Privacy in gaming

[mietze]

Part of that discussion by necessity should include not only ideals but common (and uncommon) things that are likely to happen to fall short.

And IMO permission for people to also have varying degrees of risk adversity be able to discuss their concerns without it turning into either "whaddya expect, it's the wild west and anything goes" or "if you participate in any game at all that isn't secured and there's the possibility of people chatting about other than game stuff then you are stupid." There's a huge middle ground there, and I personally think there is a lot of room for different standards on different games too. Both in what they promise "wont happen" and in how they respond when things do happen.

[Ghost]

I think there could be some truth that the format is obsolete and having trouble adapting to modern security and privacy models. @faraday is right that upgrading standup of a game would be more difficult with SSH, and probably slightly more expensive.

What I'm seeing, though, is that privacy from a computer vulnerability standpoint (regardless of other risks) isnt as critical to MU players as the immediate privacy factor of staff snooping.

Forgive me if this seems presumptuous, but I kind of feel like the typical MU'er KNOWS there's privacy problems going in, but still does it anyway, and it's just constantly taken on good faith that their "private stuff" on games is private, even when there's a bazillion ways (right on down to staff backtracing IPs, email addresses, watching page streams, setting invisible and teleporting into scene room) that it could EASILY be spied on.

What is a little perplexing to me is that there are things on these games considered important enough to be kept secret, at least outside of "plot-type secrets only staff and players should know". Yet the concern still seems less for other players learning their IC secrets than it does being watched by unknown persons.

[mietze]

@Ghost some of it may just be cultural/familiarity, at least for older gamers who played on places where that was often used to humiliate/cheat? I think most perceived violating behavior that I have heard about in the last say 6 or 7 years or so has largely revolved around multi-platform spying/whisper campaigns, ect. Not so much dark staffers in rooms or pulling histories.

I would be really curious to see what people who have only been doing this for the last 3 or 4 years think of when it comes to privacy on a game. My guess is that it will be all over the map but more about harassment than cheating or trying to catch people breaking "rules". These days I think it is more expected than not that every scene will be logged by at least one participant--i do not remember that expectation (and in fact people would freak out at the thought) of someone logging all interactions each time (which catches all private/ooc communication too).

It is a pretty interesting thought.

[Arkandel]

@Auspice said in Privacy in gaming:

Just like what I am posting, right now, is going to an unsecured site.

Would I be furious if Arkandel used it for nefarious purposes? Yes, of course I would. But I'm not waltzing in expecting the forum equivalent of Fort Knox and that is what I think people need to stop doing.

Hey now, you are posting stuff to a regularly updated platform running on a regularly updated Linux system hosted by a reputable company, and you're doing so over an encrypted https connection. While it's true MSB is no Fort Knox, we're not exactly trivial to breach either.

Conversely there's only one way for me to provide your data to a third party and that's if the police produce a warrant demanding something specific. In Canada laws are fairly sane in that regard so the chance is low. No other requests are going to be honored.

Also although I obviously can't prove it and you shouldn't take my word for it, I'd never pry into the database for your people's disgusting private conversations with each other. I don't want to have to bleach my eyeballs afterwards.

[Auspice]

@Arkandel said in Privacy in gaming:

@Auspice said in Privacy in gaming:

Just like what I am posting, right now, is going to an unsecured site.

Would I be furious if Arkandel used it for nefarious purposes? Yes, of course I would. But I'm not waltzing in expecting the forum equivalent of Fort Knox and that is what I think people need to stop doing.

Hey now, you are posting stuff to a regularly updated platform running on a regularly updated Linux system hosted by a reputable company, and you're doing so over an encrypted https connection. While it's true MSB is no Fort Knox, we're not exactly trivial to breach either.

Conversely there's only one way for me to provide your data and that's if the police produce a warrant demanding something specific. In Canada laws are fairly sane in that regard so the chance is low. No other requests are going to be honored.

Also although I obviously can't prove it and you shouldn't take my word for it, I'd never pry into the database for your people's disgusting private conversations with each other. I don't want to have to bleach my eyeballs afterwards.

It's still unsecure in the sense that, save for a few sections, anyone can read what we're saying without having an account. Someone could use a crawler to grab an archive of the entire forum if they wanted with minimal difficulty. Would it include PMs? No.

There's still a level of insecurity.

But, the fact is: I do trust you not to share any of the more secure stuff (like email addresses, IP addresses, and so on) which is why I'm totally fine being here.

[Arkandel]

@Auspice said in Privacy in gaming:

@Arkandel said in Privacy in gaming:

@Auspice said in Privacy in gaming:

Just like what I am posting, right now, is going to an unsecured site.

Would I be furious if Arkandel used it for nefarious purposes? Yes, of course I would. But I'm not waltzing in expecting the forum equivalent of Fort Knox and that is what I think people need to stop doing.

Hey now, you are posting stuff to a regularly updated platform running on a regularly updated Linux system hosted by a reputable company, and you're doing so over an encrypted https connection. While it's true MSB is no Fort Knox, we're not exactly trivial to breach either.

Conversely there's only one way for me to provide your data and that's if the police produce a warrant demanding something specific. In Canada laws are fairly sane in that regard so the chance is low. No other requests are going to be honored.

Also although I obviously can't prove it and you shouldn't take my word for it, I'd never pry into the database for your people's disgusting private conversations with each other. I don't want to have to bleach my eyeballs afterwards.

It's still unsecure in the sense that, save for a few sections, anyone can read what we're saying without having an account. Someone could use a crawler to grab an archive of the entire forum if they wanted with minimal difficulty. Would it include PMs? No.

There's still a level of insecurity.

Oh I see what you mean. I guess I don't consider posting on public forums something that needs to be protected, much in the way scenes in non-private rooms on the grid should be fine to share without asking permission.

[Auspice]

@Arkandel said in Privacy in gaming:

@Auspice said in Privacy in gaming:

@Arkandel said in Privacy in gaming:

@Auspice said in Privacy in gaming:

Just like what I am posting, right now, is going to an unsecured site.

Would I be furious if Arkandel used it for nefarious purposes? Yes, of course I would. But I'm not waltzing in expecting the forum equivalent of Fort Knox and that is what I think people need to stop doing.

Hey now, you are posting stuff to a regularly updated platform running on a regularly updated Linux system hosted by a reputable company, and you're doing so over an encrypted https connection. While it's true MSB is no Fort Knox, we're not exactly trivial to breach either.

Conversely there's only one way for me to provide your data and that's if the police produce a warrant demanding something specific. In Canada laws are fairly sane in that regard so the chance is low. No other requests are going to be honored.

Also although I obviously can't prove it and you shouldn't take my word for it, I'd never pry into the database for your people's disgusting private conversations with each other. I don't want to have to bleach my eyeballs afterwards.

It's still unsecure in the sense that, save for a few sections, anyone can read what we're saying without having an account. Someone could use a crawler to grab an archive of the entire forum if they wanted with minimal difficulty. Would it include PMs? No.

There's still a level of insecurity.

Oh I see what you mean. I guess I don't consider posting on public forums something that needs to be protected, much in the way scenes in non-private rooms on the grid should be fine to share without asking permission.

I don't either (re: public scenes are loggable, etc), but I've met enough people over the years who have an expectation of asking permission regardless of scene location that I know it's not the standard.

[gryphter]

To my thinking, when I log onto a game, a few important things happen. First, I'm connecting to the infrastructure of a system that someone else owns. They pay money to own it; there is no reasonable expectation, therefore, that anything that happens there is 'mine'. I bring some of my stuff with me, like my PII, and I can't argue with anything said here about how we should be protecting that more effectively -- I should be able to maintain control over my stuff that I brought, or if that's impossible I should have some recourse to feel satisfied about what's being done to protect it for me.

I begin to RP, generating content within this setting which is someone else's creative property. Elements of my content are my original creative product, but they're impossible to divorce from those setting elements somebody else crafted. Who owns what, intellectually speaking? If I create a character from the ground up as being a part of that setting I don't own, and the person who does own it has to approve my integrating what I've written into it, it starts to feel like a vanishingly small portion of this can be called 'mine' creatively. Reduce this even further if I'm playing a roster character, which I far more often do. Sure, there continues to be an original creative element in how I voice that character and move them around the world, but every single shred of it is tied to the stuff that's not mine. It's partly mine, but mostly not.

Now I have this character I probably don't own on a game I definitely don't, and as time goes by I become a part of the community with the other people that play characters they don't own there. Some of these people are my friends, and I want them to feel safe and have a good time, getting to be involved in stories about the game world that isn't theirs. There are other people on the game too, and some of them might have it in mind to make things unsafe and/or not fun for others. I want me and my friends to be protected from that, and to have some recourse for satisfaction when that protection fails.

For all these reasons, I expect staff on a game to exercise their powers to observe. I accept it, because frankly I'm the one with a hand out here, asking to participate in something that's not mine."Sure, but I'm going to keep an eye on what you're up to" seems perfectly reasonable to me as an answer. Much like when I go to work and the entire facility is monitored; it doesn't creep me out, it makes me feel protected. I have the expectation that the people who own the company will do what they need to do to maintain a safe environment, and I trust that any information collected supports that goal. I don't know what I could possibly put in a pose written as part of a game's world that I couldn't bear to have the game runners read, but maybe that's just me. If it's sex and I'm embarrassed about that, well, maybe I should keep my pants on at the office if I don't want people to laugh at my inadequacies of both equipment and technique.

The security guards probably shouldn't gather 'round the monitor to watch, but they might, and if I don't like that I feel it's my fault for giving them something to see (even if science lacks a sufficiently sensitive device to measure its tiny scale accurately).

And for anyone keeping score at home, I'm in the 'wave at the camera, smile, and give them a show' camp.

[Arkandel]

@gryphter said in Privacy in gaming:

To my thinking, when I log onto a game, a few important things happen. First, I'm connecting to the infrastructure of a system that someone else owns. They pay money to own it; there is no reasonable expectation, therefore, that anything that happens there is 'mine'. I bring some of my stuff with me, like my PII, and I can't argue with anything said here about how we should be protecting that more effectively -- I should be able to maintain control over my stuff that I brought, or if that's impossible I should have some recourse to feel satisfied about what's being done to protect it for me.

You walk into my house that I own. I pay money to own it, yet not everything that happens there is 'mine'. If you're having a private conversation I can't use preinstalled microphones you don't know about to record it just because you're under my roof, and if you go to specific private parts of the building (like the washroom, nevermind that I still own it) I am not permitted to have installed cameras.

To give up on the analogy though it's not a matter of authority. Obviously if staff are bad actors they can do whatever they want and will only get caught if they leak that fact themselves and there's just about no recourse a player has other than leaving the game or spreading the word.

All I'm saying is that - in my opinion - secretly prying on private rooms or conversations constitutes unethical behavior. It's not because what transpires there is noteworthy, shameful, intimate, etc; it's because privacy itself is important.

[gryphter]

@Arkandel There's something between these two ideas that bothers me, and I'm trying to figure out what it is. I won't go back to the analogy, but it feels weird to me to log onto somebody's game and expect privacy. It's theirs and I feel like they have a right to monitor it and control for content.

I think the weirdness happens somewhere around that important word: expectations. There's currently no process at all, really, that talks about how much or how little privacy you might get so as to set those expectations. Given that, I can see where somebody who walks in with an expectation of privacy -- which never gets challenged at the door -- might take it poorly to learn later on that the reality is very different.

When a person enters an environment where they're being recorded out in the real world, they typically legally need to be informed of that. It seems reasonable to expect similar treatment here.

[Sunny]

My expectation of privacy is not that any given someone MUST provide it. It IS a selection criteria for me. If somewhere has it on policy that they will not be what I, specifically, find reasonable about my privacy I will not play there no matter what. I can understand the reasons for it, respect that it is their decision, and never once darken their doorway ever. Which is perfectly reasonable.

[faraday]

@Arkandel said in Privacy in gaming:

If you're having a private conversation I can't use preinstalled microphones you don't know about to record it just because you're under my roof

You say "can't" there, so I presume you're referring to laws. Otherwise what's to stop you?

But federal wiretap laws revolve around the idea of whether there's a "reasonable expectation of privacy" with the thing being recorded. (Disclaimer: I am not a lawyer.) Two people chatting in my living room without me being present? Yeah, they probably reasonably expect privacy.

But two people chatting on this forum's direct message software? I don't think that same expectation exists because we know the conversation is being saved in a database somewhere and could be viewed. Two people chatting on Blizzard's WoW guild chat? The expectation definitely doesn't exist because it's right there in the terms of service saying "chat logs are recorded and subject to review."

I don't think it's as black and white as you're making it out to be.

[Arkandel]

@faraday said in Privacy in gaming:

@Arkandel said in Privacy in gaming:

If you're having a private conversation I can't use preinstalled microphones you don't know about to record it just because you're under my roof

I'm not just talking about the legal repercussions. It's fair to argue most people would find the idea of being recorded without their knowledge in a house they're visiting to be disturbing, creepy or at least frown on the idea of such a practice.

[Jeshin]

I think the real question might be less what is the responsibility of game owners. Each game owner is going to handle it differently and be motivated by a different set of circumstances. The real question is what is the standard community expectation of privacy. Only by establishing the norm can people be judged for deviating from it.

From what I've read it appears that unless someone posts a log to a website or the policy explicitly states otherwise people expect their RP to be private whether it's sexual or not. They also expect their @mails and pages to be private too?

[faraday]

@Arkandel said in Privacy in gaming:

It's fair to argue most people would find the idea of being recorded without their knowledge in a house they're visiting to be disturbing, creepy or at least frown on the idea of such a practice.

Would they? Judging by the trends in smart home security cameras, I think we're on our way to an era where being recorded in someone's home is as much a presumed non-event as knowing that I'm on camera when I walk into Wal Mart.

If you're not talking about laws, though, you're talking about social norms. And judging from the replies on this thread, there is quite a bit of variance in what players expect.

[gryphter]

I'm aware that I'm planting my flag firmly on one extreme of this issue, but for me it's all in. This might be somewhat informed by games I played on in my early years in the hobby, where this was the clearly-stated expectation.

I also admit my understanding of the issue is somewhat limited by my own imagination here. I can't imagine what I could page, @mail, messenger, or pose that I would need to consider sensitive or private. I have no shame. Conversely I also can't imagine why I would want to watch anyone else TS, or even RP out a normal scene I have no connection to.

I'll admit that anyone who can talk their way into a wizbit having access to my PII has always made me uncomfortable. When someone could copy/paste a bunch of sensitive information out to who knows where, it seems like we can and should do better than 'well they won't though'.

[RightMeow]

Off topic a bit -- To anyone out there looking up my location from my IP or whatever. I would like to remind that I own a very large dog with protection/anger issues. **

** This may or may not be true, but pretend it is.

[WildBaboons]

I deal with privacy laws/compliance in a professional capacity. If I was going to be hosting a game, especially if I lived in the EU, I sure as hell would have a privacy policy in place that is part of the login screen.

I get that not everyone views privacy as a right or even a realistic expectation on a MU but a lot of people and government bodies do nowadays. they may not legally care about your hawt TS poses but if, for a example, you're discussing your health history on an Ares chat channel that's posted in the channel history to a webpage, the owner of the site could be looking at a GDPR violation if proper notice hasn't been given.

[faraday]

@WildBaboons said in Privacy in gaming:

you're discussing your health history on an Ares chat channel that's posted in the channel history to a webpage

Not likely in that specific instance, because you're doing the disclosure yourself in a public forum. It would be no different that talking about your diabetes to your buddy in the line at Wendys. Wendys isn't responsible for who might overhear.

But a staffer snooping on a page convo and then gabbing about your diabetes would be more problematic.

ETA: I agree with your general point about having a privacy policy though - I said so earlier as well.

[Tinuviel]

@Jeshin said in Privacy in gaming:

The real question is what is the standard community expectation of privacy. Only by establishing the norm can people be judged for deviating from it.

People are going to be judged for their implementation regardless as to how close or how deviant from the 'standard community expectation' is.

If you don't keep logs of anything at all, then you're not doing enough to protect your players. If you spy a little, then you're cherrypicking. If you spy on everything, you're a pervert or a creep.