1400 Second Life Recorded Keys

Bahahaha, I think he actually did it.

Gaaah. I was assuming that LL would have encrypted it with a custom SSL algorithm.

Oh well, now that I know its doable I'm sure I can figure it out .. heh!

Still, this really makes me think about the mind of Philip. Is he really fucking with us or what?

Leaving the protocol open means they had to assume someone would figure it out.

Sometimes you feel like a rat in a maze with cheese placed strategically slowly directing you to the exit.

Got it! Thanks!

I'll be back in a few hours ...

~Ulrika~

I don't get it.

I'm not as smartz as uz peplz.

Hehe, "an avatar looking exactly like you", I never thought of that but that'd be the most excellent way to handle shady business. If you could hide names atleast. You'd never know who really was doing the dealings. "He looked exactly like me officer!" Kinda got a Tyler Durden thing going on there.

I'll put together a web page that will convert name.cache files and allow people to download the submissions of other translated files in a compressed file tonight.

All it takes to convert the name.cache keys into valid keys is this, shown here in perl:

$key =~ tr/0123456789abcdef/32107654ba98fedc/;

One simply has to translate the number "0" into the number "3", the number "1" into the number "2", and so on. It looks like the obfuscated numbers are simply a 16-bit little-endian version of the original (or so I'm told).

Send me your name.cache files by email (Ulrika.Zugzwang@gmail dot com) and I'll do it for you tonight. I've already received a few. Thanks!

~Ulrika~

No, little endian is a bit reversal.

It's an xor mask between each byte and 3, or 0011

Yes. You're right.

I did some reading up on cryptography and apparently this method of obfuscation is known as a simple substitution monoalphabetic cipher. The substitution alphabet is simply formed by reversing the order of a set of four characters four times. From a mathematical standpoint it's an xor between each byte and 3 or 0011 (I haven't verified this but I believe you).

With this knowledge and our named.cache files, we can now create a free Name2Key service online! I'll donate the bandwith, if you donate your name.cache files.

~Ulrika~

ursj. ytir. niy yjod eo;; s;esud nr ,u gsbptoyr dindyoyiopm go;yrt/

fpm
y npyjrt yr;;omh ,r yjsy o ,sfr s ;py pg d[r;;omh ,odyslrd jrtr. yjpihj/ vsidr o fof smf trs;;u. o fpmy
vstr/

Progress on this?

I got distracted by my other project and forgot to ask to have the code copied over. It will be online tonight.

~Ulrika~

OK! The beta version of the web tool is complete. I've entered in all of the name.cache files that folks have sent me, yielding a database file with 1199 unique name-key pairs. If you can spare the time, please submit your name.cache file and contribute to the free name2key database.

You heard me. Submit your name.cache files!

Let me know if you find any problems with the webpage. This one was thrown together rather quickly. Also, the archive of the database only updates daily. I'll change this later when I have more time.

You can visit the page here.

~Ulrika~

I just put in 150,000 bytes of name.cache files, that should help a bit. I wonderd if I would ever find a use for them, now I have.

What determines if names are stored in the name.cache file? It is not simple proximity. Does one have to see their chat, or would it result from use of a script command involving the key, or do you have to touch them or something they made, or what?

If we know what makes the names appear in the name.cache file we can pull them in faster.

Then again, maybe the name.cache is scrambled for the same reason that we lack llName2Key() function?

It's those of you who will memorize the keys that really concern me.

From experimenting I've discovered some ways to make certain that a name/key entry is enterred into the name.cache file (note that from what I've observed, the entries don't always appear in the file until after the SL app is quit).

The first way is to simply hover the mouse pointer over an object so the owners name is retrieved.

The second, and more comprehensive means of gathering keys in the name.cache file is through the Profile window. For some reason, the profile in the Find->People tab is not sufficient for retrieving the key, you must actually pull up the profile in a separate window. To do this quickly, click "Instant Message..." at the bottom of the Profile tab, then click "Profile..." in the instant message window.

Using the second method you can systematically harvest all the keys for a single surname quickly by searching for that surname in Find->People and performing these steps for each name in the list.

If somebody was to write a macro that used a list of valid last names along with automating the clicking process, a comprehensive list of keys could easily be obtained/kept up to date without the use of in world sensors.

So if Ushuaia is correct, those who wish could split up the task, picking different ranges of names, then entering the name.cache files into Ulrika's database maker, and getting a copy for our own use.

Not that I have any use for them.

Couldn't you get one heck of a lot more keys just by flying around with a sensor attached and calling llDetectedOwner on every object, llGetLandOwnerAt on every parcel, llDetectedKey on every agent...?
Bonus points for the first self replicating invisible cube system

I don't think so. Going through Find->People would find every single agent's key regardless of whether they own land, rez objects, or even log in.

Absolutely! If anyone decides to do this, send me the list and I'll add it to the database. If you'd like, I can even create an email address where your script could email the results as it or you travels. Ambitious coders, feel free to contact me.

There are now 4794 entries to the database. Up by a factor of four in less than a day.

~Ulrika~

The cached_mute file appears to have the same disguised keys. Disguised keys and names appear when you mute. The file does not have the additional number included. Muting people and unmuting them is easy to do.

This is how the entry in the cached_mute files appear:
5451aaa5-854c-faae-cd1c-b4cd730e6434 SuezanneC Baskerville|

Note the pipe character at the end.

Funny how concerns of "privacy" tend to be written off by many as "hysteria".

Hey, my address is free to anybody that walks by my building. There's no such thing as a private address, insofar as the info is concerned. There's the name of my street, you know what town/state/zip that street is in, and the number of my building is right on the front. You don't even have to know my name, you can just use "Resident" (which should be BANNED by the USPO)...exactly as you can just use a key and not have to know the users name (even though you can in fact do that too of course).

So, you walk up and down my block, get the addresses, and build a list.

Then you sell it, or give it away. What do you THINK is going to get done with it? How are you ensuring that people on this list never, ever get spam, or offers, of whatever the hell else people that tend to be interested in such compilations do?

Nah man, this is no better than any spam collection list. Saying, "we just compile it, we don't defend, or endorse, any actions involving the use of it" is irresponsible. There's laws about the use of such compilations in RL, there should be laws against it in SL.

Not like this is even original. People have been key gathering forever in SL. But this is the first time I've ever seen somebody so obviously set themselves up for trouble by marketing it (even if it's free).

If I'm on that list, take me off. Somebody wants to ask me for the info, or get it on their own (i.e. by writing it down in their notepad as they walk up and down my block), well, there's not much I can do about that. But I don't want it given away on a list. Period. It may not do any good, but if I find my info on that list I'm going to report it and demand LL force you to retract it. I'm fairly sure that publishing this info could be termed as a privacy violation if they do truly interpret their rules as they say, "in the broadest sense" (even though that term is way unevenly applied by LL, it should actually read, "according to our interpretation at that given moment in time."

I may not "own" it. But I should have some say over where it's published.

EDIT: OMG I just visited the site. It is branded as VENDOR SERVICES!!! So the target group for this is vendors. The intent being that vendors are supplied an easy list to get names and keys. You don't need to have a Master's in Business to know what this all adds up to.

Spam.

Oh and let's not forget the following stated "purpose"...

To decrypt and store name.cache files.

Is that something you're supposed to be doing? I'd have to say this is an unintended, and likely forbidden, use of the SL client software. Perhaps LL should respond.

I have a C++ script which goes through the entire SL database and clicks on everyone's name and then goes instant message -> profile.

If anyone wants to run this through the entire SL database IM me and I'll give you a copy.

It takes about 23 minutes per last name.

Aahah.

Ulrika, you truly rock!

I just uploaded a 1000 or so keys (mostly lindens

I have a program which can automatically grab the rest of the keys, but I'd rather not run the whole thing from my one machine because of bandwidth consumption and what not.

If I can get a few volunteers then we could spread it out amongst them?

Let me know.

I think you may have missed the intention of the site that is troubling you: it was designed to thwart those who would sell your key for L$. You are right, you don't own it, but as it is in one-to-one correspondence with your AV name, and provides no additional information about you it could be considered a mere "alias" for your name.

And following your RL anaalogy, if I had your postal address, I could sell it to whomever I please to help ensure that you get your fair portion of the 5 billion+ credit card offers mailed in the US each year. The USPS does not reconize your "right" to privacy of your street address, indeed, they give bulk mailers increasingly favorable rates. Regardless, there still are no reported SL key spammings, so let's punish the crime (should it happen) and not the means by which a ToS violation *might* be committed. This argument parallels the one about hobbling llPushObject in order to nerf guns.

A quick glance at the names doesn't appear to show any names that start with non-alphabetic characters. i.e. numbers or punctuation marks

Do a search on "1" in the people finder.

Not sure if you can still do this, though..

Generally my algorithm is going "a spinnaker" "b spinnaker" "c spinnaker" etc