Spyware or Not?

A fan of the popular multiplayer online game The World of Warcraft described recently what its module does, unknown to the game users. In short, it scans all open windows on the computer, makes hashes of their titles, and sends the hashes to the game maker Blizzard. (According to Blizzard, the hashes are checked there against a list of hashes of popular game cheats. If a match is found (that is, the gamer is cheating), his/her program is terminated, together with the contract that allows access to the Blizzard servers.) The author of the article found this to be a violation of his privacy.

People close to Blizzard replied to this article, stating that they do not violate anyone’s privacy, and that their clients, by agreeing to the game EULA, give them the right to do this. (The two articles, and the comments to them in the forums they are posted in, give in-depth coverage of the details.) The discussion continues.

I couldn’t agree more that cheating should not be tolerated. In games like WOW, cheaters gain unfair advantage against users who have invested into their achievements either a lot of time and work, or a decent sum of money. (For example, by cheating you can gain there stronger weapons that otherwise you would have to pay for.) I congratulate Blizzard for taking the initiative aganst the cheaters. However, this should not be made at the price of violating the privacy of the people.

Are any privacy actually violated, in this case? Yes, I believe.

While you play, the “anti-cheating” mod sends to Blizzard an unique hash of the title of every window you may open. Blizzard could use these hashes to identify all or almost all programs you use, exactly the same way they use them to identify if you use cheating programs. It is not hard to make a list of hashes for the window titles of the most popular, say, 10 000 programs for Windows. By this, Blizzard will be able to identify over 99% of the software you run on your PC, when you run it, when you close it, etc.

Things don’t stop here. Blizzard will be able to tell whether you edited a document with a certain name, and what word processor you used. (My practice shows that the most popular 10 000 document names match well over 99% of all the documents typically found on a home PC.) They will be able to tell whether you watch certain movie on your PC, whether you listen certain music, etc. (The list of the movie names is long, but not endless; the same is with the music and song names.) They will be able to say whether you visit certain site and / or Web page. (A list of, say, 10 000 appropriately chosen sites and pages that can be checked for would be priceless to a lot of different people.). Searching for matching hashes by appropriate algorithms would allow them to identify all this in real time, and an ordinary 200 GB harddisk is easily able to provide space enough for 1000 different lists, with 1 000 000 hashes in each of them, and to still be almost empty.

I personally don’t believe that Blizzard does this, or that it wants to. But, as said above, these abilities will grantedly attract the attention of a lot of people, and once this is understood, Blizzard will face a pressure to secretly provide this service. Given that certain influential three-letter organizations will certainly be among these who want it, I don’t think it will take too long before Blizzard gets forced to start playing this game. Once you open the Pandora’s box, some things get free, even if you had good intentions.

What is the worse, this practice creates a precedent. A lot of organizations may follow, pretending that they do nothing different. Some of them will probably be less reluctant to spy over its users than Blizzard. Some will probably enter this playground exactly with this kind of play in mind. And users will accept them, lured into a false sense of safety.

Actually, this could be happening even now. Even if Blizzard will bankrupt rather than spy for someone (including themselves), and even if noone dares to try the same, the users data already are not safe. Anyone with access, legal or illegal, to a box en route, may have all these hashes, and use them for the goals a criminal may like. And, in a world infested with crackers and spyware, this is far more probable than not.

So, I am sorry to say this, but this tool of Blizzard should be classified as spyware. Directly or not, it does infringe the users’ privacy.

Now, some ideas on what may be done to change this.

To start with, the sending policy may be reversed. Instead of sending the hashes to a central server, the anti-cheating module may retrieve a hashlist from there, and compare it locally. This way, no user data will leave the user’s PC, and the privacy issue will disappear.

Another approach is to store all characteristics of a player server-side rather than client-side, like WOW does now. This will require some coding, but the system will become far less vulnerable to a lot of other attacks, too.

More ways to avoid the privacy problem exist. The discussion in the forums provide some great insight. It is completely possible to change the model, and avoid this problem. Of course, if Blizzard are not already bound to the current model, for some reason.

I’d hate to ask what exactly.