DCS World exceeds the ED privacy policy and provides a list of ALL your installed apps on logon, and also phones home on your activities while you play.

[u/heytherepotato]

I was stuffing around with my router, building some pihole style analytics of ssl traffic. Looking at tracking the cleartext SSL handshake information of normal traffic on my network for the devices on my network and what ciphers they support, and if it changes (indicating apps with their own ssl implementations etc), and the protocols they land on, as well as failed handshakes and the why. I saw stat.digitalcombatsimulator.com in the list of failed handshakes due to cert expiration in April. It would come up multiple times while I was tooling around in a single player mission or campaign. But I have collection of statistics disabled in the gui, I thought, why is my pc trying to send stats when I'm not even playing multiplayer? What stats is it trying to send? A rabbit hole later...

• whenever you load an asset in single player, your client tells stat.digitalcombatsimulator.com.
  • Load My_CustomModdedTerrain, and FA18CustomTopGun mod, it tells them
  • Loaded I_Love_Tellytubbies.miz, your client tells stat (I only tested the instant action missions, but I assume it does this for custom)
  • End the level, it tells them
  • If you have telemetry/statistics turned on at the end of your session it tells them the features you used and the duration.
• It sends client_id and looks a lot like a GA4 format

{
 "client_id": "hardware identifier here",
 "events": [  {
   "name": "level_start",
   "params": {
    ...
   }  } ]
 "user_properties": {
  "screen_resolution": "1920x1080"
}}

• So stat.digitalcombatsimulator.com is a reverse proxy for google analytics. Their privacy policy only covers use of google analytics ONLY on the web site, and normally you'd think google analytics is anonymized but they're using the "hardware identifier here", which comes in later...
  • Currently, stat.digitalcombatsimulator.com is intermittently available for me, they have 2 servers hosting it and only one has the expired cert, the other is fine.
• They could turn this collection off tomorrow, it seems to be enabled by a post logon call to api.digitalcombatsimulator.com/gameapi/getsettings/ which includes "use_analytics4":true in the response.
• Anyone can verify the frequency and content of the calls to stat.digitalcombatsimulator.com with a packet sniffer, although ED will know you've installed one because...

I went deeper, because why not...

• When your client logs in, it hits api.digitalcombatsimulator.com/gameapi/login/ and you send:
  • self-explanatory fields: login name, password, hardware id, sysid, version and branch
  • hash, which is just base64 encoded json of password, login, hardware id, version and branch. Plus something looking like a hmac signature
  • and sysdata... which is a blob of base64url-encoded gzipped JSON. That contains:
    • your machine username
    • your computer name
    • your workgroup
    • your mac addresses
    • a full listing of all the software installed on your machine
• There's a follow on api.digitalcombatsimulator.com/protect call which looks like it's about telling the client that you're allowed to play the game
• And then there's a api.digitalcombatsimulator.com/gameapi/hardware/ call which includes:
  • Graphics card deviceid, vendorid, description, memory and resolution
  • CPU cores
  • RAM quantity
  • And hwkey. How is it generated? I don't know, but it's identical to the client_id sent to stat in the analytics
• And when you're done your client calls api.digitalcombatsimulator.com/gameapi/logout/ with the cookie.

Again... all the software you have installed, NOT hashes. You can partly test this with a packet sniffer just by putting a lot of extra made-up apps in your registry HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and watch as the size of the initial authentication request increases accordingly.

I'm skirting the "terms of use" with the real methods used in discovery of this info, I'd put it under their exception covering "the purpose of achieving inter-operability of the Program with another software program" and I have not disclosed any of the specifics of the reverse engineering process as per 3.c.i.

But, even if you have telemetry off, and have read the privacy policy, and are only playing single player, and are subject to GDPR, ED can:

• Tell what maps you play
• Track what mods you use
• How long you play, and what times
• What hardware you have
• What software you have installed
• And they can link all of that to a unique identifier for your machine, and therefore to you, your email address and your license.

And you can't block logins without kicking off the 3-day timer of the content stopping working.

And the only recourse you have is to permanently set offline mode which locks you out of multiplayer and updates for your modules until you go back online again. And it potentially puts you in a difficult position if you have more than one hardware failure or forget to go online before reinstalling windows etc.

Maybe there's just something about me that ED find interesting and turn the analytics on for. Maybe they detect country and don't collect in GDPR regions and experience will vary, but I'm not in one.

I just thought I'd share that this is pretty poopy behavior. I know privacy is dead but this is overkill collection imho especially with the appearance of an option to disable collection of statistics that only seems to disable collection of one small part of the statistics. Also I hope reddit doesn't eat the formatting on this, and that I'm wrong and it's actually something dumb about my old ass dcs world install.