By Lilly Schramm in KittyScan —

Admins, protect the privacy of your players!

By default, Minecraft servers publish a sample of their currently online players through their Status Response which is shown by the client when hovering over the player count field in the multiplayer menu.

Screenshot of the minecraft multiplayer menu. The player count is being hovered and shows "Lillychan_"
The player name, visible in the Minecraft client

Since this Status is given out to everyone who requests it, without prior authentication or authorization, server scanners like KittyScan can easily use this information to track players.

With the extreme amount of data server scanners accumulate that itself does not pose an issue. It does however allow for targeted stalking. Just knowing someones username allows for the creation of specific profiles, such as with whom someone is playing regularly, their usual playtimes, and many other details which can be extrapolated surrounding factors.

Since 1.18 players can decide to hide themselves from this sample.

By setting the Allow Server Listings toggle in Options > Online to off all servers this player joins are instructed to redact their username from the player sample.

By default, this is done by sending the username Anonymous Player combined with the UUID 00000000-0000-0000-0000-000000000000 instead of the real information.

Screenshot of the minecraft multiplayer menu. The player count is being hovered and shows "Anonymous Player"
The player name, redacted to "Anonymous Player" in the Minecraft client

This does not prevent anyone from joining a public server and just saving the player list, this would however be noticeable since it requires a bot to be on the server itself.

Since this setting is enabled by default and the client itself does not give any indication that this player sample exists, I fear that many players, who would prefer not being trackable this way, still are.

This is where server admins come in. Also since 1.18 the hide-online-players has been added to the vanilla server.properties file. Setting this to true will fully remove the player sample.

Since enabling this setting does no harm in any way other than removing that niche hover in the multiplayer menu, which I'd wager most people aren't even aware of, I highly recommend all admins to enable it. Especially if you run a community for commonly targeted or otherwise vulnerable groups. (LGBTQ+, your kids, ...)

As a general solution I'd like to petition this setting to be on by default, or to remove the player sample completely.