Square Enix’s attempt to beef up security with Final Fantasy 14 Patch 7.2 hasn’t exactly gone to plan. Just hours after its release, a savvy programmer cracked the new measures, putting the spotlight back on some longstanding concerns. Previously, players had raised the alarm over a mod known as PlayerScope, which snoops on character details without permission.
Patch 7.2, named Seekers of Eternity, went live on March 25 after a day-long maintenance period. It brought in the Cruiserweight tier for the Arcadion raid series and moved the main narrative of Dawntrail forward. The update also introduced some significant Job adjustments; the Black Mage received a boost with quicker cast times and increased damage, while Pictomancer’s burst damage took a hit following player feedback. Additionally, the patch aimed to fend off malicious attacks by encrypting player account ID info.
Unfortunately, the fix was soon deemed ineffective. In an interview with PC Gamer, programmer and Final Fantasy 14 enthusiast NotNite revealed how swiftly she and her team unraveled Square Enix’s new security measures. According to NotNite, the patch attempted to implement network obfuscation to protect account IDs, but this defense was soon breached using an algorithm. After a few hours of testing with the help of some willing friends, they concluded that the fix didn’t hold up. NotNite detailed these discoveries on Bluesky.
While NotNite hasn’t disclosed exactly how they cracked the obfuscation, she suggested that mods like PlayerScope, which draw on account ID data, might soon update with this breakthrough. This has reignited concerns about PlayerScope, a tool notorious for tracking all characters tied to a player’s account by exploiting local client data, a potential gateway for harassment.
NotNite speculated that Square Enix’s quick fix might stem from constraints in development time and resources. Earlier this year, the company acknowledged the existence of PlayerScope and restated its stance that third-party mods violate the game’s terms of service. According to the patch notes, the changes to account IDs were supposed to prevent certain player names from displaying, although players could recreate any affected names.
After testing the patch, NotNite criticized Square Enix’s approach, urging the company to stop sending account information to game clients. Considering the added blow from recent DDoS attacks on the game’s servers, it remains to be seen how Square Enix will tackle these security issues moving forward.
