Echo-Unvaulted

The Sunnie Sunday Report (echo-unvaulted.net) is a weekly report of discovered EchoVault contributors. These characters were found with our own tools exploiting a few security oversights in Echo’s protocol.

The report is to let stalkers know they aren’t anonymous and can be caught by playing their own game. Good news: so far this plugin isn’t as popular as it’s developer would like it to be.

• Glossary — an alphabetical index of terms used across this documentation.

About Echo

Echo is a third-party plugin for Final Fantasy XIV that runs continuously in the background while the game is open. While active, it sweeps through every player character it can see and uploads detailed information about them, building a searchable public “census” of players without their knowledge or consent.

Because the About and FAQ pages on EchoVault’s website are extremely dishonest on what is actually being collected, we are documenting it from analyzing it’s decompiled code.

• What is Echo?
  • Who ends up in its database?
  • Captured information
  • How does it work?
  • Where does it all go?
  • How can it be disabled?
  • tl;dr
• Motives of Echo users
  • The mechanics: gamification
  • Personal motives
  • If you feel unsafe
• Policy Violations
  • Square Enix — FINAL FANTASY XIV User Agreement
  • Dalamud — project statements and developer guidelines

Echo’s Wire API

These technical pages are to help other developers interested in fighting against scoping plugins.

• Transfer Protocol (HTTP)
  • Transport and envelope
  • Request signing (HMAC)
    • Example
  • Endpoint index
  • Endpoint detail
    • GET /v1/config
    • POST /v1/auth/register
    • POST /v1/auth/session
    • POST /v1/ingest
    • POST /v1/scan-targets
    • POST /v1/scanner/stats
    • POST /v1/claims/link/start
    • POST /v1/auth/verify/start
    • POST /v1/auth/verify/complete
    • POST /v1/appeals
  • The auto-search sweep (DMA)
  • Illustrative walkthrough: config → register → session → verify → ingest
• Data Model (C#)
  • Registration and session
  • Ingest: the sighting payload
    • Sighting schema
    • Collection channels
  • Server config
  • Coverage / scan targets
  • Scanner stats
  • Claims and verification
  • Appeals and generic errors
  • Unused
  • Local storage
  • Local-only types