Tag: RedZone

RedZone and security: separating fact from fiction

Posted on by Inara Pey

The mills continue to churn on the matter of RedZone and its ilk. As such, I thought I’d pause for breath and try to sort some of the wheat from the chaff for those still confused. I’m deliberately avoiding any attempt to delve deeply into the more questionable aspects of RedZone and its data-gathering, and focus on the raw facts in the hope of illuminating the bare bones of why RedZone has little or no legitimate use in matters of security.

Myth 1: RedZone prevents copybotting

No, it doesn’t. It doesn’t even deter copybotting. RedZone attempts to identify known malicious viewers – which sounds good until you consider the following:

  • Anyone seriously engaged in content ripping (aka copybotting) knows how to hide the identity of the Viewer they are using so that it appears to be perfectly legitimate – thus RedZone cannot identify it. They can therefore create an alt, enter a sim, be scanned a “legal” and still copy items on display
  • Copybotting existed long before the Viewer was open sourced. As such, while the Viewer is the most convenient way to rip content, it is not the only means. The code for content ripping is still available to those that want to use it. There are also software applications that can be used for certain types of content theft. RedZone cannot even detect such activities – much less stop them- RedZone cannot even detect, much less stop them
  • RedZone works on the assumption that the Copybotter will actively engage in theft within the shop. Some may – and will likely avoid detection, as noted above. However, the simplest way to copy something is to legitimately buy it and then rez and copy it away from the store, rendering RedZone pointless.

So, don’t be fooled. In terms of “stopping copybotting” RedZone will be about as effective as using a wet paper bag to stop a bullet. At L$3999 a pop, that’s an awfully expensive wet paper bag…

Myth 2: RedZone prevents griefing by alts

RedZone is no better than any non-invasive (and cheaper) security tools for stopping griefing. In many respects, it is actually worse.

Much is made of RedZone’s ability to “identify alts” and so “stop griefers returning”. While this makes good reading, let’s look at the facts.

RedZone uses a method of obtaining avatar data and IP addresses (through a media stream exploit) and then compares results, the “theory” being that if two avatars have the same IP address, they “must” be alts of one another. BUT…the system ignores the fact that the vast majority of IP addresses currently in use are dynamic and can be changed frequently.

For example, I can turn my router off for 3 or more minutes, and when I power it back on again, I have a “new” IP address assigned to me by my ISP – an IP address that was previously been used by someone else possibly in the same general geographical location as me, but certainly using the same ISP.  This means that potentially:

  • *If* I were a griefer, I could avoid detection on a sim using RedZone simply by forcing my ISP to assign me a new IP address and then creating a throw-away alt.  There is a better than even chance that RedZone would not detect me, leaving me free to go about my dirty business
  • As someone who does not engage in griefing, I could be innocently accused and convicted of the crime, simply be because my ISP has assigned me a dynamic IP address that was previously associated with a “griefer”

RedZone further fails to acknowledge the existence of “block” IP addressing – such as might be used within an office building, or in an apartment block or by an Internet cafe, and so on. This means that if *one* person is identified as a “griefer” on that IP address – then all users of that IP address “must” be alts of the “griefer” – and are therefore banned.

And if that weren’t enough – RedZone does not distinguish between accounts on the same IP address. Thus, if one person in a household decides to do something silly, then can end up being banned as a “griefer”  – along with the rest of their household.

Proponents of RedZone will say this is acceptable – in other words, condone “guilt by association” – for the “greater good”. Yet all they are actually doing is potentially banning customers from their shops and patrons from their venues. Again, the genuine / serial griefer can circumvent RedZone as easily as the serial copybotter.

Myth 3: RedZone provides better land security features than other systems

No, it doesn’t. For general land security – keeping out unwanted visitors, preventing “casual” acts of “griefing”, removing troublemakers, etc., RedZone offers no more than can be found – free of charge – in the land tools available at parcel level, or at estate level if you own a sim. Using the land tools you can ensure:

  • Residents with no payment info logged with LL (directly or via PayPal) cannot access their land
  • Residents who are not Adult Verified cannot access their land
  • Residents who are not Adult Verified and have no payment information registered cannot access their land
  • Only members of your own Group can access the land.

These options alone should deal with over 99% of potential issues around security. And even if there is the occasional issue with a troublemaker, all parcels have a simple-to-use Ban List.

Similarly, griefing objects can be taken care of  simply by:

  • Restricting object creation / rezzing to Group members only
  • Restricting object entry to Group members only
  • (Worst case) restricting script running to Group members only.

These three steps alone eliminate the means by which the majority of griefers operate.

Sim owners can similarly restrict access to their sims – and in the case of residential sims, restrict access to multiple Groups if they wish, to save having everyone living on the sim a member of “their” Group.

If, for whatever reason, estate / land tools don’t work for you, then there are a number of items out there specifically developed for land security, none of which require your visitors / friends to be surreptitiously scanned. I’ll name two here, because I’ve used them for the last 4+ years at both parcel and sim level with great success:

  • Psyke Phaeton’s outstanding PDS Home Security orb – offers both parcel and sim-level solutions
  • Thomas Conover’s Land BodyGuard HUD, which provides sim-wide protection plus remote access to functions (you don’t have to be on your sim to ban someone, similarly, you can ban someone who is not physically present on the sim at the time of banning (because, say, they’ve created mischief and run away). It can be fully integrated with the SIM Radar system, if required – and both for half the price of RedZone. Find both in-world here.

These are just two systems. There are many more. All are cheaper that RedZone, and all carry out their functions without the need to covertly scan your visitors, as stated, nor do they lead to additional angst and drama over people being incorrectly accused of being alts of one another or having information about them stored on a third-party database outside of SL (which would most likely cause them considerable upset were they to be told this is in fact the case).

The facts that do count with RedZone

  • It cannot prevent copybotting. The most it can give an a false sense of security
  • It may deter the odd griefer, but not those who make griefing a habit
  • It offers an expensive solution to the problem of land security costing far more than dedicated land security tools that offer the same functionality
  • As a basic “security tool” RedZone is invasive of people’s privacy that sends avatar information to an insecure 3rd party database. As such, and given its use is detectable, all it is liable to do is encourage people to stay away from those stores / venues where it is used.

As I said, I’m not using this post to delve into the deeper and more distasteful elements of RedZone or the unethical behaviour of its creator following recent revisions to the Second Life Community Standards. These are all public knowledge. Rather, I’m hoping this post will simply give pause to those who have RedZone, or who are considering it, so they can ask themselves if it is really worth L$3999 when something costing L$750 will do the job without embroiling them in the wider aspects of the RedZone situation.

Data scraping: update

Posted on by Inara Pey

The media patch mentioned for Phoenix has, as reported earlier, now arrived in Henri Beauchamp’s Cool VL Viewer, in a somewhat modified form.

And already it is proving its worth for those concerned with attempts by others to scrape and gather IP addresses for the purposes of match – or simply gathering avatar information in general for the purposes of profiling & possible stalking.

  • Theia Magic, had a run-in a while ago with a club owner who was either somewhat economical with the truth during their exchange – or was playing a game of “place the RedZone, removed the RedZone, place the RedZone again when no-one is looking”. As it seems that, despite his loud denials as to running RedZone, he does in fact have it deployed and hidden. Given he’s been trolling the “old” official forums loudly denying he has or would use RedZone, getting caught out has obviously left him with the produce of several chickens on his face – or at least, that’s how I look upon the “colourful metaphors” he employs in his exchange with Theia.
  • The Hair Fair that has been running of late and has been widely advertised also appears to be running RedZone. Whether it is the organisers or an individual store is unclear; however, the patch flagged aggressive media stream pushing that resolved to the RedZone server as soon as a number of people using Henri’s Viewer arrived. The interesting thing here is that Greenzone failed to give any alerts.
  • Theia has now started a list of in-world locations that are attempting to deliberately mask their use of RedZone (see link above). So much for the RedZone Challenge initiated by Ciaran Laval in an attempt to gain transparency.

Quickware (another spying tool) has been linked to the IP Address 193.93.174.118.

Elsewhere, and connected with the use of the new patch, A “new” mystery domain has now been revealed as popping up frequently around the grid, again aggressively pushing a media URL onto people arrival at stores and venues. URL resolves to a domain called m.sparkgap.info (IP 69.163.222.23). It is unclear as to precisely what this is doing: speculation points to it possibly being related to CDS, but this is far from confirmed.

Caution certainly dictates both of these IPs are added to your firewall for blocking purposes – and in the case of m.sparkgap.info, added to your host file if you are technically-minded. Prior to the release of the media patch, there was speculation that it would probably uncover a lot more in the way of mysterious use (as opposed to outright misuse) people build around media streaming. m.sparkgap.info may yet be the tip of the iceberg.

Finally, Itazura Radio has some fun at the RedZoners’ expense while making some very valid points (sorry I cannot embed; EMI apparently get ticked off with me if I try).

And Cummere Mayo provides some excellent advice for those wishing to lose friends and alienate people.

A new working week commences tomorrow; one in which the new Community Platform is unveiled. This could well be a testing time for the Lab in terms of measuring up their actions against the words of their new CEO.

Further Information:

  • The humongous SLU thread on the subject (now with summaries!) – it is a monster, but an enlightening and addictive read
  • Henri Beauchamp’s Cool VL Viewer with media patch
  • Theia Magic’s blog with RedZone listings
  • no2Redzone – the latest information, information on blocking the RedZone site, etc.
  • My original post, with further links (and some repeats)
  • JIRAs on the subject of privacy – all worthy of your vote and watch):
    • SVC6751 -Make parcel_media_agent_command and similar request user permission
    • SVC 6793 – Establishing an opt-out system to prevent tracking
    • VWR24746 – RedZone security violates ToS, exposes private information & is being misused
    • VWR-24807 – Add abilityto filter cookies into the browser (Viewer 2.x)

Privacy: words and deeds

Posted on by Inara Pey

When talking to Dusan Writer recently, Rod Humble made a very interesting statement:

“Privacy is extremely important for anyone putting themselves out there, expressing themselves, or expressing a side of themselves through an avatar. People don’t want other people to connect the dots from their avatar to their real life person – or even, for that matter, to an alt. One of the ethical obligations we have is to protect people’s privacy

“People come to Second Life because they want a story, they want to be in a story….and we have an ethical obligation to protect that.

“I’m not so sure that the conventional wisdom makes any sense. Yes, it might be technically easy to track people and all that. But in the long-term I’m optimistic that we’ll see the pendulum swing back in the other direction towards more privacy.”

And granted, while it can be read at least two ways, LL Board member and investor Mitch Kapor appeared to see the light on matters of privacy when he tweeted:

“The more I learn, the more I see how the whole biz side of social networking is built on surreptitiously stealing personal data”

As regular readers here are only too aware, there has been much of a to-do about RedZone and its data-harvesting & drama/griefing capabilities (I simply cannot refer to it as an “anti-Copybotting tool” due to it being an abject failure in this regard). As has been seen, Linden Lab have made a move to partially close the door on things, although they’ve not – as yet, at least in this affair – gone far enough (and at this point it is only speculation as to whether they’ll go further in this particular matter).

However, the issue of user data – beyond what we volunteer to reveal in our Profiles  – being harvested is still an issue whether or not a single tool and HUD are on the market or not. Viewer patches will help, a clear-cut policy is needed – and users themselves need to be empowered to be able to make a clear-cut choice in matters of privacy.

Ann O’Toole has hit upon one way in which the latter can be achieved, and has raised a JIRA on the matter.

This is an elegant solution because it provides every single user in SL with a choice as to what happens “under the covers” with any data which is linked to them outside of Profile information. As such, it dovetails perfectly with Rod Humble’s stated views on privacy within and beyond Second Life – indeed it encourages the swing of the pendulum to which he alludes –  and curtails the act of surreptitiously stealing personal data which appears to have Mitch Kapor somewhat concerned about in his Tweet.

So – I urge you all very strongly to go visit SVC-6793 and add your weight to those voting / watching the issue – it really is in your best interests to do so.

Hamlet’s credibility takes a plunge

Posted on by Inara Pey

I’m going to have to start a RedZone category at this rate!

Hamlet Au over at New World Notes wades into the mess of the RedZone furore and – well, rather makes a mess of things.

Trying to play down the situation, Hamlet engages in the very worst kind of journalism imaginable, including:

  • Playing down the number of votes on the JIRA: “The JIRA thread has less than 1500 “votes” from Residents who consider the request valid and important…”
  • Quoting Samuel Linden from a “related” JIRA: “We do not consider IP gathering to be an actionable security exploit”
  • Overlooking the broader (and primary) issues around this tool – that of the potential for avatar / alt profiling, stalking, etc., while falling back on the hoary old “your IP Address is public” excuse: “Oh yeah, before you weigh in with your comments about Redzone’s IP address tracking software, keep in mind that if you post here, this Typepad blogging software lets me, well, track your IP address.”
  • Attempts to make light of the whole situation as being meaningless with a quip about a Second Life band, “And while we’re at it, how much of a concern is this for Redzone, the popular Second Life industrial band of the same name but no apparent relation to the program?”

Quite what prompts this display of “journalistic” arrogance is beyond me.

In referencing the JIRA and dismissing it as having “only” 1500 votes, Hamlet deliberately overlooks the fact that for much of the past month the SL General Discussion forum has been awash with complaints and concerns around RedZone and its potential for abuse, thus demonstrating that there is far wider concern than those who use and understand the JIRA.

Furthermore, it may “only” be 1500 votes – but that still puts it right up there among the top-ranking JIRA, and this does account for something, even with LL abandoning voting themselves – or is Hamlet stating user thoughts on any matters within SL aren’t worth a thing?

Then there is the quote from Samuel Linden. While it is genuine, the JIRA itself is over twelve months old and as such, Hamlet’s use of Samuel’s comment is really playing a game of misdirection here; particularly when any such comment has been overtaken by the changes made to Section 4 of the Community Standards – changes that Hamlet, as a journalist prepared to actually investigate the matter he is opining on should be fully aware of.

But just in case it has somehow slipped his attention, let me provide a handy quote aide-mémoire for him:

“4. Disclosure

“Residents are entitled to a reasonable level of privacy with regard to their Second Life experience. Sharing personal information about your fellow Residents without their consent — including gender, religion, age, marital status, race, sexual preference, alternate account names, and real-world location beyond what is provided by them in their Resident profile — is not allowed. Remotely monitoring conversations in Second Life, posting conversation logs, or sharing conversation logs without the participants’ consent are all prohibited.”

IF this were just a matter of IP Address gathering, there wouldn’t be a problem; again, those objecting to RedZone have made this abundantly clear. But RedZone does far more than this, as well all know. It seeks to match avatar account information with IP Addresses in an attempt to link alts.

In other words, in case you still don’t get it Hamlet, RedZone harvests alternative account names and attempts to correlate them to real-world location via the IP Address – and this is most expressly not allowed.

Of course, Hamlet isn’t going to see an issue with RedZone because he’s too caught up in the world of Facebook, where Mark Zuckerberg and his idiotic notion that “the age of privacy is over” rule. Indeed, he is utterly dismissive of the idea that any of us have a right to privacy, “Right now, I’m inclined to think it’s a deep concern mainly to a vociferous minority who are vigilantly protective over their privacy. And, of course, Copybot and alt account users.” Nice.

And by the way, Hamlet, I saw exactly what you did there – linking those who wish to maintain a degree of privacy around their SL activities directly with the nefarious acts of “Copybot users”. Nice to see NWN stoop into the worst kind of tabloid trickery.

However, I’ll leave it to Ordinal Malaprop to make the most astute and accurate summation as to the value and accuracy of Hamlet’s piece:

“I really don’t think that anybody who can’t tell the difference between the implications of a website being able to record self-identified (i.e. basically an/pseudonymous) IPs if people choose to submit comments, and those of a system that collects IPs without awareness let alone consent which are automatically tied to a unique identifier, should be writing articles like this.”

Indeed.

Slip-sliding away

Posted on by Inara Pey

Today, in theory, we should see something on policy relating to data mining in Second Life – or at least what amounts to being “private” data & how it can be used.

As reported last night, LL has changed the wording of the Section 4 of the Community Standards – but frankly, this is not enough.

zFire Xue himself is busily informing his followers that he is working on ways to – essentially – render the new CS null and void. While we do not know what, if any, conversations have been held between Mr. Xue and Linden Lab, it is clear from some of the posts on his own forum that he fails to grasp the precedent of formal consent over implied consent – in much the same way that those with statement in their Profiles relating to their ability to freely disseminate IM conversations fail to grasp this fundamental point. An example of this failure to comprehend comes in his statement that if people do not respond to a request for consent to be “background checked” then they “have given their consent” and the check will be enabled.

This is akin to saying that a vandal is entitled to kick the glass out of someone’s front door because they failed to answer it within 60 seconds of the bell being rung. The vandal may think it is OK – but the authorities are liable to inform him otherwise.

Elsewhere, Xue mob rail against the upcoming media patch that has been accepted into Phoenix, resulting in some vile and outright threatening posts being made – so much so that Jessica Lyons herself was prompted to step into the fray, thus:

“I guess it’s time to make a formal post here. While I may control the official position of the Phoenix Viewer Project on matters such as this, I do not control and would make no attempt to control the opinions of the members on this team. That is to say, everyone is entitled to their opinion, and EVERYONE has an opinion… Internally.. we have team members in favor of Rz, and team members against it… Those opinions do NOT reflect the official position of the Project as a whole.

“The official position of the Phoenix Viewer Project in regards to the Redzone matter, is neutral.. The project is not in favor of.. nor against Rz. There are valid arguments on both sides of this fence and we will not take sides.

“However, we as a team have discussed at great lengths and agreed that users should have the right to control what connections their viewer or computer make to the internet. Because of this, we have accepted and are currently improving a patch that was submitted to us which provides the user a partial url string to which they can allow or deny a connection.

“When a user enters a parcel that has a media url, and they have media enabled and the “Media Filter” option enabled, it will prompt the user before allowing the connection and say “The owner of this parcel has requested media at the following location to be loaded by your viewer”… The URL will be parsed beyond the domain, example… “http://sim4328.agni.lindenlab.com:……/…. php?…. /…. “

“We feel this implementation provides acceptable privacy for both the visitors and the stream owners by not giving out the full URL. The visitor can then choose to Allow, Deny, Black list, White list. This feature can be enabled or disabled completely by the user in media preferences. The black list and white list will be shipped empty.

“Now, while Redzone users may feel this feature is targeting Redzone.. and no amount of statement by me may change that opinion to which you are all entitled too.. I will again state the purpose of this feature for the record. “To provide the user the ‘Right’ to control what connections their viewer makes to the internet.” This is of course no different than the purpose of any firewall.”

[with thanks to Hitomi Tipomi]

And she is absolutely correct. The risks in leaving the Viewer in its “default” mode are legion when it comes to potential abuse through the media stream. As such, providing the user who opts to have media turned on with a media to review and accept incoming media streams is not “helping the copybotters and griefers” – not in the slightest. It is about protecting SL users and their computers. Period.

Henri Beauchamp also understands this, releasing as he does today an update to his Cool VL Viewer:

“Cool VL Viewer v1.25.0.23 (stable branch, Snowglobe v1.5-based)

“New in this release:

  • New MediaFilter patch: based on a patch by Sione Lomu, this (largely) reworked patch allows you to authorize or deny individual media and audio streams. See this message for full details.
  • Updated SLPluginAndMediaFixes patch: this new version fixes the internal web browser “cache” folder quirk which caused the latter to be written at the root of your filesystem (“/cache” in Linux, “c:\cache” in Windows). See this thread for details.
  • Updated ContextMenuTextEntry patch: this new version improves the context menu of input lines and text entries by greying out automatically unavailable actions in the menu (for example, disabling “Copy” when no text is selected).
  • Updated RevertUIchanges patch: changed to cope with the new MediaFilter patch.
  • Updated CoolPreferences patch: changed to implement the options related to the MediaFilter patch (in the “Miscellaneous” sub-tab of the “Cool features” tab: new checkbox and “Reset filters” button).
  • Updated CoolVLViewerBranding patch: Sione Lomu added to the contributors list.

“Enjoy ! “

[with thanks to Innula Zenovka for raising this.]

Doubtless, this will also make Henri a “supporter of griffers” (or “Greenzoners” as the term now appears to be).  All I can say is: kudos for him in giving his users the freedom of choice. I look forward to seeing more 1.x TPVs making the patch available and – hopefully – the coding being ported to 2.x TPVs.

Personally, I have media disabled on my computer – and I’ll continue to do so moving forward (although I might give the patch a try once it is available in a Phoenix release). Of course, admitting this doubtless confirms to Mr. Xue and his Crackerjack followers that I’m a “copybotter and griefer” (or indeed “griffer”, as they insist on spelling it).

The fact that I have media disabled because a) I simply do not and almost never have watch a video stream in-world (other than just after my return to SL), and therefore never have had media streaming turned on; and b) I actually prefer having my own music playing over the stereo while in-world, as 98% of “music” played in stores usually gives me a dose of the screaming heebee geebees; is something that Xue et al will not accept as being my right.

But then, it is more fitting for these people to adopt the mob mentality and loudly proclaim that anyone with media turned off does so “because they have something to hide”, because the right of the user to make a choice in what they do and how they go about their Second Life is precisely what Xue and his Crackerjack crowd want to try and prevent. Not because it means that those using RedZone will no longer be able to “protect” their stores and business (RedZone is already an abject failure in this regard, so ’nuff said). No. The reason that Xue’s Crackerjack followers don’t like the idea of you and I exercising our right of choice as to what goes on in relation to our in-world experience is because it ruins their immature sense of entitlement that they have the right to “police” the Grid and determine who is who and who can go where.

And this remains the core issue with this tool in particular – as zFire’s continued talk of circumventing the revised Community Standards most ably demonstrates – the ability of a minority to attempt to hold sway over the majority and consider themselves somehow above the ToS and CS.

However, there is an old truism about hanging and giving someone sufficient rope. Given the noises being made within LL as regards privacy – from the likes of Rod Humble and Mitch Kapor (who recently tweeted “The more I learn, the more I see how the whole biz side of social networking is built on surreptitiously stealing personal data” – I’m hoping that the truism applies in the case of Mr. Xue and his self-supposed immunity from the revised CS.

Addendum Feb 26th

It would seem that zFire Xue is determined to hang himself. With speculation continuing to run as to the future of RedZone and the potential for it to be banned from SL, he responds with pure (and exceptionally stupid) thug-like threats.

Note the highlighted portion. The thuggish attitude here is clear: he’s threatening to “out” the data he’s gathered; he’s trying to bully Linden Lab and he’s attempting to stifle legitimate concerns about his product (although this last point, to be fair, has always been his tactic and so comes under the “nothing new here” category).

Perhaps he actually realised he was giving away too much as to his intentions, as this reply was later re-edited into something far milder and with the threats removed – and can be seen on his forum in this latter format:

Sadly for xFire, however, the original reply – and his intentions – are now a matter of public record, thanks to Innula Zenovka, who captured the original in a screen shot prior to posting it over at SLU, – and to others who have since circulated it for broader consideration up to and including posting a copy on the JIRA related to this issue.

What was I saying earlier about the old hanging, rope, and man truism? zFire, meet rope.

 

Nailing the data harvesters (2): LL make a move

Posted on by Inara Pey

It seems LL have made a move to clamp down on tools like RedZone.

Until today, Section 4 of the Community Standards read:

“Residents are entitled to a reasonable level of privacy with regard to their Second Life experience. Sharing personal information about a fellow Resident –including gender, religion, age, marital status, race, sexual preference, and real-world location beyond what is provided by the Resident in the First Life page of their Resident profile is a violation of that Resident’s privacy. Remotely monitoring conversations, posting conversation logs, or sharing conversation logs without consent are all prohibited in Second Life and on the Second Life Forums.”

However, this has now been revised to read:

“Residents are entitled to a reasonable level of privacy with regard to their Second Life experience. Sharing personal information about your fellow Residents without their consent — including gender, religion, age, marital status, race, sexual preference, alternate account names, and real-world location beyond what is provided by them in their Resident profile — is not allowed. Remotely monitoring conversations in Second Life, posting conversation logs, or sharing conversation logs without the participants’ consent are all prohibited.”

[my emphasis]

Thus, at a stroke, the surreptitious ability of RedZone to gather information on SL users without their knowledge, much less consent is rendered void – or is it?

It’s not quite time to proclaim victory as yet. While the change to Section 4 of the CS is indeed welcome, it does not go far enough: sharing information that can be regarded as personal may not “not be allowed” – what about gathering of said information?

There is also the matter of in-store scanners (note that on his own blog zFire only comments on his nasty little (and purely voyeuristic) HUD as being updated to request people allow it to scan them).

The playing field has shifted, certainly – but, depending on what policy announcement is forthcoming from LL tomorrow – it seems that it may not have shifted enough.

Right now, the rule of thumb would be to keep your media tools disabled – at least for the time being.

ADDENDUM – Feb 25th

Thanks to Theia Magic’s investigations, it now appears that the RedZone in-world scanners give you a link to follow to the RedZone website in order to “give your consent” to be “background checked”.

This being the case, I’d advise people to keep media disabled and to stay away from the RedZone website – especially if following links using your own web browser,  rather than the built-in Viewer browser. Visiting that website is giving a clear indication that you’re OK with data being captured and – potentially – a cookie being deposited on your computer – even if you’re attempting to “opt out” of your information being captured!

The website is further confusing inasmuch as only those already scanned need to “opt out”. Despite the claims of zFire Xue, RedZone’s creator, those scanned / placed on the database are liable to be in the minority – therefore this approach could fool people into exposing themselves where there is no need for them to do so.

Beyond this, the solutions currently being offered up by zFire Xue relate purely to having your details (if any) “checked” on his database – they do nothing to prevent any actual scanning by his in-world items in the first place.

So – simplest solution: keep your media options disabled and remember there are a lot more stores you can shop at / clubs you can dance at that don’t use RedZone than there are stores that do use it.