LoppyDaCutie: I'm sure that the random Russian web host that has the ability to ignore consequences will listen when the FTC sends them a stern letter saying "please stop." Lol.

The ripper sites will never go away - they are al hosted in countries where copyright is not followed and foreign laws from the USA don't matter.

Curious Cryptogenic: it was taken down by the ftc a few days ago

Now there using a forum to do there stuff

IzzySpyderr: Encryption can't work when every user must be able to decrypt the avatar to see it anyways. Someone will just crack it on first day and release the tool.

GotoFinal: Could generate a unique key for encryption for each user/avatar/world. IE.) Per User generates a key for each users uploaded Avatars/Worlds etc.

Also adding encryption gives us a leg up against rippers. Since they're really only running an external program to rip the avatars, if they need to datamine or right a program that will bruteforce an encryption key they're tampering with VRChat's licensed security protocol for malicious benefit. That's at least worth a DMCA takedown, since may people upload otherwise copyrighted content and some upload original works. If you had to take down the rippers for original works, you can't DMCA them for violating someone else's Intellectual Property, whether they own the assets on the avatar or not (going for VRC as a whole as well as individual creators)

IzzySpyderr: ??? That changes nothing, still person sees you, need to decrypt the avatar, gets the key, and done.

And rippers already mess with stuff they are not supposed to, didnt stop anything. And when you upload your avatar to vrchat there is a checkbox about giving vrchat rights to your work, so they can DMCA all they want.

GotoFinal: VRChat makes ripping trivially easy by writing the avatar/world files directly to disk without any kind of protection. All the ripper needs to do is copy the files from cache and use an Unity extractor.

No need for modded VRChat client. No need to steal the encryption keys. Just a simply copy&paste the file...

I understand that security measures might be eventually be broken. But that's no excuse have zero security measures at all.

Yoyobuae: no, thats exacly the reason to not bother, because what will you gain? 1? maybe 7 days of protection if you are lucky? and then the guide on some random discord will just change the wording from "copy files from this folder" to "drag and drop the files from this folder to this app" changing nothing... Well not nothing, all the normal users will pay for it, with longer avatar loading times.

Thats why this canny is actually good, as it wants something actually usefull to stop and ban these people, just easier way to report and track it - as vrchat is really lacking here, some people don't even extract the avatars, they just reupload them as they are. So thats something to fix and make it easier to report it.

GotoFinal: Said app would need to have the decryption key. If the decryption key is always the same, then obviously it would be trivial to extract it and redistribute.

So the next step is to make the decryption key dynamic and unique per each VRChat user account. So now the ripper needs to get the decryption key for their specific VRChat cache.

Then make it so that the decryption key is also specific per each asset stored in the cache. And obviously clear the decryption key from memory as soon as it's no longer needed.

At that point the ripper will need to have a program running while VRChat is loading the asset, and that program will need to spy on VRChat's memory to catch the decryption key on the fly.

Then EAC can be used for something actually productive and catch said program trying to spy on VRChat's memory. Then perma-bans should be administered to said players.

Is this solution perfectly secure? Well, no. No solution will every be 100% secure. But it does raise the bar for ripping assets and thus discourage the low effort rippers from even trying.

Yoyobuae: But it still takes one person to crack it to allow everyone to use it, and I don't think any anticheats stopped people from ripping stuff just directly from memory/gpu then in other games.

> Then make it so that the decryption key is also specific per each asset stored in the cache.

key must be decided on creation of asset, so on avatar upload, and stored somewhere to allow users to actually receive this key to view the avatar. So people could probably just request for this key, at best with limitation that it only works when in the instance with someone using this avatar. So does not seems like too much issue to just get it anyways, no need to spy on the memory, just get it in the same way the client does.

And the load times will be hurt for no reason

xxx_red_xxx: Sounds good on paper. But for manual review that requires manpower that VRChat at least at the moment dosent possess. I still agree somthing needs to be done though.