Apple pulls Facebook enterprise certificate

Meta blows safety bubble around users after reports of sexual harassment

There’s trouble brewing in the Metaverse, but the trouble isn’t a particularly new problem. In fact, it’s been an issue for years – and so have many of the solutions. Strangely, Meta is having to play catch-up where some basic security and safety settings are concerned in the virtual realm.

At Malwarebytes Labs, we’ve kept an eye on many areas for concern in the VR realm. We’ve dug into the possibilities of ad network compromise, and explored the not very successful attemptsat ad trials in paid-for VR games. We’ve also looked at the risks of placing your entire home into a virtual space. There’s even been the occasional data leak. Unfortunately, this barely scratches the surface.

Scaling up harassment

One of the biggest, most pressing issues in VR spaces has always been that of sexual harassment and abuse. VR platforms have come and gone through the years, and many had security settings to prevent abuse from happening. The absence of these options for users can result in genuinely unpleasant scenarios (fair warning, some of the descriptions hereare horrifying).

Where a lack of settings exists, and where existent settings are hard to find, horrible behaviour rushes in to fill the vacuum. Many people struggle to find certain options on a plain old Windows desktop. In VR, many settings are available outside of the helmet. That is to say, you may only be able to set things to your liking on a website or portal. If you can’t even get that far, you’re going to be stuck with defaults which may not be very optimal.

Speaking of which…

After what appear to be several reports of sexual harassment of various kinds in the Metaverse, Meta is enabling a “bubble shield”/personal boundaryas a default for users to help avoid troublesome individuals. From the announcement:

Personal Boundary will begin rolling out today everywhere inside of Horizon Worlds and Horizon Venues, and will by default make it feel like there is an almost 4-foot distance between your avatar and others…If someone tries to enter your Personal Boundary, the system will halt their forward movement as they reach the boundary. You won’t feel it—there is no haptic feedback. This builds upon our existing hand harassment measures that were already in place, where an avatar’s hands would disappear if they encroached upon someone’s personal space.

How do people harass other users in VR spaces?

First off, some basics. You’ll notice that Meta avatars don’t have legs or hips. This isn’t uncommon in VR. A combination of small play areas, no sensors on legs/feet, and difficulties in animation mean it’s often easier to leave the legs out of it. An additional (very helpful) consequence of this is that it’s harder for awful people to get up to no good in VR. They can’t run up and grind or hip-thrust or anything else if they’ve nothing to grind or hip-thrust with.

However: there are many more ways people can be awful whether digital lower halves are present or not. Here’s some of the things developers do to prevent bad happenings:

  • Fade out arms and/or hands should you get too close to other users. This prevents groping and pawing.
  • Fade out bodies generally if you get too close.
  • Fade out digital representations of your controller stick or wand.
  • Allow users to “push” back others if they get too close. This one isn’t always optimal, as it can be used for trolling itself depending on how things are set up. Want to Jedi force-push someone into a wall or off a cliff? A badly configured push setting is how you do it.
  • Emergency teleport, alongside easy to access blocking/reporting features round off some of the most common tools in the “stop bad people” toolkit.

Perhaps somewhat oddly, Meta is only nowmaking a bubble a default setting. It seems an odd oversight for something so essential to VR spaces to have been lost in the mix. Meta may mention that it’s looking to “set new norms in social VR”, but attempting to set those norms is nothing new. Just to give one example: here’s Playstation’s Rec Room doing much the same thingback in 2017. 

How do bubbles work?

We’ve read the Meta description of how itsbubble operates. How do others do it?They tend to take several aspects of the above bullet points and roll them into one. A field is placed around the individual, and anyone trying to enter it fades into non-existence. Smart programmers don’t make the bubble a solid if invisible object. This is because they end up used as dodgem cars and you’re back to Jedi style force pushes, minus the force push.

According to reports, Meta’s bubble isn’t configurable at time of writing. Some platforms allow users to define the size and/or shape, making it larger or smaller (or even turning it off) as desired. It’s probable that Meta will allow more customisation in the near future.

All the same, Meta definitely didn’t need a raft of assault themed news stories as it tries to promote the benefits of its Metaverse. VR has always been somewhat niche, and negative perceptions via easily preventable bad actions may not help with the general uptake.

Haptic headaches may be round the corner…

You may have seen the “haptic” reference up above, and wondered what it is. When you use a touch screen and it vibrates, when you get hit in a video game and your controller rumbles, that’s haptic feedback. The artificial replication of touch is what it’s all about. Haptic sensations are one of the big future goals of VR. Meta is trialling haptic glove prototypes.

Can you imagine the problems in VR realms that haptic sensations will bring as a result of weak or absent safety settings? It’s absolutely crucial that major players in the virtual space have all their headset safety ducks in a row before adding to the sensory overload that is VR. Anything less than that is probably going to end badly for all concerned.


Christopher Boyd

Former Director of Research at FaceTime Security Labs. He has a very particular set of skills. Skills that make him a nightmare for threats like you.