Sunnie Sunday
@echo-unvaulted.net
Weekly report of characters verified as EchoVault users, including documentation of Echo's data structure and API.
It's harder to tell from decompiled code and just one of the many reasons to advocate for a public open source repository. Former stalker plugins have used AI in the past but all I can say is that EchoVault isn't secured against silly cats poking at it.
August 22, 2026 at 3:36 PM
It's harder to tell from decompiled code and just one of the many reasons to advocate for a public open source repository. Former stalker plugins have used AI in the past but all I can say is that EchoVault isn't secured against silly cats poking at it.
Playing devil's advocate I do gather a subset of what EchoVault would (without Account IDs) to catch them and that "ick" is a reasonable reaction. That said these few confirmed users are leaking sightings of their friends list, FC members and everyone near like clockwork. They have a right to know.
August 22, 2026 at 2:12 PM
Playing devil's advocate I do gather a subset of what EchoVault would (without Account IDs) to catch them and that "ick" is a reasonable reaction. That said these few confirmed users are leaking sightings of their friends list, FC members and everyone near like clockwork. They have a right to know.
Reposted by Sunnie Sunday
After reviewing the write up as best I can with a migraine, I have some follow-up questions:
Some of these accounts only have claim codes, a takedown code, or no code in their Lodestone. How did you verify these profiles are scrapers and not random?
Some of these accounts only have claim codes, a takedown code, or no code in their Lodestone. How did you verify these profiles are scrapers and not random?
August 18, 2026 at 1:00 PM
After reviewing the write up as best I can with a migraine, I have some follow-up questions:
Some of these accounts only have claim codes, a takedown code, or no code in their Lodestone. How did you verify these profiles are scrapers and not random?
Some of these accounts only have claim codes, a takedown code, or no code in their Lodestone. How did you verify these profiles are scrapers and not random?
Poisoning was my first intent. Over time I became uncomfortable with this because it requires caching and sending lots of legitimate character data with only a few things altered (or it won't be accepted). But yes it can be done with fake Account IDs.
August 18, 2026 at 4:50 PM
Poisoning was my first intent. Over time I became uncomfortable with this because it requires caching and sending lots of legitimate character data with only a few things altered (or it won't be accepted). But yes it can be done with fake Account IDs.
Some users who left their claim or takedown codes can be found on Google. Of those I've audited that way less than 10% were verified users (meaning over 90% just wants to opt-out of the website).
August 18, 2026 at 4:43 PM
Some users who left their claim or takedown codes can be found on Google. Of those I've audited that way less than 10% were verified users (meaning over 90% just wants to opt-out of the website).
What I look for isn't the codes. I start the verification process as them with Echo's API as you can see from the HTTP logs on each character's entry. If someone *only* did the claim process, they will not trigger an "already_claimed" response on the "/v1/auth/verify/start" endpoint.
August 18, 2026 at 4:33 PM
What I look for isn't the codes. I start the verification process as them with Echo's API as you can see from the HTTP logs on each character's entry. If someone *only* did the claim process, they will not trigger an "already_claimed" response on the "/v1/auth/verify/start" endpoint.
Just to add context: while we obviously don't have the server's code it can be implied that it compares where the reporter is in relation to it's sighting. The coordinates for both are sent.
August 17, 2026 at 8:47 PM
Just to add context: while we obviously don't have the server's code it can be implied that it compares where the reporter is in relation to it's sighting. The coordinates for both are sent.
The data structure you see is from the latest version (v0.8.3) so yes. I didn't notice anything being removed since it launched...
August 17, 2026 at 8:39 PM
The data structure you see is from the latest version (v0.8.3) so yes. I didn't notice anything being removed since it launched...
You are right, EchoVault's website is extremely dishonest on what it actually collects. To better understand what it does and the policies it violates, see echo-unvaulted.net/docs/index.h...
August 17, 2026 at 8:14 PM
You are right, EchoVault's website is extremely dishonest on what it actually collects. To better understand what it does and the policies it violates, see echo-unvaulted.net/docs/index.h...