C4A data privacy

[Ziz]

Hi,

Since Snowden's disclosures about the NSA and GCHQ collecting internet (meta)data world wide, but also since earlier known open attempts of different states to get more metadata for "crime fighting" (like the data preservation (Vorratsdatenspeicherung) in europe), people, especially the IT affine people, critize these attempts because of privacy and personal freedom reasons.

Furthermore they critize google or facebook for collecting masses of (meta)data or Anroid and iOS apps for having more rights than they need and sending userdata to obscure unknown servers in the internet.

So I wondered, whether it is really okay for C4A applications to commit scores, especially without telling the user. If a game commits every score, you produce metadata, when and how often you play the game and data how good you are or how hard is the game.

However I never accpeted somewhere for any applications, that it is allowed to send these (meta)data.

So this open discussion:

Is this really okay? If not, how would it be okay?

Is this legal with US or EU rights?

Does it matter for this small and mostly trustworthy community?

Are other problems maybe even bigger like no code check in the repository (malware insection is QUITE easy) or no checks for invalid scores at c4a?

Tell me your opinion!

greetings Ziz

PS: I don't want to attact any developer of a c4a game. As you may know, I made some, too.

 

[sebt3]

the problem with online privacy is when your nick is directly linked to your real life real name.

(Just like someone did here (I was pissed....) http://pandorawiki.org/Team without anyone consent...)

As long as your online identity and your real one aren't officially connected you're fine.

C4A dont want your real name but your online identity and does nothing to help ling the 2. I'm fine with that myself.

 

[skeezix]

FWIW, since day zero, the frontend has had a warning on the front:

<i>Security disclosure: In case it is not obvious, this application talks to a remote server to push and pull scoring (and thats it.)</i>

 

I suppose it is implied my server knows about time of day, and source-IP (in logs), but it doesn't record any of that stuff. The source code is all up in my github (but its a travesty, since it was a rush job I added that note since although its obvious (online scoring system is online), I wanted it to be out in the open. None of the conspiracy of having it do it behind the scenes .. its up front about whats going on. This probably also covers any legal grounds (though I'd be curious to know for sure.)

 

https://github.com/skeezix/compo4all

 

The intention was its obvious that when you create a c4a profile, you know its sending scores up; it presumed obvious that c4a supporting games do it, but certainly they could do it behind the scenes. Seems obvious, you create c4a profile, you accept you want your scores up.. but it does bring up interesting interface question.. should the interface be clear that a packet has been sent up to remote server.. a little progress bar swooshy graphic sort of thing.

FWIW, the c4a stuff is all done using the hash-key, which is more or less private; unless you share it, no one knows a thing, even if they intercept traffic into my server (say); if someone gets my server, thats a different story. (Always assume the NSA can do it

 

... I forget if there is a 'delete profile' option in c4a-manager; if not, probably should be.. 'delete me and my history'. Certainly I'd do it by request.

 

Of concern since day 0 .. its a lame protocol, with no protection, due to pretty much necessity; its all easily faked and cheated and since its plaintext http (not even https), easily intercepted. I just assume no one cares, since its 'just game scores'. But interesting question is .. will someone, someday, care?

 

To grow up the protocol, make it all secure, is a Tall Order and Big Inconvenience for everyone (I think.) ie: signing of apps before each version released, centralize authorities, all that bullshit; want to avoid that

 

jeff

 

(edit: I know this is not accusatory posting at all; just bored and curious. Its an interesting question, but I merely propose counter ideas so people don't get all stirred up and call us all Evil) (they will anyway) (Evil is fun) (for awhile, I had my kidws trained to call "Elevators" "Evilators", but that got dry after awhile)

 

[rygD]

Is this really okay? If not, how would it be okay?

Is this legal with US or EU rights?

Does it matter for this small and mostly trustworthy community?

Are other problems maybe even bigger like no code check in the repository (malware insection is QUITE easy) or no checks for invalid scores at c4a?

1.  Yes and no, depends on the opinion of each person.  I am one of the people often called "paranoid", yet I have no problem with it because I currently splatter information about my internet activity all over the world, including ways I do have problems with (using my legal name and other information to register for things, or others doing it for me without my direct consent).  Also because:

2.  I am pretty sure downloading software that explicitly states in both the software and documentation that it will transmit certain information, then filling out how you will be identified, then running the software AND getting online and having the software do what you set it up for is legal.  But you do bring up a good point, I have seen people legally fight stupid stuff they have done to themselves, and laws that make very little sense.

3.  YES!  This information is publicly accessible.  Beyond that, how much do you trust people you really don't know?  If you do feel you know them well enough, how much do you trust people in general?  Many will share stuff about you to cover their own ass should certain things happen, and if they are blackmailed.  Also, some in the community are lurkers who may have logs and other records of what you have said and done, but that you have never interacted directly with.  There is much more.  Trust No One.

4.  Yes, but I will leave that to others. 

edit:

(edit: I know this is not accusatory posting at all; just bored and curious. Its an interesting question, but I merely propose counter ideas so people don't get all stirred up and call us all Evil) (they will anyway) (Evil is fun) (for awhile, I had my kidws trained to call "Elevators" "Evilators", but that got dry after awhile)

EvilDragon kinda runs the show for Pandora (and Pyra), so really none of us can be expected to be any better...

 

[levi]

the problem with online privacy is when your nick is directly linked to your real life real name.


(Just like someone did here (I was pissed....) http://pandorawiki.org/Team without anyone consent...)


As long as your online identity and your real one aren't officially connected you're fine.


C4A dont want your real name but your online identity and does nothing to help ling the 2. I'm fine with that myself.

Most people are pretty lazy about keeping their online identity distinct though, thanks to work by google, yahoo and others. My favourite vector tends to be any time anyone links to one of their flickr photos, which shows me their adobe name, which nine times out of ten is a real name.

That said, I don't see what anyone can do with the data that c4a records. All it can prove is you've played a game a number of times. I suppose it can find out when you were gaming as well, either month by month using the website, or at a greater frequency if it keeps wgetting the server. Not anything I'm greatly fussed about though.