9 ms·

EA is File Snooping with the Origin Client

191 points by kmfrk 12y ago

johansch 12y ago
As one of the comments there mention, the Origin client is only enumerating the list of recently run applications. The app name in that list is ROT13-"encrypted" by explorer.exe for some odd reason; see: http://blog.didierstevens.com/2006/07/24/rot13-is-used-in-windows-you%E2%80%99re-joking/ http://blog.didierstevens.com/2006/07/24/rot13-is-used-in-wi...
- raverbashing 12y ago
  So, how it behaves with non-ASCII data?
FatalLogic 12y ago
It's quite likely to be cheat-detection scanning filenames, maybe even file contents. Valve had an issue like this recently. (edit: the Valve issue was actually DNS cache scanning) edit: Gabe Newell explained Valve's reasons for scanning DNS cache - http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_tru...
- bellerocky 12y ago
  Yes Steam I think tracks what websites you've been to, but they only do this when they are already suspecting you of cheating, and they only send a hash of the url to see if matches known cheat sites. That's just one of the things I remember. In a perfect world EA would just use steam and give up on Origin. I'm sure they can pay Valve enough to get top billing on steam and it would be less than they spend on their own anti-cheat and origin engineering. They'd also have to cut steam in on sales, but it might still be worth it. It would definitely be worth it to the user as the Origin software is horrible.
  - gabzuka 12y ago
    That's still a bad thing, in my opinion. If I am suspected of cheating then they get access to my browsing history?. How is that acceptable?
    - funkyy 12y ago
      Its not and sooner or later EU will investigate it and those companies will be in huge troubles.
    - JacobEdelman 12y ago
      Well.... As far as spying goes it doesn't sound that horrible. Since they are only checking hashes of your history against a list of common cheating site hashes they really gain minimal information. If their were clear opt-ins and transparency I would definitely be okay with this sort of anti-cheating measure.
    - maddev 12y ago
      Not acceptable at all. Whoever came up with that scheme is a psychopathic criminal for all I care. But then again, once you start using proprietary software you expect there is a gorilla holding your banana and with him comes the jungle. Not even once.
      - mindslight 12y ago
        Well to be fair, you can often receive those gorillas from reputable shippers (torrents), keep them each in their own strong cage (different user account under wine, chroot/namespaces being the next step), and prevent them from getting overexcited by the jungle (iptables).
    - aaronharnly 12y ago
      If you read the linked thread, they are not "accessing your browser history". Rather, as a specific countermeasure against specific cheats, they checked the DNS cache for access to a particular set of phone-home server addresses embedded in some cheats. Not websites, but backend servers (ironically) enforcing DRM for cheat software. Like all such countermeasures, it was effective for a short while, then counter-countered by the cheat. What they sent back to valve was only a "yes they appeared to have accessed cheat backend server X", not a list of all accessed servers or browsing history. I'm not saying I love it, but it's important to be accurate before turning the outrage dial to 11.
Argorak 12y ago
I am constantly surprised by the common reaction that this is covered by the EULA and thus okay. Origin is a software intended for international use, including such countries where this behavior is: a) actively prohibited b) probably illegal, but never came to court c) not covered by the EULA, as EULAs are not binding It might be okay in your country, but not in others.
- JoeAltmaier 12y ago
  Its not 'ok' anywhere. It may be covered by small print EULA obfuscation. But its an underhanded, selfish, dirty thing for them to do. Regardless of whether they can be prosecuted for it. Lets be clear about the difference between legal and ethical.
- funkyy 12y ago
  Well, EA reached newest low. It seems there is hardly anything in the web world not trying to spy on you.
- tokenizerrr 12y ago
  It's the same for many other video games I play. A recent example is the anticheat that got introduced in the Rust beta builds. It takes screenshots of your desktop while you play, so what if I have a private chat or banking info open on my second screen? I don't want to have to be paranoid about that getting screenshotted and uploaded to their servers. Pretty sure this is illegal in my country, but I've contacted them and they do not care.
  - tom9729 12y ago
    PunkBuster (used by many games including Battlefield) does this as well.
    - evilpie 12y ago
      Better yet, server admins could ask for screenshots of players. (I just don't know if it would refuse to take screenshots outside the game)
higherpurpose 12y ago
Basically everything Cory Doctorow has predicted [1] would happen with DRM, and of course what Richard Stallman said many years before that. [1] https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg And now we're going to get OS level DRM that works through all of our browsers, thanks to Netflix, Google, Microsoft, Apple, and last, but not least, the W3C. Terrific.
- kabdib 12y ago
  The issue goes deeper than DRM. Online games like Rust, CS:GO and so forth attract cheaters. Often the intent of a cheater is to ruin the game for everyone else, with patches that give them super-powers (aimbots and wall hacks are pretty common) and the ability to unfairly dominate the other players. Sometimes there are cheaters in official tournaments (a high-profile player in Germany was recently found to be cheating). Scanning a whole system for "DRM cracking tools" seems very, very bad to me. If this is what EA is doing then they had better have a really good explanation. Scanning a the running environment of an online game, under the umbrella of a EULA, seems fine. I'll note that if you object to this, you're free to play on non-protected game servers. Some games are designed to be inherently cheat resistant. One strategy is for the server to never give the game client enough information to be useful for cheating, so even if you've written a totally cheaty client it doesn't do you much good. (Reductio ad absurdum, your client is just a smart video feed with some controller input). Cheaters suck, but they're a fact of life and if your online game doesn't prevent them then you'll be overrun by the scum and honest players will stop playing.
  - Sae5waip 12y ago
    > If this is what EA is doing then they had better have a really good explanation. Or?
    - kabdib 12y ago
      ... or we'll get mad? Again? Good question. "I'm going to pout and not pre-order Battlefield 5 until a week before it comes out. That'll show them!"
sgy 12y ago
This has been a pretty old issue [2011] with EA, which they have tried to deny many times. http://www.gamespot.com/forums/pc-mac-discussion-1000004/ea-is-spying-on-us-through-origin-28825397/ http://www.gamespot.com/forums/pc-mac-discussion-1000004/ea-...
mabbo 12y ago
Snooping my files? Ugh, jackasses. But using ROT13 to hide your activities? That's downright offensive. Who the hell uses a Caesar cipher in the 21st century?
- JoeAltmaier 12y ago
  It worked for quite I while I would guess, months or maybe years they got away with it.
- tkschmidt 12y ago
  Geocachers read ROT13 like plain-text ;)
- bringking 12y ago
  Actually the UserAssist reg key is meant for windows explorer usage tracking and does the ROT13 encoding automatically. You can turn off the encoding or tracking in general. Source-http://www.aldeid.com/wiki/Windows-userassist-keys http://www.aldeid.com/wiki/Windows-userassist-keys
Qualman 12y ago
Is there any proof of this actually being packaged up and sent to EA? It seems to me that this is probably like Blizzard's Warden process, which actively scans for hacks while the client is open. I'll save my outrage until there is proof that they are phoning home with these file scans.
lnanek2 12y ago
Kind of crappy sensationalist article. This is common behavior for game clients which do this sort of thing to detect cheating and bots. E.g. World of Warcraft trying to detect automated gold farming, etc.. I can think of at least four programs that do this sort of thing and it would only be news if it didn't, honestly.
- thefreeman 12y ago
  While I am aware that warden and things like it can scan the memory of processes, I don't think they are granted full access to read everything on your system. I believe their are restrictions like the file must actively be reading / writing your processes memory before you can scan it. There is definitely 0 reason that they should be scanning all of the files on your computer and storing them in some sketchy gibberish registry settings. Who knows what else they are looking at. This is no different then Sony putting rootkits on their audio CD's in order to "prevent piracy". http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...
  - jdong 12y ago
    Warden in fact has capabilities to scan absolutely anything on your computer, but it only does it when new cheat definitions are shipped. (This only happens during mass banwaves which happen every couple of years)
  - byerley 12y ago
    I'm not an OS wizard, but checking the continuity of your working memory sounds pretty expensive and wouldn't necessarily give you the source. I have no idea how you'd look for outside reads unless you had full permissions. Can you expand a little bit if you have some knowledge on the subject?
  - nobotty 12y ago
    Hahaeha, no, warden can and does scan EVERY SINGLE THING on your system. Good luck with fixing that whole "trusting companies that release games I like" thing.
kmfrk 12y ago
This reminds me of when Blizzard did the same thing to us Diablo 2 players almost ten years ago: https://en.wikipedia.org/wiki/Warden_(software) https://en.wikipedia.org/wiki/Warden_(software). They did so very openly, although you clearly couldn't play the game without submitting to the requirements. Of course, this was back when things like having the government surveil our library history was considered a big deal in privacy. Culture's changed quite a bit since.
bringking 12y ago
The UserAssist registry key was meant for tracking Explorer stats. EA is just reading a reg area that windows is already tracking. Also, you can turn it off. Source- http://www.aldeid.com/wiki/Windows-userassist-keys http://www.aldeid.com/wiki/Windows-userassist-keys
onewaystreet 12y ago
From reading newer comments in the Reddit thread it looks like the OP was wrong.
gamesnotblames 12y ago
Wow... people seem to be ok with this - saying this is in the EULA, therefore it's all cool? "Errrm, I couldn't help but notice that the videogames company representative just let himself into your house, fucked your dog up the arse, killed your goldfish and pissed in your coffee" "Oh yes, it's all in the EULA, it's perfectly fair, I am playing the game I bought from them, don't you know!"
st3fan 12y ago
This is a funny story to report for a web site (wccftech) that has 85 tracking widgets on that one page. Thanks for blocking all of those Ghostery!
- Trufa 12y ago
  And Ghostery is owned by an advertising company that tracks you by default.
  - 3rd3 12y ago
    Is Disconnect.me better in that regard?
    - Trufa 12y ago
      Well if you trust that ghostery wont track you if you disable, I think it's pretty good. I have never heard of them until now to be honest so I'm not the guy to ask.
      - bsilvereagle 12y ago
        You can view (and modify) the source code of all Chrome extensions to check that it won't track if the option is disabled: Windows: C:\Users\<user>\AppData\Local\Google\Chrome\User Data\<Name>\Extensions Mac: ~/Library/Application Support/Google/Chrome/Default/Extensions Linux: ~/.config/google-chrome/Default/Extensions/
  - sp332 12y ago
    Ghostrank? It's disabled by default.
    - Trufa 12y ago
      It may have changed recently but for sure until some time ago, an option that clearly said they are tracking you, was activated by default.
Artemis2 12y ago
To compare with Valve's reaction when an user discovered that kind of data collection in VAC, EA representatives don't seem to know a thing, while, for VAC, Valve's CEO Gabe Newell immediately explained publicly the situation and demonstrated that Valve did think their system quite thoroughly for their users' privacy: http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_tru....
beloch 12y ago
The worst thing is that Origin is compulsory for many EA distributed games now. e.g. If you played Mass Effect 3, you had to go online with Origin running every time you played the game to get past the DRM, even if you bought a physical disk to install the game. There were no other options for acquiring the game legally. Besides being intrusive, Origin is spectacularly unfriendly to user mods. The mod community has made some nice texture upgrades for ME3, but to use them with an uncracked ME3 executable requires you to shuffle files around while Origin is running so that it never sees the modified executable (Origin scans and validates executables when you start up a game). I'm not much of a gamer, but Bioware games are a weakness of mine. I look forward to the day when they're no longer infested with EA's spyware.
bastawhiz 12y ago
So wait...these allegations are based entirely on the fact that Windows registry keys exist with ROT13-ed process names? Let's just check the scorecard: - Outbound packet captures showing that Origin is capturing this information? Nope. - Proof that the Origin client is making a targeted effort to steal information about the user? Nope. - Indications that Origin is accessing the processes of Firefox or Chrome in any way beyond getting their names? Nope. - Indications that Origin is potentially capturing any information at all beyond the names of some running processes? Nope. Cheat detection has been named a couple of times, and that's certainly plausible. I'd imagine ROT13 is used to prevent Origin from being spuriously picked up by antivirus software.
- abritishguy 12y ago
  Also the fact that origin has to communicate with web plugins to work (battlelog etc.) seems to have been neglected as a possible explanation.
- Buge 12y ago
  Those registry entries were not created by origin. They were created with rot13 by windows explorer. That screenshot shows origin specifically checking whether the entries exist. So origin has a list of files that it checks if the user has.
  - jcrawfordor 12y ago
    Do we know that it isn't enumerating the whole hive? that seems more likely to me.
    - Buge 12y ago
      I guess I don't really know. But the way it says either "SUCCESS" or "NAME NO..." makes it look like it either found the registry entry or it failed to find the registry entry. The second case would probably only happen if it was looking for specific keys.
z3t4 12y ago
The program is probably hooking into the web browser, because you need to start some Origin games (BF 3) via the browser! Yeh, I'm not joking. A similar thing happened for me with Googleupdate.exe it scanned all my hard drives ... They don't do it any more but I still remove googleupdate.exe every time it magically gets installed on my system.
- cyanbane 12y ago
  That is my guess also, it's actually probably just looking for their specific plug-in. See slide 21 http://www.slideshare.net/DICEStudio/battlelog-building-scalable-web-sites-with-tight-game-integration http://www.slideshare.net/DICEStudio/battlelog-building-scal... That doesn't mean there isn't any leakage they technically can/can't see. No clue if any of that info gets phoned home.
  - z3t4 12y ago
    One of the problems with encrypting almost everything, even pictures of your dog, is that it no longer brings suspicion ... And programs like these can send any information without you knowing about it. Encrypted data is not a security protection, it's a security risk! Because you have no idea what information they send. Probably a lot more then they tell you, because there's no way you can find out.
rmrfrmrf 12y ago
People need to be educated on what software/websites is/are doing by default. I would assume that most people familiar with today's tracking boilerplate would know better than to install Origin in an unsandboxed environment in the first place. Unfortunately, this doesn't seem to be the case.
libraryatnight 12y ago
I didn't use Origin much, but it's uninstalled and gone for good, now.
cookiecaper 12y ago
We need a new hardware architecture to elegantly enable containment and sandboxing. Every application should have its own isolated virtual environment and OS for execution. Like Qubes, but with every environment capable of utilizing the full hardware simultaneously (that is, managed by the hypervisor). Direct access to the video hardware is the main thing that holds back the virtualization of gaming or other graphics-heavy activities. We desperately need a solution to that.
- jlawer 12y ago
  This is kind of already available for VDI if your willing to accept the overhead of multiple OS instance. Nvidia GRID and similar GPU / Compute boards can handle multiple simultaneous users. The problem is COST. These are designed for VDI servers supporting 25/50/100 desktop users not 1 gamer and are priced as enterprise equipment.
A_COMPUTER 12y ago
Even if you think this sort of thing is OK because of EULAs or explicit consumer buy-in (I know multiple people that are OK with it because they are bigtime gamers and appreciate its reduction of cheating,) this is one more NSA attack vector. How's the security on this backdoor? Does EA ever service NSLs?
szatkus 12y ago
wccftech.com on Hacker News? My world just collapsed. It's most unreliable tech website in the world.
greggman 12y ago
This is what scares me about Steam at little. My understanding (though not sure) is this is what Apple's OSX store and Microsoft's windows app store are trying to solve. Basically sandbox native apps so you can install them and not worry they can do stuff like this. I'm not saying they succeed at that. I have no idea how secure their sandboxes are and what limits they place. But, that is arguably the intent (or at least one of the intents). Steam on the other hand has no such intent AFAIK. Of course in all those cases, including Steam, there is the threat to the publisher they'll be banned from the store if they do this kind of thing. I don't know if there is any example of Steam removing an app because of "unethical behavior". I would guess if it was an indie they'd ban first, question later whereas if it was a big publisher like EA they'd probably talk first, try to get them to address the issue. I'd be curious to know if Steam Box makes any effort in this direction. I was similarly worried about Boxee apps (the PC/OSX/Linux version), XBMC scripts. etc...

191 points by kmfrk 12y ago

As one of the comments there mention, the Origin client is only enumerating the list of recently run applications. The app name in that list is ROT13-"encrypted" by explorer.exe for some odd reason; see: http://blog.didierstevens.com/2006/07/24/rot13-is-used-in-windows-you%E2%80%99re-joking/ http://blog.didierstevens.com/2006/07/24/rot13-is-used-in-wi...

raverbashing 12y ago
So, how it behaves with non-ASCII data?

FatalLogic 12y ago

It's quite likely to be cheat-detection scanning filenames, maybe even file contents. Valve had an issue like this recently. (edit: the Valve issue was actually DNS cache scanning) edit: Gabe Newell explained Valve's reasons for scanning DNS cache - http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_tru...

bellerocky 12y ago
Yes Steam I think tracks what websites you've been to, but they only do this when they are already suspecting you of cheating, and they only send a hash of the url to see if matches known cheat sites. That's just one of the things I remember. In a perfect world EA would just use steam and give up on Origin. I'm sure they can pay Valve enough to get top billing on steam and it would be less than they spend on their own anti-cheat and origin engineering. They'd also have to cut steam in on sales, but it might still be worth it. It would definitely be worth it to the user as the Origin software is horrible.
- gabzuka 12y ago
  That's still a bad thing, in my opinion. If I am suspected of cheating then they get access to my browsing history?. How is that acceptable?
  - funkyy 12y ago
    Its not and sooner or later EU will investigate it and those companies will be in huge troubles.
  - JacobEdelman 12y ago
    Well.... As far as spying goes it doesn't sound that horrible. Since they are only checking hashes of your history against a list of common cheating site hashes they really gain minimal information. If their were clear opt-ins and transparency I would definitely be okay with this sort of anti-cheating measure.
  - maddev 12y ago
    Not acceptable at all. Whoever came up with that scheme is a psychopathic criminal for all I care. But then again, once you start using proprietary software you expect there is a gorilla holding your banana and with him comes the jungle. Not even once.
    - mindslight 12y ago
      Well to be fair, you can often receive those gorillas from reputable shippers (torrents), keep them each in their own strong cage (different user account under wine, chroot/namespaces being the next step), and prevent them from getting overexcited by the jungle (iptables).
  - aaronharnly 12y ago
    If you read the linked thread, they are not "accessing your browser history". Rather, as a specific countermeasure against specific cheats, they checked the DNS cache for access to a particular set of phone-home server addresses embedded in some cheats. Not websites, but backend servers (ironically) enforcing DRM for cheat software. Like all such countermeasures, it was effective for a short while, then counter-countered by the cheat. What they sent back to valve was only a "yes they appeared to have accessed cheat backend server X", not a list of all accessed servers or browsing history. I'm not saying I love it, but it's important to be accurate before turning the outrage dial to 11.

Argorak 12y ago

I am constantly surprised by the common reaction that this is covered by the EULA and thus okay. Origin is a software intended for international use, including such countries where this behavior is: a) actively prohibited b) probably illegal, but never came to court c) not covered by the EULA, as EULAs are not binding It might be okay in your country, but not in others.

JoeAltmaier 12y ago
Its not 'ok' anywhere. It may be covered by small print EULA obfuscation. But its an underhanded, selfish, dirty thing for them to do. Regardless of whether they can be prosecuted for it. Lets be clear about the difference between legal and ethical.
funkyy 12y ago
Well, EA reached newest low. It seems there is hardly anything in the web world not trying to spy on you.
tokenizerrr 12y ago
It's the same for many other video games I play. A recent example is the anticheat that got introduced in the Rust beta builds. It takes screenshots of your desktop while you play, so what if I have a private chat or banking info open on my second screen? I don't want to have to be paranoid about that getting screenshotted and uploaded to their servers. Pretty sure this is illegal in my country, but I've contacted them and they do not care.
- tom9729 12y ago
  PunkBuster (used by many games including Battlefield) does this as well.
  - evilpie 12y ago
    Better yet, server admins could ask for screenshots of players. (I just don't know if it would refuse to take screenshots outside the game)

higherpurpose 12y ago

Basically everything Cory Doctorow has predicted [1] would happen with DRM, and of course what Richard Stallman said many years before that. [1] https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg And now we're going to get OS level DRM that works through all of our browsers, thanks to Netflix, Google, Microsoft, Apple, and last, but not least, the W3C. Terrific.

kabdib 12y ago
The issue goes deeper than DRM. Online games like Rust, CS:GO and so forth attract cheaters. Often the intent of a cheater is to ruin the game for everyone else, with patches that give them super-powers (aimbots and wall hacks are pretty common) and the ability to unfairly dominate the other players. Sometimes there are cheaters in official tournaments (a high-profile player in Germany was recently found to be cheating). Scanning a whole system for "DRM cracking tools" seems very, very bad to me. If this is what EA is doing then they had better have a really good explanation. Scanning a the running environment of an online game, under the umbrella of a EULA, seems fine. I'll note that if you object to this, you're free to play on non-protected game servers. Some games are designed to be inherently cheat resistant. One strategy is for the server to never give the game client enough information to be useful for cheating, so even if you've written a totally cheaty client it doesn't do you much good. (Reductio ad absurdum, your client is just a smart video feed with some controller input). Cheaters suck, but they're a fact of life and if your online game doesn't prevent them then you'll be overrun by the scum and honest players will stop playing.
- Sae5waip 12y ago
  > If this is what EA is doing then they had better have a really good explanation. Or?
  - kabdib 12y ago
    ... or we'll get mad? Again? Good question. "I'm going to pout and not pre-order Battlefield 5 until a week before it comes out. That'll show them!"

sgy 12y ago

This has been a pretty old issue [2011] with EA, which they have tried to deny many times. http://www.gamespot.com/forums/pc-mac-discussion-1000004/ea-is-spying-on-us-through-origin-28825397/ http://www.gamespot.com/forums/pc-mac-discussion-1000004/ea-...

mabbo 12y ago

Snooping my files? Ugh, jackasses. But using ROT13 to hide your activities? That's downright offensive. Who the hell uses a Caesar cipher in the 21st century?

JoeAltmaier 12y ago
It worked for quite I while I would guess, months or maybe years they got away with it.
tkschmidt 12y ago
Geocachers read ROT13 like plain-text ;)
bringking 12y ago
Actually the UserAssist reg key is meant for windows explorer usage tracking and does the ROT13 encoding automatically. You can turn off the encoding or tracking in general. Source-http://www.aldeid.com/wiki/Windows-userassist-keys http://www.aldeid.com/wiki/Windows-userassist-keys

Qualman 12y ago

Is there any proof of this actually being packaged up and sent to EA? It seems to me that this is probably like Blizzard's Warden process, which actively scans for hacks while the client is open. I'll save my outrage until there is proof that they are phoning home with these file scans.

lnanek2 12y ago

Kind of crappy sensationalist article. This is common behavior for game clients which do this sort of thing to detect cheating and bots. E.g. World of Warcraft trying to detect automated gold farming, etc.. I can think of at least four programs that do this sort of thing and it would only be news if it didn't, honestly.

thefreeman 12y ago
While I am aware that warden and things like it can scan the memory of processes, I don't think they are granted full access to read everything on your system. I believe their are restrictions like the file must actively be reading / writing your processes memory before you can scan it. There is definitely 0 reason that they should be scanning all of the files on your computer and storing them in some sketchy gibberish registry settings. Who knows what else they are looking at. This is no different then Sony putting rootkits on their audio CD's in order to "prevent piracy". http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...
- jdong 12y ago
  Warden in fact has capabilities to scan absolutely anything on your computer, but it only does it when new cheat definitions are shipped. (This only happens during mass banwaves which happen every couple of years)
- byerley 12y ago
  I'm not an OS wizard, but checking the continuity of your working memory sounds pretty expensive and wouldn't necessarily give you the source. I have no idea how you'd look for outside reads unless you had full permissions. Can you expand a little bit if you have some knowledge on the subject?
- nobotty 12y ago
  Hahaeha, no, warden can and does scan EVERY SINGLE THING on your system. Good luck with fixing that whole "trusting companies that release games I like" thing.

kmfrk 12y ago

This reminds me of when Blizzard did the same thing to us Diablo 2 players almost ten years ago: https://en.wikipedia.org/wiki/Warden_(software) https://en.wikipedia.org/wiki/Warden_(software). They did so very openly, although you clearly couldn't play the game without submitting to the requirements. Of course, this was back when things like having the government surveil our library history was considered a big deal in privacy. Culture's changed quite a bit since.

bringking 12y ago

The UserAssist registry key was meant for tracking Explorer stats. EA is just reading a reg area that windows is already tracking. Also, you can turn it off. Source- http://www.aldeid.com/wiki/Windows-userassist-keys http://www.aldeid.com/wiki/Windows-userassist-keys

onewaystreet 12y ago

From reading newer comments in the Reddit thread it looks like the OP was wrong.

gamesnotblames 12y ago

Wow... people seem to be ok with this - saying this is in the EULA, therefore it's all cool? "Errrm, I couldn't help but notice that the videogames company representative just let himself into your house, fucked your dog up the arse, killed your goldfish and pissed in your coffee" "Oh yes, it's all in the EULA, it's perfectly fair, I am playing the game I bought from them, don't you know!"

st3fan 12y ago

This is a funny story to report for a web site (wccftech) that has 85 tracking widgets on that one page. Thanks for blocking all of those Ghostery!

Trufa 12y ago
And Ghostery is owned by an advertising company that tracks you by default.
- 3rd3 12y ago
  Is Disconnect.me better in that regard?
  - Trufa 12y ago
    Well if you trust that ghostery wont track you if you disable, I think it's pretty good. I have never heard of them until now to be honest so I'm not the guy to ask.
    - bsilvereagle 12y ago
      You can view (and modify) the source code of all Chrome extensions to check that it won't track if the option is disabled: Windows: C:\Users\<user>\AppData\Local\Google\Chrome\User Data\<Name>\Extensions Mac: ~/Library/Application Support/Google/Chrome/Default/Extensions Linux: ~/.config/google-chrome/Default/Extensions/
- sp332 12y ago
  Ghostrank? It's disabled by default.
  - Trufa 12y ago
    It may have changed recently but for sure until some time ago, an option that clearly said they are tracking you, was activated by default.

Artemis2 12y ago

To compare with Valve's reaction when an user discovered that kind of data collection in VAC, EA representatives don't seem to know a thing, while, for VAC, Valve's CEO Gabe Newell immediately explained publicly the situation and demonstrated that Valve did think their system quite thoroughly for their users' privacy: http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ http://reddit.com/r/gaming/comments/1y70ej/valve_vac_and_tru....

beloch 12y ago

The worst thing is that Origin is compulsory for many EA distributed games now. e.g. If you played Mass Effect 3, you had to go online with Origin running every time you played the game to get past the DRM, even if you bought a physical disk to install the game. There were no other options for acquiring the game legally. Besides being intrusive, Origin is spectacularly unfriendly to user mods. The mod community has made some nice texture upgrades for ME3, but to use them with an uncracked ME3 executable requires you to shuffle files around while Origin is running so that it never sees the modified executable (Origin scans and validates executables when you start up a game). I'm not much of a gamer, but Bioware games are a weakness of mine. I look forward to the day when they're no longer infested with EA's spyware.

bastawhiz 12y ago

So wait...these allegations are based entirely on the fact that Windows registry keys exist with ROT13-ed process names? Let's just check the scorecard: - Outbound packet captures showing that Origin is capturing this information? Nope. - Proof that the Origin client is making a targeted effort to steal information about the user? Nope. - Indications that Origin is accessing the processes of Firefox or Chrome in any way beyond getting their names? Nope. - Indications that Origin is potentially capturing any information at all beyond the names of some running processes? Nope. Cheat detection has been named a couple of times, and that's certainly plausible. I'd imagine ROT13 is used to prevent Origin from being spuriously picked up by antivirus software.

abritishguy 12y ago
Also the fact that origin has to communicate with web plugins to work (battlelog etc.) seems to have been neglected as a possible explanation.
Buge 12y ago
Those registry entries were not created by origin. They were created with rot13 by windows explorer. That screenshot shows origin specifically checking whether the entries exist. So origin has a list of files that it checks if the user has.
- jcrawfordor 12y ago
  Do we know that it isn't enumerating the whole hive? that seems more likely to me.
  - Buge 12y ago
    I guess I don't really know. But the way it says either "SUCCESS" or "NAME NO..." makes it look like it either found the registry entry or it failed to find the registry entry. The second case would probably only happen if it was looking for specific keys.

z3t4 12y ago

The program is probably hooking into the web browser, because you need to start some Origin games (BF 3) via the browser! Yeh, I'm not joking. A similar thing happened for me with Googleupdate.exe it scanned all my hard drives ... They don't do it any more but I still remove googleupdate.exe every time it magically gets installed on my system.

cyanbane 12y ago
That is my guess also, it's actually probably just looking for their specific plug-in. See slide 21 http://www.slideshare.net/DICEStudio/battlelog-building-scalable-web-sites-with-tight-game-integration http://www.slideshare.net/DICEStudio/battlelog-building-scal... That doesn't mean there isn't any leakage they technically can/can't see. No clue if any of that info gets phoned home.
- z3t4 12y ago
  One of the problems with encrypting almost everything, even pictures of your dog, is that it no longer brings suspicion ... And programs like these can send any information without you knowing about it. Encrypted data is not a security protection, it's a security risk! Because you have no idea what information they send. Probably a lot more then they tell you, because there's no way you can find out.

rmrfrmrf 12y ago

People need to be educated on what software/websites is/are doing by default. I would assume that most people familiar with today's tracking boilerplate would know better than to install Origin in an unsandboxed environment in the first place. Unfortunately, this doesn't seem to be the case.

libraryatnight 12y ago

I didn't use Origin much, but it's uninstalled and gone for good, now.

cookiecaper 12y ago

We need a new hardware architecture to elegantly enable containment and sandboxing. Every application should have its own isolated virtual environment and OS for execution. Like Qubes, but with every environment capable of utilizing the full hardware simultaneously (that is, managed by the hypervisor). Direct access to the video hardware is the main thing that holds back the virtualization of gaming or other graphics-heavy activities. We desperately need a solution to that.

jlawer 12y ago
This is kind of already available for VDI if your willing to accept the overhead of multiple OS instance. Nvidia GRID and similar GPU / Compute boards can handle multiple simultaneous users. The problem is COST. These are designed for VDI servers supporting 25/50/100 desktop users not 1 gamer and are priced as enterprise equipment.

A_COMPUTER 12y ago

Even if you think this sort of thing is OK because of EULAs or explicit consumer buy-in (I know multiple people that are OK with it because they are bigtime gamers and appreciate its reduction of cheating,) this is one more NSA attack vector. How's the security on this backdoor? Does EA ever service NSLs?

szatkus 12y ago

wccftech.com on Hacker News? My world just collapsed. It's most unreliable tech website in the world.

greggman 12y ago

This is what scares me about Steam at little. My understanding (though not sure) is this is what Apple's OSX store and Microsoft's windows app store are trying to solve. Basically sandbox native apps so you can install them and not worry they can do stuff like this. I'm not saying they succeed at that. I have no idea how secure their sandboxes are and what limits they place. But, that is arguably the intent (or at least one of the intents). Steam on the other hand has no such intent AFAIK. Of course in all those cases, including Steam, there is the threat to the publisher they'll be banned from the store if they do this kind of thing. I don't know if there is any example of Steam removing an app because of "unethical behavior". I would guess if it was an indie they'd ban first, question later whereas if it was a big publisher like EA they'd probably talk first, try to get them to address the issue. I'd be curious to know if Steam Box makes any effort in this direction. I was similarly worried about Boxee apps (the PC/OSX/Linux version), XBMC scripts. etc...