OK EA, now you're pulling the piss...

Shiminay

So, if you use EA's Origin service, the Ts & Cs you have to agree to in order to use it allow them to scan your hard drive and use the results of what they find, combined with your personal information, to sell better advertising, amongst other things.

Article here on RockPaperShotgun.

I can forgive a lot of the practices EA do that people regularly take issue with but this is too much for me. I will be un-installing Origin from my machine at home (haven't used it in ages anyway) and probably won't allow another of their products installed on my PC in the future unless they make some serious changes to this.

I'm going to see if I can get a hold of someone in EA to comment.

amacachi

Pretty common thing I thought? Otherwise it amazes me how good Google are at suggesting things I'd like to buy.

Redlion

amacachi wrote: »

Pretty common thing I thought? Otherwise it amazes me how good Google are at suggesting things I'd like to buy.

I thought that's done through taking what you google/look at online and using this info to show ads that you'd want to see, as opposed to scanning your hard drive. I think it's called Adsense or something...

Kiith

It's done in a lot of EULA's, but most of them specifically state that it only happens when you use the game online. Because Origin is always online, it is allowed to do whatever it wants. Plus, most EULA's specify that they can take info relating to their product, whereas this one is pretty much saying it can take what it wants.

It sucks, but i'm still going to buy and play the **** out of Battlefield 3.

Opinicus

Redlion wrote: »

I thought that's done through taking what you google/look at online and using this info to show ads that you'd want to see, as opposed to scanning your hard drive. I think it's called Adsense or something...

Exactly.

Scanning your hard drive is more than a little too much I think.

amacachi

Redlion wrote: »

I thought that's done through taking what you google/look at online and using this info to show ads that you'd want to see, as opposed to scanning your hard drive. I think it's called Adsense or something...

Gmail scans your emails as well though. My emails are probably worse than my hard drive. :pac:

Redlion

amacachi wrote: »

Gmail scans your emails as well though. My emails are probably worse than my hard drive. :pac:

Something ya'd like to share with us, amacachi? :P

Mindkiller

My hard drive is mostly porn and pictures of cats. Nothing too incriminating really

marco_polo

Mindkiller wrote: »

My hard drive is mostly porn and pictures of cats. Nothing too incriminating really

Unless the two overlap in places

hooradiation

Mindkiller wrote: »

My hard drive is mostly porn and pictures of cats. Nothing too incriminating really

I think you'll find bestiality is illegal.

Edit: MARCO! *Shakes fist*

ríomhaire

Steam is allowed gather info on your PC aswell, though Valve are only allowed share aggregate info about the entire customer base with whoever they want, they can only share personal information about your specific profile with companies who are working under a contract for them. It's all in the Steam privacy policy.

Also, this: http://store.steampowered.com/hwsurvey

SeantheMan

I have my PCs 3 disks partitioned into 6 drives.
F:/ being for games.
With regards to the above, are they only allowed to scan this F:/ drive , the whole disk, or all disks ?

Under the title of “Consent to Collection and Use of Data”, the clause states that by installing Origin you are giving EA permission to

“collect, use, store and transmit technical and related information that identifies your computer, operating system, Application usage (including but not limited to successful installation and/or removal), software, software usage and peripheral hardware.”

It doesnt really say anything about personal data, website history, pictures, documents or anything. Just software and hardware usage or tech info related to your PC. Not a HUGE deal , considering the digital age we are in, where everyone already has everything personal about them scattered on facebook, twitter, myspace, youtube etc

ríomhaire

Surely internet history and such would fall under "software usage".

humanji

SeantheMan wrote:

It doesnt really say anything about personal data, website history, pictures, documents or anything. Just software and hardware usage or tech info related to your PC. Not a HUGE deal , considering the digital age we are in, where everyone already has everything personal about them scattered on facebook, twitter, myspace, youtube etc

I think that people are claiming that because it doesn't say specifically what it can collect, then they could potentially collect anything.

I'm not sure, but it could potentially include any banking details you put online or something like that. That's where the problems lie (though I could be wrong, who the hell ever reads T&C's?).

DeVore

Seantheman, is says any associated peripherals. I'd say they just enumerate the hardrives and start at the top.

I thoroughly dislike this and wont be playing any games that insist upon it.

Steam, while not spotless (see what I did there!), are at least self limiting in that they say more or less what they are looking for and that they will treat it with SOME respect.

DeV.

Shiminay

The wording of the EULA is vague enough that it mean's you have to allow them full access to everything and anything on your computer.

Not everyone has all of their personal life on Facebook or Twitter or all the rest and some of us would like to keep it that way

jaykhunter

yep. i've nothing incriminating on my laptop but i'm completely against anyone remotely scanning my hard-drive.

I'd have to imagine that this going public and tons of negative press that they'll amend their TOS

Doodee

Shiminay wrote: »

The wording of the EULA is vague enough that it mean's you have to allow them full access to everything and anything on your computer.

Not everyone has all of their personal life on Facebook or Twitter or all the rest and some of us would like to keep it that way

Under Irish law they can not 'opt-in' people by default or overly complicate the wording to mask their intentions. The correct term escapes me right now but they basically have to give a clear enough message to people about what they are tracking.
I know this cause we have had to investigate this for some features in our games and most legal teams are aware of it.
Be thankful that our Government are rather 'difficult' here regarding data protection.

I would also remind people of the differences between the Facebook T&C's and that of Google+. They both allow for the same thing only one is worded nicer

Shiminay

Since when has Irish law troubled organisations like Facebook or EA? These gigantic American firms don't give a fig about us Quite a lot of what Facebook does would be in breach of our Data Protection Act, but has that slowed them down even a little bit? Not at all.

BostonB

SeantheMan wrote: »

I....where everyone already has everything personal about them scattered on facebook, twitter, myspace, youtube etc

Er no they don't.

Most of the people I know have almost zero online presence. May very deliberately. Theres few people who have a lot of stuff online, they assume everyone else is the same. But they'd be wrong.

Personally I don't want anyone scanning anything or auto doing anything. Its all bloated crud and all it does is consume resources, and bandwidth, at the consumers expense.

Overheal

ríomhaire wrote: »

Steam is allowed gather info on your PC aswell, though Valve are only allowed share aggregate info about the entire customer base with whoever they want, they can only share personal information about your specific profile with companies who are working under a contract for them. It's all in the Steam privacy policy.

Also, this: http://store.steampowered.com/hwsurvey

I'm pretty sure Steam asked me to opt in to the hardware survey. That they don't automatically start sniffing around my machine for nefarious reasons. I'd have to read the T&C again but I doubt anything like that is contained within it.

ED E

Wont be touching Origin, or Gamestops new yoke after that stunt they just pulled. If its not on steam/greenman I wont be downloading it.

CORaven

I hope programs like AVG start flagging it as spyware. It may make them rethink their T&C.

Overheal

Brought Origin.com's safeweb rating down to a 4.0

Some people on the article discussion are strange. Yes, a supermarket tracks information about your spending habits. They do this based on actions you perform in the store. But it's not as if you consent at the time you purchase milk to have someone from Tesco ransack your home and take an inventory of everything you own. You don't head away from the drive-thru of a mcdonalds with a gps tracker so they can see how often you use your car. This would be the virtual equivalent. Even adsense/analytics more or less just tracks your behavior while you're on the target site, only the crazy ones try to place trackers on you and I enjoy letting my internet security scrub me of such tracking cookies.

Icyseanfitz

bloody EA, always pushing the boundries of what is acceptable scuminess

jaykhunter

^^^ Yup. I think the limit hasn't been set for what gamers will accept; so VG companies are prone to seeing what they can get away with.

I also think this sort of thing could only happen at a time where in general, the industry is booming.

ríomhaire

Overheal wrote: »

I'm pretty sure Steam asked me to opt in to the hardware survey. That they don't automatically start sniffing around my machine for nefarious reasons. I'd have to read the T&C again but I doubt anything like that is contained within it.

Oh yeah. It's been so long ago since I opted in to it I forgot that I did in the first place. I wonder is it possible to still opt out again.

Jelle1880

I was doubting between the 360 and PC version, guess I'll stick to the 360 version despite the smaller multiplayer maps.

This is a step too far.

Burgo

http://www.rockpapershotgun.com/2011/08/26/origin-eula-gets-a-makeover/

ED E

Burgo wrote: »

http://www.rockpapershotgun.com/2011/08/26/origin-eula-gets-a-makeover/

They can still FOAD.

gizmo

Burgo wrote: »

http://www.rockpapershotgun.com/2011/08/26/origin-eula-gets-a-makeover/

Awesome, so now it's basically like every other EULA I've ever agreed to.

Burgo

someone over on the EA forums did a bit of research into origin:

Lightman101 wrote:

Since there's been quite a bit of speculation about what Origin might monitor on your PC I thought I'd do a quick test to see what exactly it looks for on the computer. Please keep the discussion to either your interpretation of someone's findings or your own actual findings of the program.

After installing Origin I started it up with Process Monitor running as well. It recorded origin accessing various EA folders on the C drive and registry keys relating to EA and system stuff.

I did a search on its registry access and I noticed that it did NOT access the following keys (commonly used by the system to list the programs installed on the computer):
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall
SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData
HKUUSER-SID-HERESoftwareMicrosoftInstallerProducts
HKLMSoftwareMicrosoftWindowsCurrentVersionInstallerUserData
HKLMSoftware****sInstallerProducts
HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall
HKCUSoftware

I also searched and found that Origin did not access any keys at all containing the word "Uninstall".

Folder and file access showed Origin accessing mostly EA and system related stuff although it did access ALL of the folders and most if not all files in the ProgramData folder. Within these folders it even accessed icon files, Robosoft search dump files and some other miscellanous stuff which seemed a bit strange.

Origin also opened Xfire.ini which does contain a list of detected installed games as well as xfire_games.ini which contains a list of all games that XFire can detect.

I searched all the logs and couldn't find anything about Origin accessing folders or registry keys relating to my legitimate Battlefield 2 installation, and the game itself worked fine afterwards so it doesn't seem to interfere with other EA games (unless they are perhaps part of origin itself).

I searched the file and registry logs and found that Origin did not access any values containing the word "browser", "Internet Explorer", "Steam", "Valve" or "Firefox" (my default browser) except for a couple of HTTPshellopencommand(Default) registry entries that indicate what is the default browser for the system. It also queried the registry entries Internet ExplorerSecuritySafety Warning Level and Internet ExplorerSecurity which seem to indicate what security level IE is running on.

The Wireshark network log showed Origin communicating with several EA servers, though from what I could tell it was mostly sending HTTP GET requests and sending some sort of encrypted information to them.

While Origin was starting up & checking files it utilized 0% of the Internet connection. There was a tiny spike of internet utilization when I logged into my Origin account but after leaving it for a few minutes there was no more Internet activity. This would indicate that although it did check/open everything in the ProgramData folder there's no way it could have provided all that detailed information to the EA servers without a massive spike in Internet usage.

While testing origin I did find that Origin itself used about 70MB of memory.

Origin did not appear to install or activate any additional services when it was installed or when it started up.


Conclusion:

From what I can see Origin does act a bit suspiciously as it checks everything in the ProgramData folder and I can't tell for certain what data it sends to the EA servers, however it does appear to be mostly benign. Given its tiny amount of Internet utilization when logging in (barely half a megabit per second for a couple of seconds) it would appear to not send that much information to EA, especially since my ProgramData folder is 4.25GB and contains 211000 files in 655 folders. From looking at it's activities Origin seems sloppily programmed and badly implemented more so than anything else.

It doesn't appear to use steam or common registry keys to get a list of other programs on the computer however it does access XFire files which show what games XFire detected on your computer. It doesn't appear to access the game folders or registry keys of the games themselves though. It does however check to see what's in the ProgramData folder

I suppose you could remove the detected game info in Xfire.ini before starting Origin and hide or move the other stuff in the ProgramData folder to stop that stuff from being accessed.

It also doesn't appear to go through your browsing history or check much of your browser stuff except for checking what the default browser is and Internet Explorer's security level.

Keep in mind that Origin like other resource hogs accessed loads of registry entries and various system folders so I didn't check every single thing it did, I only searched for more obvious stuff and skimmed over what it accessed.


Questions Raised:

What's puzzling about this behaviour is that it doesn't appear that Origin is searching for something in particular or else it wouldn't be opening icon files, image files, json files and other miscellanous files. On the other hand there's no way that Origin could relay detailed information about what it's found in the couple of hundred Kilobytes max that it exchanges between itself and the EA servers when logging in.

It's possible that Origin might be providing a general overview of its scans to the servers, although much of the information would be useless as file info about icons and json files would have no value for marketing, customer service or selling the info to others. Given that many people would be using origin at once this would mean that EA's servers would be filtering out loads of useless information obtained by such a scan.

Another possiblity is that Origin is filtering the information found on the ProgramData folder itself before sending the relevant results over, which means that it's very badly programmed as it shouldn't need to scan every damn file to find out info about the software.

There is also the question about why Origin is checking the ProgramData folder but not other significant program folders or the registry keys for other software. Many programs don't store stuff in the ProgramData folder so if Origin was being used to see what other software there was it would only get part of the picture.


Comparison to Steam:

Out of curiosity's sake I've also done a quick test of Steam. Aside from accessing some system stuff Steam did not access anything else like the ProgramData folder (except for checking some bin files in Nvidia) or other game's folders.

It also mostly stayed out of other program's folders although it did access a dll in the FileZilla FTP Client folder and a couple of bin files in Nvidia's folder in the ProgramData folder. Keep in mind that I didn't check every little thing Steam did, only the (IMO) obvious stuff.

It also accessed the Start Menu\Programs folder and the Desktop folder but only to perform a basic query which provides the following info: CreationTime, LastAccessTime, LastWriteTime, ChangeTime, FileAttributes (just had RHDNCI for mine)

Within the registry it accessed quite a bit of system and steam/valve stuff. It did not access the keys mentioned in my first post that are commonly used by the system to list the programs installed on the computer.

These tests indicate that Steam and Origin are NOT the same thing, especially when it comes to what is scanned on the computer.


Personal:

I still have Origin installed however I won't use it outside of tests unless I can block its access to the ProgramData folder (apart from scanning every file and folder in ProgramData it also takes forever to load as a result). The best way to do this without resorting to Virtual Machines seems to be to use a sandbox program, however I haven't found one that properly works for Vista 64bit.

Comments, explanations and clarifications welcome, especially by EA staff.

http://forum.ea.com/eaforum/posts/list/7492824.page