Security flaw allows addons to expose full real life names without user permission

by Adam Holisky Jul 6th 2010 at 3:30PM

There is a flaw in the design of the Real ID system which, (as we understand it) thanks to you being an automatic Real ID friend of yourself, allows any addon to expose your real life name to anything or everyone; even if you have not marked those people as a Real ID friend.

We're hopeful that Blizzard corrects this design issue soon. From what we can tell, this has not yet been fixed.

In the mean time, we strongly encourage users to make sure only trusted addons are installed. Take a few minutes and be doubly sure that only those addons you need and know where they come from are running.

Tags: addon, addons, breaking, real-id

Filed under: News items

Reader Comments (Page 1 of 13)

KrusherX Jul 6th 2010 3:34PM

That RealID system has been a horrible idea from the get go imo.

Felix_rew Jul 6th 2010 3:46PM

It's a TRAP!!!11! So you think this is a coincidence? Blizzard set this up to steal our brainwaves, FLEE WHILST YOU STILL CAN!!!

-dons tin-foil hat-

cll Jul 6th 2010 3:54PM

It actualy happened to me, displayed my real name in white leter, talking about New Entities Entry and stuff -.- kinda freaked me out so I opened a ticket and a GM told me to relod my UI... clever. Still I dont trust it.

fladne Jul 6th 2010 3:57PM

When RealID cameout, I thought, "Man, am I glad I didn't use my real name when I made my WoW account." My friends made fun of me for being paranoid. With today's revelations including this and real names being used on the forums, I laugh and laugh as I read Bliz's promise that they will "never share personal information."

Hawkeye Jul 6th 2010 4:18PM

This recent flaw is the only problem with it that I personally have. If I don't want to take part in RealID sharing I don't have to. If, on the other hand, I decide to share my RealID I should be making peace with the fact that I am effectively putting my Facebook in my WoW. Ive already seen people putting their WoW in their Facebook so this is the next logical step.

sprout_daddy Jul 6th 2010 4:50PM

Given some of the people I've been grouped with lately, I can't for the life of me imagine why Blizzard would want to steal our brain waves. I'd be trying desperately find a way to give them back.

Perhaps RealID should be put on hold until some more testing can be conducted. I know it's very important for Blizzard to connect us so that I can see when my real-life friend is on WoW, playing SC2, or taking a dump (that version 2 of RealID), but I think it's less important than compromising client security, something that Blizzard has cared enough about preventing that they've given away authenticators and thrown vanity pets at us. I've got the feeling that once this RealID hole is closed, another will rear up.

And my hat isn't made of tin foil - it's aluminum.

kabshiel Jul 6th 2010 5:19PM

Oh noes! People can see my name!

MrJackSauce Jul 6th 2010 6:01PM

It's so intense!!!!! Oh my god, all we need now is a... DOUBLE RAINBOW! :O

http://www.youtube.com/watch?v=MX0D4oZwCsA&feature=player_embedded

Moonfaxx Jul 6th 2010 6:08PM

Having seen this bit of news and the change coming to the forums, my thoughts are these:

It seems that a lot of WoW players are convinced that people actually give a damn about you, what you're doing, or your name in real life. It strikes a parallel to those that think the government is spying on them. DO NOT FLATTER YOURSELF. No one cares. While you may feel and be important to your raid group, in the real world people simply don't care.

I am a computer and web security specialist, and protecting your sensitive information is important. But those people that think the whole world cares about what they're doing should worry less about their name being out in the open and more about your credit card information floating about.

Let there be no mistake: This IS a security flaw, and it is fixable. But don't think that the Real ID system or forum changes are terrible simply because Blizzard is shuffling things around.

Hoggersbud Jul 6th 2010 7:27PM

I'm not worried about the whole world. It's one person. Who I may or may not ever know.

The risk is far higher than my desire to expose myself to it.

Microtonal Jul 6th 2010 7:28PM

@ Moonfaxx: "It seems that a lot of WoW players are convinced that people actually give a damn about you, what you're doing, or your name in real life."

Just off the top of my head, I can think of several reasons why someone might not want their online activities to be associated with their real name and easily accessible to anyone at any time, some of them potentially life-threatening. Not everyone is privileged enough to be as cavalier with their identity as you appear to be.

The statements "I don't have any reason to protect my identity" and "no one has any reason to protect their identity" are not logically equivalent.

theRaptor Jul 6th 2010 8:38PM

@Moonfaxx

Go tell that to all those Facebook and Twitter kids that will never be able to get elected to political office.

I have met enough psychos on the web in my time to not want to expose my RL name in case they do decide to try and get back at me for some slight in a game or web forum.

tulipblossom Jul 6th 2010 9:00PM

Absolutely agree, RealID is just a really bad idea. It's not the system that's bad or the intent behind it, but rather the way it's been implemented. Using your real name (first and last) is just unwise, I'm sorry.

I think that pretty much anyone who disliked RealID saw this sort of thing coming, hence part of why they disliked RealID.

Camo Jul 7th 2010 7:52AM

I highly recommend the wowinterface addon that blocks those requests:
http://www.wowinterface.com/downloads/info17002-BlizzBugsSuck.html

Amaxe-1 Jul 8th 2010 10:50AM

Remember how people got so angry when the BBB gave Blizzard an "F" rating?
http://www.wow.com/2009/04/20/blizzard-gets-an-f-at-the-better-business-bureau/

(Ironically, they seem to have a "B" rating now. Wonder if that will change with the complaints over this policy?)

WoW Insider Show

Subscribe via iTunes for our latest show.

Hot Topics

WoW Insider Social Links

Put WoW Insider headlines on your site
Follow WoW Insider on Twitter
Find us on Facebook

Upcoming Events

Event	Date
Call to Arms: Eye of the Storm	5/25 - 5/28
Call to Arms: Alterac Valley	6/1 - 6/4
Darkmoon Faire	6/3 - 6/9
Call to Arms: Warsong Gulch	6/8 - 6/11
Call to Arms: Strand of the Ancients	6/15 - 6/18
Midsummer Fire Festival	6/21 - 7/4
Call to Arms: Isle of Conquest	6/22 - 6/25
Call to Arms: The Battle for Gilneas	6/29 - 7/2
Call to Arms: Twin Peaks	7/6 - 7/9
Call to Arms: Arathi Basin	7/13 - 7/16