Support NeoGAF

[DJ_Lae]

Can view my own account again - glad I (somewhat randomly) removed my credit card and address from there a while back. Only had Paypal and the last digits of my phone...which is still annoying enough.

Unlinked Paypal either way.

 

[Wallach]

Whatever, I'm gonna go play Grim Dawn. If you get my phone number call me and let me know I guess.

 

[Data West]

Not in the US and Canada they're not. Everyone on Steam agreed to binding arbitration and a class-action waiver. They ain't getting sued by shit. Read your subscriber agreement.

TOS aren't legally binding

 

[NoblesseOblige]

What's up with people so invested in running damage control on Valve's behalf

Someone's got to. Valve sure ain't doing it themselves.

 

[Savitar]

Everything is back to normal it seems.

 

[SirBaron]

What's up with people so invested in running damage control on Valve's behalf

Why is there so many people invested in doing the opposite?

 

[Frodo]

Urgh...

It says my log in username or password are incorrect.


I'm already dead, aren't I?

 

[Gaz_RB]

Our accounts with thousands upon thousands of dollars of games and our personal information and payment information could have been compromised. Gee, I don't know why...

But that's not really the case from what I understand. It's just name, address, phone number, last four digits of CC, right? No passwords or usernames? You don't need to be scared about your games.

 

[butzopower]

What's up with people so invested in running damage control on Valve's behalf

I don't really see anyone defending Valve, I see people trying to assess the situation and not flying off the rails and reporting their credit cards stolen like some people did.

 

[Toad King]

Not in the US and Canada they're not. Everyone on Steam agreed to binding arbitration and a class-action waiver. They ain't getting sued by shit. Read your subscriber agreement.

Tell that to Sony: https://psnsoesettlement.com/english/

 

[Enter the Dragon Punch]

Ok, posted a few pages back, but maybe someone can settle my stomach. I'm seeing a pending transaction on my bank account for Target.com. It's for the amount that I paid to pre-order Dishonored 2. I'm not sure if this pending transaction is for that pre-order that won't come out for months, or if it's someone that stole my card info. Supposedly no one is able to get all the credit card info from this fuck-up right? I'll probably be calling the bank to be sure.

it's either dishonored or target fucking up. as far as we know, no one actually got full on credit card numbers... but i'm still watching like a fucking hawk on my credit account anyways.

 

[Crimsonclaw111]

I have an old phone number linked on my account page, how do I remove it and add my current phone if I don't have access to the old one?

 

[Macrotus]

I'm more worried about my phone number and email address becoming flooded with shit.

As well as some of our full addresses being fully exposed....

 

[LiquidMetal14]

BALVE LOVES US

 

[Smash88]

Whatever, I'm gonna go play Grim Dawn. If you get my phone number call me and let me know I guess.

You want Dominos or Pizza Hut tonight? I'll get it setup.

 

[Wanderer5]

Well the 10 cent in my steam wallet is gone. Not that I would be sad over that, but well means someone definitely saw the info I had there.

Nothing odd in order history or email through.

 

[AnathemicOne]

Okay my account is safe, I had no balance in my account but I did have my credit card linked. Purchase History says no recent purchases I'm unaware of.

 

[AxeMan]

Not in the US and Canada they're not. Everyone on Steam agreed to binding arbitration and a class-action waiver. They ain't getting sued by shit. Read your subscriber agreement.

You can't agree to something that is against the law (at least in Australia)
So they can put whatever they want in it, doesn't mean it's enforceable

 

[snack]

Urgh...

It says my log in username or password are incorrect.


I'm already dead, aren't I?

Same...

 

[Steel]

But that's not really the case from what I understand. It's just name, address, phone number, last four digits of CC, right? No passwords or usernames? You don't need to be scared about your games.

Username and password length were totally out there. Plus if an account didn't have steam guard, it could be worse.

 

[BreezyLimbo]

What's the deal with not visiting steam store pages? Part of the problem?

And I guess I should change my password...should I change my pass now @-@

 

[IcyStorm]

But that's not really the case from what I understand. It's just name, address, phone number, last four digits of CC, right? No passwords or usernames? You don't need to be scared about your games.

I'd rather my user/pw be exposed than my name and full address...

 

[BY2K]

Is it back?

 

[fluffydelusions]

Working here!

 

[Femmeworth]

I bought something earlier. Oh dear. D:

 

[Lautaro]

Mmm, now I can see my real account page... that delete buttons for my cc looks very tempting, I don't know...

EDIT: mmm, I can't edit the cc, I don't know about deleting it...

 

[cartographer]

Why is there so many people invested in doing the opposite?

You mean why are people concerned about a significant security breach involving the personal info of customers?

Do you need someone to answer that for you?

 

[TC McQueen]

But that's not really the case from what I understand. It's just name, address, phone number, right? No passwords or usernames? You don't need to be scared about your games.

That bolded stuff is way more fucking important than access to the games.

 

[bobawesome]

What's up with people so invested in running damage control on Valve's behalf

I wouldn't be surprised if this whole thing just blows over. Valve seems nearly impervious to mainstream online outrage despite a number of bad decisions they've made.

Why is there so many people invested in doing the opposite?

Doy, couldn't imagine why.

 

[Enter the Dragon Punch]

it's fixed, i logged in via the client and see MY account details

 

[Shantom]

I logged back in and instantly got this

For once, I might actually look at the privacy policy.

 

[Ivan Amiibo]

But that's not really the case from what I understand. It's just name, address, phone number, last four digits of CC, right? No passwords or usernames? You don't need to be scared about your games.

Not scared about them stealing games, but all that info will out me as a Hunie Pop owner.

 

[failgubbe]

つ ◕_◕ ༽つ HL3 or we riot つ ◕_◕ ༽つ

 

[Shepard]

Wait what, we aren't supposed to be viewing them? I've been trying to but it fails to connect to the servers so I can't.

I'm no pro, but if the problem was steam making cached pages public, doesn't it mean that accessing your personal page without being sure they resolved the problem would theoretically add it to the cached pages pool?

 

[Danny Dudekisser]

What the hell is this?

Demonstrably realistic.

 

[Tenebrous]

Mmm, now I can see my real account page... that delete buttons for my cc looks very tempting, I don't know...

I suggest you do it - I know I will be! I moved to prepaid cards ages ago for Battle.net & PSN, but random purchases on Steam stopped me from ever doing so... That's about to change.

 

[strafer]

Yeah, I'm not starting Steam until an official response.

 

[kulapik]

Back on my account, no payment method linked.. Maybe they cleaned all of them?

 

[Sianos]

If you haven't been logged in all day, you should be safe, right?

And is it safe to log in now?

 

[Exotoro]

im never using steam again wtf

 

[AcademicSaucer]

What's up with people so invested in running damage control on Valve's behalf

I hope they are just servile to Lord Gaben and not shills.

 

[Theecliff]

Why is there so many people invested in doing the opposite?

is this a serious post

 

[Hexa]

Not in the US and Canada they're not. Everyone on Steam agreed to binding arbitration and a class-action waiver. They ain't getting sued by shit. Read your subscriber agreement.

Nope. At the end of the day most of that doesn't amount to being worth anything. They must certainly will get sued.

 

[chrominance]

I'm highly doubtful this is a "caching issue". This sounds like a problem on Steam's end.

For starters, you don't cache everything at the CDN and information that's supposed to be encrypted is still encrypted. If Steam is caching all of this at Akamai they're idiots and it's still on them.

So even if it is "caching problem" it means that Stema has been caching unencrypted, raw account info at Akamai, though again, I'm very doubtful this is due to an issue there.

What seems more likely is that someone made an oopsie with the customer information database (drop a few key rows and suddenly info is showing up where it shouldn't have) or a straight-up hack.

Others are free to weigh in on this. I work in the webhosting industry and deal with CDNs on a fairly regular basis. Our company uses Akamai as well.

The idea of storing account info in a CDN indeed doesn't make sense, but storing it server-side via something like Varnish or memcache would be slightly more plausible. It's probably not a database issue stemming from IDs somehow being linked to the wrong rows, mostly because it was possible to see account details from many different people just by reloading the page. Also, switching between different sections of the account management area would get you different people. Finally, people mentioned seeing the same people pop up between users, i.e. multiple GAFfers could access the same person's account details. Unless the database changes were ongoing and frequent, this wouldn't make much sense. It also wouldn't explain how people who weren't even logged in were able to view account details of random people (which is how Google has some poor sap's account information in its search engine cache now).

The other thing that's weird, though, is why would Valve's caching (assuming it is the cache that failed) suddenly do so on Christmas Day in such spectacular fashion when everything was working fine for years? Generally speaking, even with a massive sale on, it seems unlikely that anyone would be pushing even minor changes to the website's code. Indeed, the fact that there's a massive sale AND a holiday would be ample reason not to do so unless there was a major error on the site. Even if someone did push a bug to the site, presumably they would've been watching for issues and wouldn't have let the site stay up for an hour. So the caching issue would have been triggered by code that previously was reliable, and I can't think of anything significant that would've changed today of all days (but of course I'm not a Valve employee and have no insight into their systems).

So potentially (though I have absolutely zero evidence to suggest this and would never say otherwise) it could be the proximate cause was a caching failure, but that failure was caused by a hack. I certainly couldn't tell you and I don't think anyone else outside of Valve could either.

 

[JSoup]

TOS aren't legally binding

Depends on the circumstance. There is plenty of legal precedent showing that a reasonable expectation of an agreement will be held as binding (your ToS agreement is a contract, not just a list of no-nos).

 

[Red Arremer]

Well the 10 cent in my steam wallet is gone. Not that I would be sad over that, but well means someone definitely saw the info I had there.

Nothing odd in order history or email through.

Keep in mind that not all pages display your steam wallet's contents.

 

[DeathPeak]

it's either dishonored or target fucking up. as far as we know, no one actually got full on credit card numbers... but i'm still watching like a fucking hawk on my credit account anyways.

I don't even think I have my credit card info on there. I use paypal. Already unlinked that. Gonna keep an eye on it. If anything else shows up, then I'll know for sure.

 

[Conor_Fool]

My steam is always logged in. Am I fucked

 

[mugurumakensei]

im never using steam again wtf

I'm not doing that, but I do appreciate gog.com and origin even more as alternatives.

 

[cr_blah_blah]

Ok, posted a few pages back, but maybe someone can settle my stomach. I'm seeing a pending transaction on my bank account for Target.com. It's for the amount that I paid to pre-order Dishonored 2. I'm not sure if this pending transaction is for that pre-order that won't come out for months, or if it's someone that stole my card info. Supposedly no one is able to get all the credit card info from this fuck-up right? I'll probably be calling the bank to be sure.

My Dishonored pre-order transaction popped back up last week and I thought it was weird until I searched for the original pre-order transaction and apparently it never actually posted. So there was only 1 payment for it in the end.