanned images of currency. It looks like a distorted X with a dot at the ends and in the middle..

    9. Re:Reminds me of the Printer affair by theArtificial · · Score: 1

      Sounds like a job for a SLR camera with some good lighting and the GIMP. Here is an example of a camera used to do this in WW2

      --
      Man blir trött av att gå och göra ingenting.
    10. Re:Reminds me of the Printer affair by DarthVain · · Score: 1

      I believe legally they are obligated to in certain regions due to printers being used to try and print money.

    11. Re:Reminds me of the Printer affair by Macgrrl · · Score: 1

      IIRC it only affects high resolution colour printers and the dataglyph is printed in yellow ink/toner.

      Despite your skepticism, it was intended as an anti-counterfeiting measure, initiated by the Secret Service not the FBI.

      --
      Sara
      Designer, Gamer, Macgrrl in an XP World
  6. Re:Just JPG artifacts by Anonymous Coward · · Score: 3, Funny

    "Watermarks do not work that way!!! Good night!"

  7. sketchy but legit by v1 · · Score: 4, Interesting

    Their TOS describes how and what info is SENT to them by the client. This is information on your own computer. They don't have to tell you all the places they store your information. Think copy protection. There's a good deal of sneaky things they're doing on your computer to make sure you're running a legit license. They don't have to tell you about any of that. If you take a file that their client makes, and upload it somewhere, it may contain identifying information in it. This just happens to be a screenshot / image, that you wouldn't normally expect metadata to be in.

    It's not too different than say, your digital camera embedding metadata. And it does. A lot. Usually common things like date/time, fstop, exposure, etc, but also can include model of camera, CAMERA SERIAL NUMBER, gps location, firmware version, total number of shots taken, etc etc.

    So you can take off the tinfoil hat. It's too late. They're already in your head.

    --
    I work for the Department of Redundancy Department.
    1. Re:sketchy but legit by Anonymous Coward · · Score: 1

      "This just happens to be a screenshot / image, that you wouldn't normally expect metadata to be in."

      The data is part of the JPG image itself, it is not metadata. Metadata can easily be removed from a file, the data Blizzard has placed into a JPG would require removal with Gimp or Photoshop.

      This is really sloppy on Blizzard's part and they deserve the firestorm headed their way.

    2. Re:sketchy but legit by fuzzyfuzzyfungus · · Score: 5, Insightful

      The difference with digital camera watermarking is that EXIF is a (not always obvious depending on the UI, and sometimes less standard that it ought to be) standardized metadata storage system. The internet is rife with amusing mistakes made by people who don't know about exif and upload anyway; but that's a UI/user problem. The fields are well known, easily viewed and edited with commonly available software, and not designed to be covert or strip-resistant in any way. Some imaging devices are, quite arguably, excessively chatty by default, and that is a legitimate concern given user ignorance; but there isn't anything sneaky about the technology.

      Watermarks, at least in this incarnation, are designed to be covert, strip-resistant, and are not intended for the creator of the image to be aware of.

      This is a 'prisons and fortresses share certain architectural similarties; but do not share purposes' situation...

    3. Re:sketchy but legit by v1 · · Score: 1

      Whether or not they're steno'ing the data only affects what you KNOW is in the file. They're still allowed to PLACE anything in the file, and they're neither required to tell you what data, nor even be obvious about it being in there in the first place.

      --
      I work for the Department of Redundancy Department.
    4. Re:sketchy but legit by caluml · · Score: 1

      It's steganography, not stenography. Stenography is what people in court-houses do.

    5. Re:sketchy but legit by Missing.Matter · · Score: 1

      So if you find a secret message in a court transcription, we have a case of a steganographer stenographer?

    6. Re:sketchy but legit by theArtificial · · Score: 1

      The data is part of the JPG image itself, it is not metadata. Metadata can easily be removed from a file, the data Blizzard has placed into a JPG would require removal with Gimp or Photoshop.

      Or using a program like Fraps which apparently side steps this whole fiasco.

      This is really sloppy on Blizzard's part and they deserve the firestorm headed their way.

      Relating to what? This realistically (potentially) affects people who may sign NDAs or play on pirate servers. None of the information disclosed is private information. Any personally identifiable information they have was given to them by the player in the first place.

      --
      Man blir trött av att gå och göra ingenting.
  8. Re:That's no watermark... by Big+Hairy+Ian · · Score: 3, Funny

    No it's a sail boat!

    --

    Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

  9. So what? by aekafan · · Score: 1, Flamebait

    This is what I think Blizz/Activision will say if you complain. What are you gonna do, go play another game? Even though they are losing subscribers, they have enough that they really don't care. I don't play WoW, nor do I even like it, but I have some relatives who are so addicted to it that Blizzard executives could break into their house and rape their children, and they would give it a pass. This is meaningless on that scale.

    1. Re:So what? by Robert+Zenz · · Score: 1

      Exactly. As every user has read the TOS which they agreed to (*snickers*), they should know that they can't hold Blizzard reliable anyway...additionally, the "Acknowledgments" section sounds a like an interesting butt rape to me...well, not much worse then many other licenses, though.

    2. Re:So what? by theArtificial · · Score: 1

      As every user has read the TOS which they agreed to (*snickers*)

      What kind of person doesn't read what they're agreeing to in the first place? It explains why we have a mortgage crisis, "Oh a Mortgage document, TL;DR" /sarcasm

      --
      Man blir trött av att gå och göra ingenting.
    3. Re:So what? by srmalloy · · Score: 1

      "...can't hold Blizzard reliable..."

      Somehow, I think that's even more appropriate a comment than the "...can't hold Blizzard liable..." that I think you intended to write.

      I suspect, though, that Blizzard will make a response to this news... and the response will consist solely of pushing the data through an encryption function before it is used to watermark the screenshot so that it's no longer plaintext.

    4. Re:So what? by Robert+Zenz · · Score: 1

      Yeah...I know...I suck at english (or typing...depends)...I realized my typo an hour later, does that count?

  10. Re:Unsubstantiated Rubbish by gl4ss · · Score: 3, Insightful

    it's a pretty far done troll if so, if you read further to the thread(there was some disassembly from mac client).

    (it would be entirely feasible that they remove the watermark at full quality.. because it would be obvious then).

    this is blizzard we're talking about after all. (I don't think jpg artifacts would position themselves like that, not on any of my pron pics anyways)

    --
    world was created 5 seconds before this post as it is.
  11. Re:Why? by iamagloworm · · Score: 3, Interesting

    One may also ask 'Why would you play WoW?' but the answer is not a pleasant thing to say.

  12. Re:Unsubstantiated Rubbish by Anonymous Coward · · Score: 5, Informative

    If you read the thread, other people have actually decoded those "compression artifacts", and even wrote a tool to do it so, no, those aren't just artifacts.

  13. Re:Unsubstantiated Rubbish by firex726 · · Score: 1

    How do you account for the pattern then?

  14. Re:Why? by ciderbrew · · Score: 1

    Same reason they want to add your Facebook, twitter, game stats & time played/pissed away on line. A really shit reason.

  15. Re:Why? by Big+Hairy+Ian · · Score: 1

    Guild Websites, How To guides etc

    --

    Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

  16. Re:Unsubstantiated Rubbish by Anonymous Coward · · Score: 1, Insightful

    Has anyone actually done some work on the quality 10 screenshots to ensure that the pattern isn't actually still in the structure of the file?

    It was my understanding that digimarc's tech was supposed to make their watermarks essentially invisible to the human eye, and perhaps it is a biproduct of lossy compression that's actually showing the pattern on lower qualities.

    Has someone taken the eye-dropper tool to a large section of a quality 10 screenshot to verify that there aren't pixels that have a different color by even one bit?

  17. Substantiated Fact by L4t3r4lu5 · · Score: 5, Informative

    This post has a script to save the watermark only

    Next time, actually read the thread before posting.

    --
    Finally had enough. Come see us over at https://soylentnews.org/
    1. Re:Substantiated Fact by Yvan256 · · Score: 3, Funny

      I'm sorry but that's totally false. The moon isn't made of cheese.

    2. Re:Substantiated Fact by Copperhamster · · Score: 1

      Ahh Fraps, the best investment I ever made so many years ago when games often didn't do these 'screenshot' things.

    3. Re:Substantiated Fact by crazyjj · · Score: 5, Funny

      Hell, sometimes I don't even read the comments before replying.

      --
      What political party do you join when you don't like Bible-thumpers *or* hippies?
    4. Re:Substantiated Fact by Intrepid+imaginaut · · Score: 2

      I don't even read my own comments, just hit the keyboard randomly. Sometimes I get lucky, sometimes not so much.

  18. Re:Unsubstantiated Rubbish by kgkoutzis · · Score: 5, Informative

    From reading the thread, the artifacts do not appear when JPEG quality is set to 10 (i.e. maximum) or if a non-lossy algorithm is used (like TIFF or PNG). If this was meant to be a watermark, the programmer who wrote the algorithm should be fired.

    These are most likely JPEG compression artefacts.

    They did this on purpose, in order to avoid having their watermark identified when viewing the images in really high quality. An Assembly expert wrote some code that allows you to add this watermark on purpose in the high quality images: http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-general/375573-looking-inside-your-screenshots-4.html#post2491687 We also decoded the content of the watermark and it indeed contains the account information, as mentioned. It is NOT artifacts. Please read the full forum post before posting dis-informative comments. Thank you.

  19. Absurd by medv4380 · · Score: 1

    JPEG compression artifacts? That's absurd! How would a random compression artifact contain the UserID, Time, and IP address? I'd be more likely to believe that was an actual picture of Jesus in my Sandwich. The reason the lossy compression just reveals the pattern.

    1. Re:Absurd by fuzzyfuzzyfungus · · Score: 4, Funny

      Blizzard actually poisons the kernel entropy pool so cleverly that 'random' behaviors by the computer end up leaking identifiable information. Very sneaky of them...

  20. Re:Just JPG artifacts by Metabolife · · Score: 1

    Yes, strategically place JPG artifacts caused by known compression techniques to create a readable barcode.

  21. Re:Unsubstantiated Rubbish by Anonymous Coward · · Score: 5, Informative

    I'm not surprised the commenter above didn't read the posts following the first post of the source.

    What's important are these posts:

    1.) Disassembly from the Mac OS X client, which shows watermark functions triggered in the screenshot routine.
    http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-general/375573-looking-inside-your-screenshots-2.html#post2489452

    2.) Using a memory modifier, the client is edited to only save the watermark (discarding the actual screenshot) even in JPEG 10 and Lossless formats. Completely disproves compression artefacts theory.
    http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-general/375573-looking-inside-your-screenshots-4.html#post2491687

    3.) Further disassembly shows the following are included in the watermark: Account Name, Realm Info (Serialized, unknown content), Realm IP, Timestamp
    http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-general/375573-looking-inside-your-screenshots-5.html#post2492494

    You really should read some of the posts in between as well, linking Digimarc to Blizzard Activision, patents filed by Digimarc describing precisely this watermarking technique (and possible predecessors), and how the payload (88 bytes) is repeated multiple times exactly to 5808 bytes in order to survive anticipated resizing and further compression.

    Whilst I'm sure they may have good intents (for support maybe? giving benefit of the doubt here), it's these kinds of tricks being pulled by digital companies whilst keeping consumers in the dark that really turns me off.

  22. Backmasked Message? by trevc · · Score: 2, Interesting

    If you look at the JPEGs in a mirror you can see a hidden message "Hello, hunters. Congratulations. You've just discovered the secret message. Please send your answer to Old Pink, care of the funny farm, Chalfont."

  23. Re:Unsubstantiated Rubbish by Impy+the+Impiuos+Imp · · Score: 1

    They claim it's been successfully decoded, but that code rule and examples are not provided. As they give the steps to generate such a picture, it would be otherwise easy enough to verify.

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  24. Questionable by ptresadern · · Score: 1

    Okay, so there's some pattern that shows up against a completely untextured view of the world. How would they recover such a faint watermark from an ordinary view of the world, complete with complex textures in the background? For that sort of thing, you need a copy of the image without the watermark so that you can take the difference between the two, and that doesn't seem to be the case here. And if you wanted to covertly record someone's data, why go to this effort when you could just send it to your server without telling them?

    1. Re:Questionable by Trails · · Score: 1
    2. Re:Questionable by Macthorpe · · Score: 1

      Actually, I'm pretty sure all you'd need is a couple of screenshots with the watermark in. If you know the location of the watermark, you can start building the information out of just one, and two or three would give you enough.

      And if someone posts a screenshot of them playing on a private server, or of them botting on a real server on a different website where their account name doesn't match, how on earth would you link that to an active player without something in the image?

      --
      "It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
    3. Re:Questionable by omnichad · · Score: 1

      The watermark is embedded in the image multiple times. As complex a scene as it is, you can compare the multiple copies and look for the variations between them in common. If you already know where the "pixels" of the encoding is at and the differential that is used, it would be relatively easy to extract. On the other hand, Digimarc has a patent on it so it's relatively complex anyway.

      Remember, you don't have to use an image manipulation tool to read the watermark. If the RGB values are all shifted by 1 to make the encoding, it's really faint, but on the numbers side, it's still a higher/lower value. It's also why the grid uses > 1 pixel squares.

  25. Re:Ask Slashdot by hawguy · · Score: 3, Funny

    Sigh. This kind of story makes me miss ignorant Ask Slashdot questions. I wonder if the OP would mind if I told him how to select the best network cable for use at home.

    I'd like to know - the cheap cables I keep buying on eBay often fail after a few plug/unplug cycles, and the $20 Systimax patch cables seem like overkill.

  26. Why not just email Mike Morhaime by orodos · · Score: 2

    and ask him wtf is going on? MMorhaime@blizzard.com

  27. Re:Money Talks... by Anonymous Coward · · Score: 1

    At some point we are going to start showing a little respect for ourselves as consumers, and stop supporting companies like this, right?

    Wrong, unfortunately.

    That will never happen. Shit, I thought it might when companies started controlling what you're allowed to run on your own device and prohibiting things that were "inconvenient" to their business model, but no... people line up to buy that shit. I thought it might happen when companies installed rootkits on people's computers, but no, people continued to buy things from the same company.

    There IS no level of abuse that people won't accept if the toy is shiny enough.

  28. Re:Unsubstantiated Rubbish by cluedweasel · · Score: 2

    From the frequent "how to I open a screenshot" posts that used to appear in the WoW TS forum, I suspect it was changed to lower support calls.

  29. Re:Why? by RogueyWon · · Score: 4, Informative

    I'm assuming you're just being sarky, but the question sort-of merits a proper answer in case anybody is actually interested. There are a few reasons:

    1) Proof of a particular achievement. Guild websites etc frequently post screenshots of kills of new bosses (or of Arena victories if they're PvP focussed) to demonstrate the level they're playing at as an aid to recruitment. You see less of this these days, since the game added an actual achievement system, along the lines of that seen on Xbox Live or Steam.

    2) Guides and walkthroughs for particular parts of the game (generally boss fights). There's a trend these days towards using youtube videos as a substitute for more traditional text-and-pictures guides. Now, youtube videos can have their place in describing MMO encounters (though I hate, loathe and despise them as a susbstitute for walkthroughs for offline games), but text-and-pictures is still much more convenient for a quick-reference guide and people are still making them.

    3) Requests for technical help. Something along the lines of "hey, guys, I installed addon x, but it doesn't seem to be working properly - here's a screenshot".

    4) Random silliness - either "look, I managed to get my character somewhere that's supposed to be inaccessible" (which you see less of these days) or "look, we used 500 dead gnomes to spell out "bumpoo" in giant letters across the Barrens".

  30. Screw Actizard, contact privacy@blizzard.com by dasacc22 · · Score: 2, Interesting

    Got fed up with all the BS and emailed privacy@blizzard.com to have my account and all my games perma-deleted from their system. Took an untold number of weeks for them to finally follow through on it but I'm now no longer a zard-tard.

    Doesn't look like many slashdotters here care, but if you actually do then claim your info back and stop affiliating with this once decent company.

    1. Re:Screw Actizard, contact privacy@blizzard.com by Khyber · · Score: 1

      I got you beat. I never touched WoW at all. I did EverQuest for about two months and got bored of it. Too easy.

      No challenge (and I mean a real challenge, not once you can solve with an army of friends and brute force) means no go for me.

      --
      Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    2. Re:Screw Actizard, contact privacy@blizzard.com by dasacc22 · · Score: 1

      actually I've never played WoW, just way too goofy for me. I emailed blizzard to have my account deleted during a diablo III fiasco. They nerfed increased-attack-speed gear, which needed to happen, but I was unaware of this until a couple days before hand and spent all my earned gold left over making it to inferno on IAS stuff.

      All that aside, the reason I asked them to delete my account and access to games (starcraft 2, diablo 3) is b/c of how they handled people on their "community" forums. I only use the word community in the sense that it's in the title on the page somewhere. Post after post after post discussing the IAS nerf was deleted, even sane and civil posts where the OP could easily reconcile the difference through discussion.

      That's not a community. That's damage control. I could overlook the crap handling of the nerf but shutting up the player base? not so much.

    3. Re:Screw Actizard, contact privacy@blizzard.com by TriezGamer · · Score: 1

      The biggest problem with the IAS nerf (which, as you said, needed to happen) was the failure to compensate with a subsequent buff to on-hit effects. Especially Life on Hit. Like you, I was built for IAS and had spent tons of gold on IAS equipment, and when the nerf hit, the attack speed wasn't what killed me -- it was the approximately 40% reduction in Life over time from my old attack speed that did me in.

  31. Re:Unsubstantiated Rubbish by Anonymous Coward · · Score: 2, Interesting

    Wait, they added un unencrypted watermark? Why on earth would you NOT encrypt a watermark of this kind?

  32. Re:Unsubstantiated Rubbish by JustOK · · Score: 4, Funny

    Why? What did it say?

    --
    rewriting history since 2109
  33. Re:Unsubstantiated Rubbish by degeneratemonkey · · Score: 1

    More people should read my post's parent.

  34. Makes Sense... by Anonymous Coward · · Score: 1

    If someone ever actually manages to find Mankrik's wife, they need to know who and when so they can send the prize.

  35. Re:Unsubstantiated Rubbish by Mortimer82 · · Score: 4, Informative

    The thread indicates it may have appeared during WotLK alpha builds and only contains:
    - Account name that was used pre-BNET or otherwise a post-BNET numeric account name. (email address is NOT included)
    - IP address of the realm you are connected to, NOT the client IP. (However, this could be used to identify pirate servers).
    - The time the screenshot was taken

    I suspect it was most likely used to catch people leaking imagery of alpha builds which were not allowed to be made public. WotLK was the last WoW expansion Blizzard tried to keep secret for the alpha, but everyone was leaking it despite very clear NDAs having to be agreed to by all who participated. With their next expansion, they didn't bother with an NDA outside of a very small group of initial internal testers.

    I wouldn't call this any kind of breach of privacy as none of the information is personal. An account name can only be matched to a real name by Blizzard and only if you play on their servers.

    Of course privacy zealots will say otherwise, but each to their own.

  36. Re:Unsubstantiated Rubbish by Anonymous Coward · · Score: 1

    What a retard you are. Just read the first few sentences, then click on the link.
    Or do you actually need someone to come and fucking click on the link for you?

  37. Seems well within their rights by GodfatherofSoul · · Score: 1

    The only people who'd need to worry are those exploiting the game who've distorted their toon names thinking that's all they need to do hide their identities.

    --
    I swear to God...I swear to God! That is NOT how you treat your human!
  38. Re:That's no watermark... by jellomizer · · Score: 1

    Online Games, it is the game makers best interests to be hard against cheater. Because if left uncontrolled they will ruin the game for everyone.
    So if you are going to be taking screen shots of your cheating. Might as well get tracked down and banned because of it.

    I remember back in them olden days of Lan Parties. A professor in my college actually hosted a WarCraft II Lan Party. So we were on two teams, One side had the professors 8th grade kid. He found a cheat that worked online. Once we found out both sides of the players (including his own team) in general told him that he cant play anymore. We wanted to play using our own skills if we won we won, if we loss we loss no big deal, not cheat, just to win.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  39. Re:Unsubstantiated Rubbish by hairyfeet · · Score: 2

    Dude have you ever tried to support clueless users? I would remind everyone this is WoW, a game that has everyone from Mr T to soccer moms playing the thing.

    In hindsight was it a good idea to put this data in there without it being encrypted? Probably not but oh Lord I can see why they did it! Personally i wish I had an easy way to have the relevant data on the system just handed to me in a screenshot by the user pushing a single button than playing twenty questions like "What OS are you running?" what's an OS? "What version of Windows is on the machine?" Windows "Windows what?" Huh?

    Now picture that conversation going on for a half an hour or more and you can see why tech support would want a way to have the facts just handed to them, because I can imagine with the volume of support calls with issues like "My Warcraft looks funny!" cutting through the bullshit would seriously cut down on support time.

    --
    ACs don't waste your time replying, your posts are never seen by me.
  40. Re:Unsubstantiated Rubbish by omnichad · · Score: 1

    To prevent additional artifacts when you resize and save the image to JPG again. If you're doing anything to the image before publishing it, you don't want anything wrong at all with it.

  41. Re:Why? by Empiric · · Score: 5, Insightful

    "This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time."

    And, without a password to go with that user ID, none of these are what one should reasonably consider "personal" or "sensitive" in the first place.

    IMHO, in terms of privacy concerns, this is a non-story. Simply presenting it to Slashdot as a neat graphical hack would make more tinfoil-free sense.

    --
    ~ Whence do you come, slayer of men, or where are you going, conqueror of space?
  42. Re:Unsubstantiated Rubbish by Entropius · · Score: 1

    Because depending on how the screenshot looks, png may actually compress better?

  43. Re:Bootstrap by tepples · · Score: 1

    But by the end of the 1990s, Windows 98 had become the standard operating system for personal computers not manufactured by Apple. I imagine that since the release of Windows 98, most major home broadband ISPs have changed their standard practices to assume the presence of IE as a system requirement unless the computer is manufactured by Apple, in which case Safari is assumed.

    Is the game still a loss if IE is demoted to "Firefox and Windows Update Downloader"?

  44. Re:Unsubstantiated Rubbish by Anonymous Coward · · Score: 2, Insightful

    Some years ago I developed my own steganography techniques and those pictures reminded me of that.
    You only need such patterns to encode information in lossy formats due to the compression artifacts. If you use a lossless picture, where every bit of every pixel is perfectly preserved, there are much more efficient ways to hide any information in the picture.
    Most likely the TIFF, PNG and other lossless formats contain the same information or even more, just encoded in a different way.
    So, if you want to avoid leaking your account details, save screenshots in a lossless format and then convert it to a lossy format.

  45. Re:Unsubstantiated Rubbish by Intropy · · Score: 1

    I once saw someone post a "link" to a screenshot on the forums that was something like "c:\documents and settings\username\desktop\World of Warcraft\screenshots\WowScrnShot_2353.tga." He didn't understand why nobody else could see it.

  46. Re:No Confirmation, No Story by Khyber · · Score: 1

    Until we have more than 3-4 people on some forum, where, conveniently, someone released a tool to disable this (which couldn't possibly be designed to steal your WoW account info!), then I call bullshit on the entire thing.

    They released tools to get it alone out of the image and decypher it, so what the fuck else do you want?

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
  47. It's confirmed by equex · · Score: 1

    Uh just read that thread guys, it's confirmed. Already with POC in several languages.

    --
    Can I light a sig ?
  48. Privacy by fa2k · · Score: 1

    Cool discovery.

    This is a minor privacy leak, when someone creates a program to decode the watermarks. It will also be worthless for authenticating screenshots, because when someone can read the watermarks, it doesn't take much to fake one. Blizzard should have encrypted the info with a public key to solve these problems.

    As it stands, it may be useful for others than Blizzard, to identify the origin of a screenshot (in a non-adversarial situation)

    1. Re:Privacy by fa2k · · Score: 1

      Correcting myself,

      Blizzard should have encrypted the info with a public key to solve these problems.

      PKI encryption wouldn't solve the authenticity problem. They would have to pull out the big DRM guns and include some secret (time dependent) string that their servers know, and an authentic WoW client has access to, but which the faker tools couldn't get.

    2. Re:Privacy by fa2k · · Score: 1

      Oh, + some hash of the picture data to check that it's the correct picture.

  49. Re:Unsubstantiated Rubbish by ruiner13 · · Score: 2

    I wouldn't call this any kind of breach of privacy as none of the information is personal. An account name can only be matched to a real name by Blizzard and only if you play on their servers.

    Or you have a dump the hackers made of their client list, which contained screen names as well as other info. They could then use this hacked info to get to any of the other data, especially by someone who posted a screen capture online. Using the leaked DB could tie that screen capture to MUCH more data.

    --

    today is spelling optional day.

  50. Re:Unsubstantiated Rubbish by KingMotley · · Score: 1

    Rarely, unless it's an extremely small screenshot like 16 pixels by 16 pixels, but it'd be hard to play WoW on that.

  51. Re:Unsubstantiated Rubbish by BenJury · · Score: 2

    It would be possible to use that information to get the first part of what is needed to actually log into an account. You've got the player name and realm, with that alone its easier to compromise an account. Although it is of course easier just to take the whole user list from Blizzard....

    --
    Blatant Advert: Android Apps!
  52. Re:Unsubstantiated Rubbish by KingMotley · · Score: 1

    Yes, because the majority of users who take screenshots are reviewing graphic cards.

  53. Re:Unsubstantiated Rubbish by CanHasDIY · · Score: 2

    Also, whoever decided that screenshots should be saved as jpeg by default (assuming it is default) should be fired.

    From a cannon.

    Into the sun.

    --
    An enigma, wrapped in a riddle, shrouded in bacon and cheese
  54. Re:Unsubstantiated Rubbish by GuldKalle · · Score: 1

    Because compression artifacts look terrible on most CGI

    --
    What?
  55. Interesting, but... by ildon · · Score: 5, Informative

    This is pretty interesting, but I think the OP is trying to spread FUD about what the implications of this data are. There is no personally identifying information contained in this watermark. It contains the server IP, server time, and account name. That's it. Now there's a lot of confusion about what "account name" means, so let me explain it for those who don't know.

    About the same time that this watermark apparently showed up (2008, the 3.0 patch associated with the WotLK expansion), Blizzard converted the WoW login system so that it was integrated with their new Battle.net 2.0 login system. At this time, it became necessary to login to WoW using your account's email address instead of your traditional account name. That traditional account name is what's being encoded into the watermark, not your email address login. If you created an account after the Battle.net 2.0 merger, then your "account name" is a unique string that isn't even display to its owner. Anywhere in the account management webpage or login screen that this string would appear, it instead displays "WoW1", "WoW2", etc. (if you have more than one account).
    So there's basically no way to associate this "account name" with your login information, real identity, etc. If you play on a private server, that account name is going to be based on the private server's login system, not Blizzard's login system.

    It's pretty obvious what the real purpose of these watermarks were: to identify users who violated the NDA of their closed betas and ban them from the beta, identify users attempting to sell their account, and possibly to identify the IP address of private servers to assist in attempting to shut them down.

    Further, the probability that these info could be used to help harvest accounts for gold selling or to phish for accounts seems ridiculous. It'd be highly inefficient to spend so much time on a single user when for far less effort you could just spam a million harvested email addresses.

    1. Re:Interesting, but... by ildon · · Score: 1

      Why would it be secret information? What could it possibly be used for? Just because you mistakenly thought it was some kind of secret information doesn't mean it actually was.

  56. Re:Unsubstantiated Rubbish by Mortimer82 · · Score: 4, Interesting

    Their compromised database is indeed a very serious privacy issue. From a security point of view, fortunately they used a good enough password hashing technique that it is largely impractical to extract passwords from the dump.

    From my experience, with almost all people who have their accounts compromised, it was due to phishing or malware. Consequently, account names in screenshots will probably not make any difference to how many people have account security issues.

  57. Re:Unsubstantiated Rubbish by ildon · · Score: 1

    They were originally TGA, and you can still create TGA screenshots. They changed them to JPG by default for user convenience. Most WoW users are not computer savvy enough to convert their own screenshots.

  58. Re:No Confirmation, No Story by FyberOptic · · Score: 1

    No, someone released a tool to "disable" the watermarking, within a very short time of all of this starting.

    To anyone who is neither naive or stupid, the entire situation stinks of a scam.

  59. Re:Unsubstantiated Rubbish by cusco · · Score: 2

    Oof. You have no idea how many times I've seen people blame Exchange/Outlook because a link like that in an email didn't work. "It's all Microsoft's fault!" Well, I guess in a way it is, since MS enabled even idiots to use a computer.

    --
    "Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
  60. Re:the claims are correct if you bother to fact ch by FyberOptic · · Score: 2

    First of all, using a beta client as a basis, which is much more likely to watermark screenshots to begin with to make sure someone isn't passing around info they shouldn't be, is not an indication that the final client does or is doing anything. And I can't reiterate enough the uselessness of a watermark which is nearly impossible to use except in certain circumstances.

    Second, I simply stated the facts. It's a group of 3-4 people who are "discovering" and dispersing all of this information. There is no correlation of this from anyone else of any reputable background. If you knew the definition of FUD, you would quickly realize that it's a group of unknown people shouting out something to fear based on unsubstantiated claims. Whoever posted this topic on Slashdot is completely irresponsible, and if it all turns out to be false, puts themselves at legal liability if Blizzard decided to make a stink about defamation.

    So far, you effectively have a lot of coincidence and suspicions. Don't try to discredit me simply because I point out that fact. If you want to prove me wrong, then prove me wrong, and I will happily admit to being so. Otherwise, it all just appears like people want to hide and discredit my comment to keep the story alive for that much longer.

  61. I am sure.... by hesaigo999ca · · Score: 1

    I am sure that WoW's EULA covers this watermark, as it does the installation of The Warden service which actually tells Blizzard all the apps running on your computer at the time that you play their game. This is extremely intrusive, much more than this watermark.... I therefor suspect the wording used to perpetuate this EULA to encompass the warden would also apply to the watermarks.

    Long Live WoW!

  62. Wow thats cool! Watermarked people! by MindPrison · · Score: 1

    "Activision Blizzard Secretly Watermarking World of Warcraft Users"

    Cool man!

    That explains why I've seen all these people on the streets with that appears to be a photoshopped watermark on them.

    --
    What this world is coming to - is for you and me to decide.
  63. Re:That's no watermark... by englishknnigits · · Score: 3, Funny

    A schooner IS a sail boat stupid head!

  64. Re:the claims are correct if you bother to fact ch by Anonymous Coward · · Score: 1

    Well, as a former WoW player, I decided to do due diligence and check my old screen shots. Any screenshots taken after WotLK due indeed have these watermarks. No they aren't jpeg compresion.

    I am not affiliated with the researchers in any way.

    It is easy to verify that screenshots have some kind of watermark by simply using a sharpen filter.

  65. Re:Why? by SydShamino · · Score: 1

    I believe Blizzard now requires user IDs to be a valid email address.

    --
    It doesn't hurt to be nice.
  66. Re:Why? by SydShamino · · Score: 1

    I stand corrected. It's not the email address; it's the old user name that A) was supposed to be secret, and B) can't be changed.

    I very much would not want it associated with my character's name, as it could tie together different online identities that I have, as a privacy concern, a desire to keep separate.

    --
    It doesn't hurt to be nice.
  67. Re:Unsubstantiated Rubbish by randomencounter · · Score: 1

    Hmm, my browser failed to render your sarcasm tags.

    --
    Forget diamonds, copyright is forever.
  68. Re:the claims are correct if you bother to fact ch by FyberOptic · · Score: 1

    You have no indication that it's not jpg compression. Take any image, from anywhere on the internet, and sharpen it in this manner. Different images will give you different intricate patterns, depending on the encoder used.

    You have no idea if this strange visual effect is really just a compression artifact resulting from light variations due to shaders which WoW employs, causing very subtle differences in the colors in certain equally spaced locations. As long as it visually looks fine, it wouldn't matter if their lighting techniques were a bit of a hack job underneath. Hell, look at the one image they linked on the forum, where a guy with a much larger screen resolution had a different pattern entirely.

    Given that the most vocal detractor of my comment is also an Anonymous Coward, likely in order to retain moderating points, we'll just have to take your word that you're not him or part of the group.

  69. Is User ID secret? by Control-Z · · Score: 1

    IP address of the server, that seems harmless. Time, harmless.

    Is the User ID secret or something that other players could see anyway?

  70. Re:Unsubstantiated Rubbish by makomk · · Score: 1

    (it would be entirely feasible that they remove the watermark at full quality.. because it would be obvious then).

    Not just entirely feasible - someone later in the thread claims to have found the code that disables the watermark on full-quality images and figured out how to patch it out, so that the watermark is present even in uncompressed TGA screenshots.

  71. Re:Unsubstantiated Rubbish by Martin+Blank · · Score: 1

    Blizzard has to deal with cheaters on a scale never before encountered by any game company. Even at the CS cheating peak when it rolled out PunkBuster, Valve never had to deal with as many cheaters in one game. Because of the economic incentives, gold farmers and others have tried with varying degrees of success to get past the protections in the game. Blizzard has made it reasonably clear that it takes certain actions to find cheaters, some of which are fairly rootkit-like in their implementation and ability, and that it does not disclose all of these methods to the end-user.

    Personally, I don't see a problem with this. I find the rootkit behavior a much bigger issue, but I'm willing to live with that in part because I know so many people at Blizzard (and I'm not just talking about a few customer service or QA people) and I trust that they're not going to do evil things with that ability. If they're willing to have that level of inspection on their computers, I don't see why there's so much fuss over the watermarking.

    --
    You can never go home again... but I guess you can shop there.
  72. Re:But why do they want it? by theArtificial · · Score: 1
    What is personally identifiable information in the US?

    Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

    An account name or server IP address does not meet these requirements. The only way for it to be linked up with an individual is with the help of Blizzard. From their privacy page:

    For some activities, we may ask you to create a username and password and/or to provide other, non-personal information such as your age, date of birth, gender, and/or game and platform preferences; and, combine such information with your personal information.

    And what, exactly, is it in the TOS that they might be breaking that warrants this anyway?

    Since the account name feature hasn't been used since the launch of the Real ID service (enabling you to communicate with your friends across all* of the Battle.net games instead of having to add them per character per game). Older titles such as Diablo 3 wouldn't feature this for example. This would apply to Wrath (2008/9ish) NDAs and perhaps situations involving pirate servers.

    --
    Man blir trött av att gå och göra ingenting.
  73. Re:Unsubstantiated Rubbish by suso · · Score: 1

    That's not actually true. jpg images can contain steganographic data in them just fine. For instance, there is a steganographic message in this image using steghide:

    http://www.climagic.org/images/mystery-developer1.jpg

    It could be that steganography didn't survive post processing. I just tested the image above by posting it to Facebook and the stego data didn't make the transfer. Maybe Blizzard developed a more hardy watermarking technique.

  74. Umm yes this is a big privacy issue ... by jest3r · · Score: 1

    Blizzard can easily monitor a users activeity outside of their network by "scraping screenshots". You don't think there's a privacy issue with that?

    Especially since they've kept it under wraps for years and failed to mention it in the privacy policy?!

    Hey by the way every time you post a screen we will track you. And be warned that anyone else who views your screenshot could potentially figure out what your User ID is. And if you upload the screenshot to a forum there is a chance that the forum software might have a vulnerability that allows virtually anyone to connect your WOW UserID to your Email Address on the forum and your IP address at which point they could figure out where you live, who your ISP is and pretty much everything else ...

  75. Re:I've never seen camera serial # in EXIF by QuebecNerd · · Score: 1

    Most decent DSLR do that. My Nikon D800 does it. My Nikons D700, D300, D300S and D7000 did it before and my friend's Canon 5DMKIII and 5DMKII do it too. I see it just by looking at my library in Lightroom.

    I have a smaller Fuji X10 and a Nikon P7000 abd they do not insert their serial number in the EXIF data.

  76. Re:Bootstrap by TheRealGrogan · · Score: 2, Informative

    ftp.mozilla.org uses "round robbin" style mirroring. You connect to that host, and it automatically directs you to an ftp server.

    That's how I do it, anyway:

    230 Login successful.
    Remote system type is UNIX.
    Using binary mode to transfer files.
    ftp> cd /pub/firefox/releases/15.0.1/win32/en-US
    250 Directory successfully changed.
    ftp> ls
    200 PORT command successful. Consider using PASV.
    150 Here comes the directory listing.
    -rw-r--r-- 1 ftp ftp 17790056 Sep 05 18:41 Firefox Setup 15.0.1.exe
    -rw-r--r-- 1 ftp ftp 189 Sep 05 18:41 Firefox Setup 15.0.1.exe.asc
    226 Directory send OK.
    ftp> get "Firefox Setup 15.0.1.exe"
    local: Firefox Setup 15.0.1.exe remote: Firefox Setup 15.0.1.exe
    200 PORT command successful. Consider using PASV.
    150 Opening BINARY mode data connection for Firefox Setup 15.0.1.exe (17790056 bytes).
    226 Transfer complete.
    17790056 bytes received in 4.45 secs (3.9e+03 Kbytes/sec)
    ftp> bye
    221 Goodbye.

  77. Re:the claims are correct if you bother to fact ch by FyberOptic · · Score: 1

    >pedophile

    Okay, troll confirmed, moving on to factually accurate articles.

  78. Re:Unsubstantiated Rubbish by GuldKalle · · Score: 1

    How about png? All modern OSes has png support, right?

    --
    What?
  79. Re:Bootstrap by fisted · · Score: 1, Funny

    son,

    u r the h4x

  80. Re:So when google spiders stuff on the internet by theArtificial · · Score: 1
    This has nothing to do with copyright OR personal information (none was disclosed).

    So when google spiders stuff on the internet with the "default allow" of the internet requirement, this is real bad to copyright content owners.

    A web server responds to requests. The act of putting files in a shared directory on a web server is authorization. Barring any exploits if I ask for information and "you" provide it, how is than anything but stupidity and/or incompetence if you're upset that I have access to it? This doesn't address if the publisher (the entity who put the files online) is authorized to release the information, medical records or something for example.

    TL;DR
    Don't put files in a shared directory you don't want shared.

    --
    Man blir trött av att gå och göra ingenting.
  81. Re:That's no watermark... by Dogtanian · · Score: 2

    So if you are going to be taking screen shots of your cheating. Might as well get tracked down and banned because of it.

    And if you *haven't* actually been cheating, but you've posted pictures of your WoW game for whatever reason over the years anyway, it's okay that identifying information was embedded without your knowledge (possibly to be used against you years later in circumstances like, oh... *this case*) even if you had good reason to want to remain anonymous?

    Actually, I don't care whether the person *was* cheating, it doesn't excuse this sort of thing. If Activision had wanted to do this, they should have been open about it happening, if not the precise mechanics of how it was implemented.

    --
    "Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
  82. Re:Bootstrap by lister+king+of+smeg · · Score: 1, Interesting

    FTP which on windows workstations is handled, by default, by IE and to get a ftp client like filezilla you will probably use a browser, - chicken vs egg

    or you could pop out the old linux disk and have any non IE/safari browser you want with a simple apt-get install, or simply while live booted grab the windows version of Firefox, Chrome, Konquerer, Opera, Seamonkey, elinks, whatever copy it you your windows partition reboot into windows install the new browser set all web related stuff to be handled by the new browser and kiss IE goodbye.*

    *until the next windows update when it resets the default program for hyperlinks to IE again.

    --
    ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
  83. Re:That's no watermark... by jellomizer · · Score: 2

    You confuse explaining a rational for doing sometime, with an endorsement for the practice.

    The gaming company know that cheaters are a problem, then they need to figure out where to draw the line.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  84. Re:But why do they want it? by theArtificial · · Score: 1

    So, like I said, it can't be used to identify THE PERSON who is breeching the ToS.

    Well that's arguable. If you're doing something you're not supposed to be doing (say breaking an NDA) why would you take pictures and distribute them? Unless their machine was compromised (then there are bigger issues at stake) or someone else has access to the machine and the contents within.

    If it isn't personally identifying, they can't tie the image to you.

    It contains information (an account name and a server IP address etc.). When paired with information only Blizzard has, they're able to identify the account. None of the information included in the screenshots is personally identifiable information. It is not a name, date and place of birth, mother's maiden name, social security number, or biometric record. I learned a lot about what personal information and cardholder data is when implementing a payment system. There are very clear definitions of what is and isn't personal information. I don't profess to be an expert, all of what I've stated is available online.

    So why is it there?

    Seems like a great method to identify NDA breakers and identify pirate servers among other things. Perhaps instead of speculating we'll have an official response?

    --
    Man blir trött av att gå och göra ingenting.
  85. Re:That's no watermark... by cgt · · Score: 1

    I clicked the damn sailboat.

  86. Re:But why do they want it? by theArtificial · · Score: 1
    Hate to reply to myself:

    It contains information (an account name and a server IP address etc.). When paired with information only Blizzard has, they're able to identify the account.

    This should read: It contains information (an account name and a server IP address etc.). When paired with information only Blizzard has, they're able to identify the account holder (the one who is responsible and agreed to certain things etc.)

    --
    Man blir trött av att gå och göra ingenting.
  87. Re:That's no watermark... by Dogtanian · · Score: 1

    You confuse explaining a rational for doing sometime, with an endorsement for the practice.

    My apologies- I thought your comment came across a bit like you (personally) were trying to excuse the company with that rationale, rather than merely explaining their position. I'm happy to accept that this was a misinterpretation.

    The gaming company know that cheaters are a problem, then they need to figure out where to draw the line.

    Systematically compromising *everyone's* anonymity without telling them so is (IMHO) quite clearly over that line.

    --
    "Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
  88. Re:Bootstrap by damien_kane · · Score: 2, Informative

    FTP which on windows workstations is handled, by default, by IE and to get a ftp client like filezilla you will probably use a browser, - chicken vs egg

    [Start] => Run => cmd.exe
    >ftp ftp.mozilla.org

    A native CLI FTP app has been included in Windows since (iirc) Win95.

  89. Re:This is dubious at best by griego · · Score: 1

    No, you have to be at 10, the highest quality to avoid watermarking. Setting quality to 9 (and presumably lower, but that's not indicated in the post) enables watermarking. What's important is what the default is, which I haven't seen mentioned anywhere.

  90. Re:Unsubstantiated Rubbish by Algae_94 · · Score: 1

    Of course you don't see the fuss about watermarking. You just said you're fine with Blizzard installing a root kit on your machine! Waht the heck is a measly watermark compared to that?

  91. Re:Unsubstantiated Rubbish by gweihir · · Score: 1

    More people should read anything before commenting. Seems half of the people here post by gut-reaction, not any fact they have observed. The thread linked in the story is conclusive for anybody with half a brain. Of course that assumes that half brain is actually put to use...

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  92. Re:Unsubstantiated Rubbish by fche · · Score: 1

    In my defense -- the first page of the linked comments was heavy on insinuation, light on actual decoding work.

  93. Re:That's no watermark... by Anonymous Coward · · Score: 4, Funny

    My apologies- I thought your comment came across a bit like you (personally) were trying to excuse the company with that rationale, rather than merely explaining their position. I'm happy to accept that this was a misinterpretation.

    What? No, dude, that's not how Internet debates are supposed to work! Dig in your heels, accuse the GP of backpedaling, and burn that strawman to the motherfucking ground!

  94. Re:Unsubstantiated Rubbish by Martin+Blank · · Score: 1

    That's exactly my point, much as you might attempt to trivialize it. I don't have a problem with the watermarking because the rootkit behavior is so much more severe in comparison. I don't see why anyone else would get bent out of shape over the watermarking if they're willing to put up with the rootkit.

    --
    You can never go home again... but I guess you can shop there.
  95. Re:Unsubstantiated Rubbish by KhabaLox · · Score: 1

    My kingdom for a mod point.

    --
    Ceci n'est pas un sig.
  96. Re:Why? by Kalriath · · Score: 1

    You forgot and c) can no longer be used to log in anyway.

    --
    For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
  97. Decode and Exploit? Really? FUD, FUD, FUD by rocket+rancher · · Score: 1

    The reason why the watermark is not mentioned in the TOS is because there is no moral, ethical, or most importantly legal reason to do so, because nothing in the watermark payload is information that can compromise a user's privacy. Blizz started using the watermarks to enforce NDAs with its beta testers, and probably also to locate non-licensed private game servers. Hard to see how you could get your knickers in a twist about this, unless you are a paid shill for one of Blizz's competitors, in which case you've now outed yourself and will be hitting our plonk files in short order.

  98. Re:do they really care about their own ToS? by petteyg359 · · Score: 1

    For future reference, the phrase usually involves a pot, not a pet.

  99. SSDD by Nerdasor · · Score: 1

    I haven't seen anyone mention why this matters. If you get a kill in the game, you used to be required to post a screenshot to prove it in the online forum, although this isn't necessarily de rigueur anymore with the advent of the achievement system. Thus, SSDD, screenshot or it didn't happen. It could still be important though to back up your argument in some type of situation.

  100. Re:Why? by SydShamino · · Score: 1

    Doesn't matter. My account is disabled and I don't care if someone tries to log in. I care that my old user name, which I have entrusted with Blizzard to be tied to my real name and my character name, not be released to the public in a way that ties it to either my real name and/or my character name.

    --
    It doesn't hurt to be nice.
  101. Bad command or file name by tepples · · Score: 1

    what's wrong with wget?

    What's wrong is that "'wget' is not recognized as an internal or external command, operable program or batch file." In order to download, install, and use Wget without ever opening IE, one has to already know on what FTP server the Windows binary of Wget is stored.

    1. Re:Bad command or file name by fisted · · Score: 1

      I should've read grandparent before posting. Turned out parent wasn't mocking on wget, but rather stated it as a suggestion. He implied a windows user could possibly have a geek badge, probably that was what confused me. I.e. i didn't realize that it's a windows context, disregard me.