Unity Analytics and the GDPR

[Poodmund]

Its weird because the Settings.cfg file that is auto-generated by default upon first load still generates with the lines:

CALL_HOME_PROMPT = True
DONT_SEND_IP = False
SEND_PROGRESS_DATA = False

So in theory the prompt window should still show, but doesn't.

What's a bit weirder is the last version of KSP that showed this window was 1.3.0 Build 1804:

... but from the transition from 1.3.0 to 1.3.1 it was removed.

You can test this by deleting your Settings.cfg file then running the game executable, in 1.3.0 is will appear, in 1.3.1 and later versions, it does not.

[Tweeker]

  

        For me the thing that really bothers me is this;

If I know a singleplayer game requires you to be online, or have an internet connection to play, I won't buy it. (I'm looking at you SimCity 5)

If I know a game has red shell, or some such similar "feature" I don't buy it.

When I bought KSP 5 years ago, there wasn't anything like this in the game.  Changing the EULA and adding this crap is very shady, you are forcing me to choose now,

agree to the new terms and be tracked.

or

walk away from the game.

or

Keep playing an older copy of the game,  in violation of the new  EULA, which I didn't agree to.

None of those are a desirable choices for me. This is not a monthly subscription service. This is something that I bought and paid for years ago. 

[Sigma88]

after the 1.4.5 update the game is still not offering an option to opt-out of data collection as far as I can tell

[Deddly]

1 hour ago, Sigma88 said:

after the 1.4.5 update the game is still not offering an option to opt-out of data collection as far as I can tell

I got the option when I first booted up 1.4.5. Odd that you didn't. 

[Cydonian Monk]

22 hours ago, Deddly said:

I got the option when I first booted up 1.4.5. Odd that you didn't. 

I wasn't provided with an option to opt-out on my clean v1.4.5 first boot either. I don't care one way or the other, but I thought the lack of an opt-out was odd given how prominently they mentioned it in the patch notes.

[Deddly]

Can you access the option in the settings menu? Should be a toggle 

[Cydonian Monk]

1 hour ago, Deddly said:

Can you access the option in the settings menu? Should be a toggle 

What's the option's name? I'll check when I get home. I don't remember seeing anything new related to this, but it's possible I overlooked it. 

[Lisias]

3 hours ago, Cydonian Monk said:

I wasn't provided with an option to opt-out on my clean v1.4.5 first boot either. I don't care one way or the other, but I thought the lack of an opt-out was odd given how prominently they mentioned it in the patch notes.

I think this is by design. The configuration is stored on the server side - so, no matter how many different KSP installments you have, all shave the same configuration.

[Deddly]

31 minutes ago, Cydonian Monk said:

What's the option's name? I'll check when I get home. I don't remember seeing anything new related to this, but it's possible I overlooked it. 

Sorry I don't remember and I have no way to check right now, either. Please be sure to share what you find when you get home

[Cydonian Monk]

56 minutes ago, Lisias said:

I think this is by design. The configuration is stored on the server side - so, no matter how many different KSP installments you have, all shave the same configuration.

What configuration? There's no part of my install of KSP or its local configuration that are stored server-side. 

If you mean the tracking and profile data they've previously collected, fine. That part makes sense and rather obviously has to be server-side. It should have nothing to do with my copy of KSP asking whether it can send _anything_ off to a random server though, which is what I expected the opt-out to be. (Such as how previous versions asked if you wanted to share your IP address.) Is that not the case?

[Lisias]

27 minutes ago, Cydonian Monk said:

What configuration? There's no part of my install of KSP or its local configuration that are stored server-side. 

If it's stored server-side, it's not local.

Check your KSP.log. You will find something like this:

[LOG 11:26:29.681] Loading data opt-out preferences from PlayerPrefs
[LOG 11:26:29.730] Requesting data opt-out preferences from https://data-optout-service.uca.cloud.unity3d.com/player/opt_out?app
id=XXXXXXXX-d29d-4faa-bb01-YYYYYYYYYYYY&userid=b5XXXXXX021e49fYYYYYYYYe01dea37&deviceid=XXXXXXXX-43F1-5FAC-A363-YYYYYYYYYYYY

 

33 minutes ago, Cydonian Monk said:

 It should have nothing to do with my copy of KSP asking whether it can send _anything_ off to a random server though, which is what I expected the opt-out to be.

It's not a random server. It's not even Squad's server. It's Unity server.

Moreover, it's a simple HTTP request made on the open. O made a simple wget on the URL, and got this:

--2018-08-17 18:18:26--  https://data-optout-service.uca.cloud.unity3d.com/player/opt_out?appid=xxxxxxxx-d29d-4faa-bb01-yyyyyyyyyyyy
Resolving data-optout-service.uca.cloud.unity3d.com (data-optout-service.uca.cloud.unity3d.com)... 50.18.192.203, 52.8.62.165
Connecting to data-optout-service.uca.cloud.unity3d.com (data-optout-service.uca.cloud.unity3d.com)|50.18.192.203|:443... connected.
HTTP request sent, awaiting response... 401 Unauthorized

Username/Password Authentication Failed.

SO… What we have:

• A HTTPS request with appid (KSP, for sure) and a userid and a deviceid is sent to Unity's server
• Such request is protected by password.

If you have a problem with any of this, I suggest put the server's IPs on a black list on your firewall. Other than that, there's very little one can do without doing precisely what Squad is being accused to.  ]]

 

52 minutes ago, Cydonian Monk said:

(Such as how previous versions asked if you wanted to share your IP address.) Is that not the case?

Well, we are not asked anymore if we want to share our IP. But since we are using it on the open, right here on the Forum (did you know that every time you load an image from, some random server logs your IP?), why it should be a problem on KSP?

Any information you would wanna to keep out from eyes they already have. You bought the game from Steam, GOG, from them directly of from any other dealer. When you did that, you already sent to them your name, address, CC number and IP (and don't complain about, the IP is logged as a security measure - if you challenge the transaction, they need to have such data). When you downloaded the game, your IP was recorded to protect themselves from fraud.

Your concerning about the matter is misguided, IMHO.

[Cydonian Monk]

59 minutes ago, Lisias said:

If it's stored server-side, it's not local. 

This does at least make sense for the Unity opt-out. I had no idea that was all handled on a remote server by the engine/organization and expected it to be on a per-game basis. 

I suppose it's not out of the realm of possibility that some other Unity game had already opted me out on my old PC, and so when the copy of v1.4.5 I had on said old PC provided the deviceid string it just went with the previous opt-out.

Doesn't particularly explain why I didn't see an "opt out" notice on a fresh install of a brand new version of KSP on a completely new piece of hardware with a completely clean OS. Basically all I had done by then was download Firefox and then use Firefox to download KSP.  Unless IP address is 100% of one of the keys Unity is using, which is a strange decision if true. 

Not that I like any of this, but it should at least work as advertised. 

 

[Lisias]

On 8/17/2018 at 8:03 PM, Cydonian Monk said:

This does at least make sense for the Unity opt-out. I had no idea that was all handled on a remote server by the engine/organization and expected it to be on a per-game basis. 

I suppose it's not out of the realm of possibility that some other Unity game had already opted me out on my old PC, and so when the copy of v1.4.5 I had on said old PC provided the deviceid string it just went with the previous opt-out.

Well, since the Unity log files are the same for every game on my machine, I concluded that only one Unity application is expected to run at the same time on one machine. So you rationale makes sense.

If an user don't want to be 'tracked' on a game, he/she probably don't want to be tracked on any other too.

 

On 8/17/2018 at 8:03 PM, Cydonian Monk said:

Not that I like any of this, but it should at least work as advertised. 

Well. It's correctly advertised (from the 1.4.5 Change Log)

Quote

* Add Unity Analytics dialog and link to the players Unity Privacy Data page for personal data opt-out management.

But.. Perhaps it was too much succinct for the non experts, you have a point here.

Since Squad is a "user" for this functionality (as it's something embedded on Unity, and not made by them), there's a chance that even they don't know exactly how this works. I'm kind of learning some Unity (due KSP), and I can tell you that not everything is clearly explained on the thing. (And some things that are, I think it's plain wrong - but whatever).

Edited August 19, 2018 by Lisias
ok, ok. bad English. Move on. :)

[cfds]

So KSP now asks if it may phone home by phoning home? That is like visiting someone at home to ask if one's restraining order is still in effect...

[sarbian]

Do you have concrete proof of what you are saying? Because I don't see any network trace in those posts. 

Edited August 20, 2018 by sarbian

[Sigma88]

On 8/16/2018 at 7:09 PM, Deddly said:

I got the option when I first booted up 1.4.5. Odd that you didn't. 

The only pop up I got redirected me to a generic unity site.

[Deddly]

6 hours ago, Sigma88 said:

The only pop up I got redirected me to a generic unity site.

That's the place where you opt out

[steve_v]

2 hours ago, Deddly said:

That's the place where you opt out

Right, so in order to opt out one has to submit a unique token to unity's servers, upon receipt of which (and subsequent clicks) they claim to stop collecting the data that KSP is obviously still sending...
Do I need to post a packet trace to show that the game is still connecting to Unity servers despite opting out, or is logic alone enough to point out the obvious flaw in this system?

Please provide an opt-out mechanism, or better yet an opt-in mechanism, that actually stops the application from sending data. I do mean any data, including my IP address, unique game identifier, and the fact that I have opted out.

I firewalled this application long ago, because I don't trust SQUAD as far as I can throw them. If this is the best "opt-out" they can come up with, and that only after quite some outcry, it was clearly the correct decision.

 

On 8/21/2018 at 1:24 AM, cfds said:

So KSP now asks if it may phone home by phoning home? That is like visiting someone at home to ask if one's restraining order is still in effect...

Why yes, yes it does. and it almost certainly transmits your game ID to see if it matches the opt-out list... So they still know who is playing, when, and where, at the very least. Hell, even simply pinging cloud.unity3d.com will tell them that.

@SQUAD Please stop phoning home. We've asked, we've complained, you're still doing it. Stop.
Even assuming the data you're sending is harmless, NO MEANS NO.

I can't see exactly what you're sending, and I shouldn't have to firewall your products to be sure you're not going behind my back.
You lost my trust in this matter some time ago by including redshell and removing the existing opt-out mechanism. The new one is a farce, and has done nothing whatsoever to regain it.
 

 

On 8/21/2018 at 3:36 AM, sarbian said:

Do you have concrete proof of what you are saying? Because I don't see any network trace in those posts. 

After opting-out, KSP is still attempting to connect to, in no particular order:
data-optout-service.uca.cloud.unity3d.com
us-west-1.elb.amazonaws.com
config.uca.cloud.unity3d.com
cdp.cloud.unity3d.com

I can tell you without doubt that packets are being exchanged with all of the above, but being tls1.2 I can't speculate as to their content.

Getting a connection to data-optout-service.uca.cloud.unity3d.com, and presumably an "opt-out" response, does not prevent it from connecting to the rest.
As the encrypted data transferred to cdp.cloud.unity3d.com is approximately the same size whether the opt-out service is reachable or not, I can only assume that opting out does not prevent data being transmitted.
Pretty liquid-poor effort if you ask me.

If you really want the whole trace, I assume you have a convenient mechanism to share for the decryption of these tls packets? Do you have concrete proof that KSP is not phoning home once you opt out?

Edited August 22, 2018 by steve_v

[sarbian]

2 hours ago, steve_v said:

If you really want the whole trace, I assume you have a convenient mechanism to share for the decryption of these tls packets? Do you have concrete proof that KSP is not phoning home once you opt out?

I did not say I had any proof. I said that if you want to complain you need to show some.

So I will (again...) post some trace of the traffic on an issue I do not care about anymore since they removed redshell and implemented the official Unity GDPR opt-out. But first let me remind you that the Unity opt-out is not a "never sand anything anywhere" but a "Dont' send private info in the analytics". If you want to see the difference then look at my previous capture and compare with the new one.

Capture from a KSP 1.4.5 with Unity Opt-out active. Response header removed because they don't provide anything useful. Response not included when it was empty.

First Unity checks if Analytics is active globally (I guess it's a kill switch on their side)

Request:
POST / HTTP/1.1
Host: config.uca.cloud.unity3d.com
User-Agent: UnityPlayer/2017.1.3p1 (UnityWebRequest/1.0, libcurl/7.51.0-DEV)
Accept-Encoding: identity
Accept: */*
Content-Type: application/json
X-Unity-Version: 2017.1.3p1
Content-Length: 355


Response:
{
	"prefs": {},
	"analytics": {
		"events": {
			"custom_event": {
				"max_event_per_hour": 350
			}
		},
		"enabled": true
	}
}

Then it checks the optout and analytics status for the game/device/user.

Request:
GET /player/opt_out?appid=39811e89-d29d-4faa-bb01-997f3cda24f0&userid=<hereismyuserid>&deviceid=<hereismydeviceid> HTTP/1.1
Host: data-optout-service.uca.cloud.unity3d.com
Accept: */*
Accept-Encoding: identity
User-Agent: UnityPlayer/2017.1.3p1 WindowsPlayer/2 DataPrivacyPlugin/1.0.1
Content-Type: application/x-www-form-urlencoded
X-Unity-Version: 2017.1.3p1

Response:
{
	"request": {
		"date": "2018-08-17T18:07:07Z"
	},
	"status": {
		"analyticsEnabled": true,
		"deviceStatsEnabled": true,
		"limitUserTracking": true,
		"performanceReportingEnabled": true,
		"optOut": true
	}
}

Then we have the events call

• I finished loading the first scene and it took forever

Request:
POST https://cdp.cloud.unity3d.com/v1/events HTTP/1.1
Host: cdp.cloud.unity3d.com
User-Agent: UnityPlayer/2017.1.3p1 (UnityWebRequest/1.0, libcurl/7.51.0-DEV)
Accept-Encoding: identity
Accept: */*
Content-Type: application/json
event_count: 4
data_block_id: c54d789f084d010e85de13913856c538
expired_session_dropped: 0
data_retry_count: 1
continuous_request: 1
X-Unity-Version: 2017.1.3p1
Content-Length: 861

{
	"common": {
		"appid": "39811e89-d29d-4faa-bb01-997f3cda24f0",
		"userid": "<stillmyuserid>",
		"sessionid": 3452760274898692909,
		"platform": "WindowsPlayer",
		"platformid": 2,
		"sdk_ver": "u2017.1.3p1",
		"localprojectid": "5be2ef0cdad9b1344ae103b0d475456b",
		"build_guid": "eba88140f461ac641a4d396bcab20931",
		"deviceid": "unknown"
	}
}{
	"type": "analytics.custom.v1",
	"msg": {
		"ts": 1534932065158,
		"name": "unity.sceneLoad",
		"custom_params": {
			"level_name": "ksploading",
			"level_num": 0,
			"total_levels": 18
		}
	}
}{
	"type": "perf.sceneLoadingTime.v1",
	"msg": {
		"ts": 1534932065166,
		"scene_name": "ksploading",
		"scene_index": 0,
		"background_time": 2415221760,
		"integrate_time": 1340646912,
		"ts_integrate_time": 52750280,
		"total_time": 3837266944
	}
}{
	"type": "analytics.appRunning.v1",
	"msg": {
		"ts": 1534932079004,
		"duration": 15,
		"local_time_offset": -3600000
	}
}{
	"type": "analytics.appStop.v1",
	"msg": {
		"ts": 1534932079005
	}
}

 

• Hey, it's me KSP

Request
POST https://cdp.cloud.unity3d.com/v1/events HTTP/1.1
Host: cdp.cloud.unity3d.com
User-Agent: UnityPlayer/2017.1.3p1 (UnityWebRequest/1.0, libcurl/7.51.0-DEV)
Accept-Encoding: identity
Accept: */*
Content-Type: application/json
event_count: 1
data_block_id: 10ea04242e3fdff2c2fde2c35ffa5003
expired_session_dropped: 0
data_retry_count: 1
continuous_request: 2
X-Unity-Version: 2017.1.3p1
Content-Length: 383

{
	"common": {
		"appid": "39811e89-d29d-4faa-bb01-997f3cda24f0",
		"userid": "<stillmyuserid>",
		"sessionid": 3452760274898692909,
		"platform": "WindowsPlayer",
		"platformid": 2,
		"sdk_ver": "u2017.1.3p1",
		"localprojectid": "5be2ef0cdad9b1344ae103b0d475456b",
		"build_guid": "eba88140f461ac641a4d396bcab20931",
		"deviceid": "unknown"
	}
}{
	"type": "analytics.appStart.v1",
	"msg": {
		"ts": 1534932375151
	}
}

 

• How much time was spent on scene so far

Request:
POST https://cdp.cloud.unity3d.com/v1/events HTTP/1.1
Host: cdp.cloud.unity3d.com
User-Agent: UnityPlayer/2017.1.3p1 (UnityWebRequest/1.0, libcurl/7.51.0-DEV)
Accept-Encoding: identity
Accept: */*
Content-Type: application/json
event_count: 1
data_block_id: 93a36dd065228301af6b9944a0a959e8
expired_session_dropped: 0
data_retry_count: 1
continuous_request: 3
X-Unity-Version: 2017.1.3p1
Content-Length: 462

{
	"common": {
		"appid": "39811e89-d29d-4faa-bb01-997f3cda24f0",
		"userid": "<stillmyuserid>",
		"sessionid": 3452760274898692909,
		"platform": "WindowsPlayer",
		"platformid": 2,
		"sdk_ver": "u2017.1.3p1",
		"localprojectid": "5be2ef0cdad9b1344ae103b0d475456b",
		"build_guid": "eba88140f461ac641a4d396bcab20931",
		"deviceid": "unknown"
	}
}{
	"type": "perf.startupTime.v1",
	"msg": {
		"ts": 1534932373298,
		"gfx_done": 197202,
		"first_scene": 233614,
		"scene_init": 2589251,
		"scene_done": 3792520
	}
}

 

Now if you compare to my previous capture you ll see that a few less things are sent. The analytics still runs but now they comply with the GDPR.

And of course if you do not want Squad or Unity to know ANYTHING about you then you should block the game traffic with a firewall. And not post on the forum.

 

Edit: no idea of the source of your amazonaws. I did not get any sent by the KSP process.

Edited August 22, 2018 by sarbian

[klesh]

17 hours ago, Sigma88 said:

The only pop up I got redirected me to a generic unity site.

 

10 hours ago, Deddly said:

That's the place where you opt out

 

 

Could you guys explain how that goes?  I posted this in the support forum, and it went absolutely nowhere.   I still dont know how to opt out.

 

[Deddly]

@klesh Did you maybe already block it in your firewall? Just going for the obvious choice first

[klesh]

Just now, Deddly said:

@klesh Did you maybe already block it in your firewall? Just going for the obvious choice first

We can take the specific discussion of it to the other thread so as to not derail this one if you like.  No, I haven't blocked it via firewall, but I'm past that now.

At this point having been given the address that that link is supposed to go to, going to it and finding nothing about opting opting out of KSP data collection, I am more concerned with how to navigate the Unity portal Squad has told us to go to to opt out. 

To be honest, I'm taking a break from all videogames at present, so it's not high on my motivational list anyway. I just wanted to chime in on my lunchbreak about how the "opt out from analytics" thing is less than user-friendly, even when you get to the portal thing Squad intends you to be at.

[steve_v]

10 hours ago, sarbian said:

the Unity opt-out is not a "never sand anything anywhere" but a "Dont' send private info in the analytics".

So opting out of analytics doesn't actually opt out of analytics...Which was my complaint in the first place.
I stand by my earlier "firewalling KSP was the correct choice".

[Fwiffo]

@sarbian Thanks for those informative captures.  Could you confirm removing UnityEngine.Analytics.dll prevents any sort of call-home activity?  I'd prefer just doing that than managing yet another firewall rule.  (Also I do have some mods that like to access other non cloud.unity3d.com sites)

[sarbian]

4 hours ago, Fwiffo said:

@sarbian Thanks for those informative captures.  Could you confirm removing UnityEngine.Analytics.dll prevents any sort of call-home activity?  I'd prefer just doing that than managing yet another firewall rule.  (Also I do have some mods that like to access other non cloud.unity3d.com sites)

No, it does not. The Unity RGPD update for Analytics is distributed as an asset so the code is merged with the game code. 

The easiest way to block only those is to edit your hosts file ( on Windows c:\Windows\System32\Drivers\etc\hosts ) and add something like

127.0.0.1 cdp.cloud.unity3d.com
127.0.0.1 config.uca.cloud.unity3d.com
127.0.0.1 data-optout-service.uca.cloud.unity3d.com