Support NeoGAF

[LiquidMetal14]

During login I got "Verifying login credentials" or something like that, gets stuck then gives a connection error. I've restarted the client and now everything seems normal though.

Might be an idiot for doing this but I suppose Valve fixed the leak when they rebooted the entire thing.

Hopefully.

I just got my mobile authenticator prompt and upon getting my info from the Steam Guard in the mobile app it allowed me to log in. Everything is normal on my end as far as my account goes.

 

[SZips]

Same.

You might be waiting a very... very... very long time.

 

[AnathemicOne]

Okay well I just deleted my credit card info off my account, would happily add it back on once Valve resolves this issue and depending on the statement they release.

 

[Costia]

To you. For alot of us it isn't.

To you. For alot of us it is.

A lot of people live in a fantasy world.
Name? Address? Phone number? All that information can be used for identity theft and other horrible things?
Meh, at least I can still play Half-Life 2.

There is a big difference between having your personal information available for random people to see online vs. friends/neighbors knowing where you live and what's your phone number.

 

[ironcreed]

A lot of people live in a fantasy world.
Name? Address? Phone number? All that information can be used for identity theft and other horrible things?
Meh, at least I can still play Half-Life 2.

LOL

 

[hlhbk]

For those scared to get on Steam here is an easy fix:

Disconnect from the internet and start in offline mode. You can reconnect to the internet after you are in offline mode. You can play your games until everything is cleared up.

 

[Lautaro]

I hope they are just servile to Lord Gaben and not shills.

I hope the opposite, doing damage control for a company and not getting paid for it is pretty sad.

Anyway, I juts logged in and deleted my CC. Curiously, I still had my Paypal info despite not being able to use it after the currencies changes they made a few weeks ago (deleted it too ofc).

 

[Wickerbasket]

Why is there so many people invested in doing the opposite?

Maybe because they just let a bunch of people access access other users' personal details?

They're probably breaking a few UK and EU data protection laws there unintentionally.

 

[Aselith]

I feel like there's a joke to be made here about Valve's tendency to promote user-created content, but I don't have the wit to come up with it.

Anyway, is it safe to log back on or no? I was hoping to play some games, not really planning to buy anything right now.

"Welcome to the Steam Hacks Beta!"

 

[Reebot]

It was just a joke because Valve hardly ever says anything officially

I was trying to play off it; this is one of those situation in which Valve's usual coy stance won't fly. They've got to address this to prevent people from leaving.

 

[SlipperyFishes]

I bought a game there now. Works good.

Still a massive fuckup somewhere.

 

[Kadayi]

Back for me now. Account is as I left it.

 

[Gaz_RB]

So what would put people's card info I risked? I deleted mine just now btw.

Nobody's card info was at risk. From what I understand it was just name, address, etc.

 

[Lagamorph]

Why are people who buy trading cards are idiots?

You mean besides spending money on jpeg files?

 

[HalfBakedProphet]

I don't understand people who are immediately logging on right now when we've had no official statement about what happened.

yup. I haven't logged into steam in around 36 hours and won't again until we hear something

 

[Professor Beef]

I wonder if someone deleted my payment method, if so thanks bruh

You say that now, but when you wanna purchase something and you can't remember your payment method, they will have the last laugh

 

[Crimsonclaw111]

So what should I do now?

I had an old phone number, can I remove it and update it to my new one? And also is there a way to require a password with PayPal checkout?

 

[Rebel Leader]

I don't understand people who are immediately logging on right now when we've had no official statement about what happened.

We are those who dare. We are those who venture forth so for those who do not dare nor challenge can follow our footsteps to know that they can access THEIR accounts.

You're welcome.

 

[Steel]

I don't understand people who are immediately logging on right now when we've had no official statement about what happened.

Yeah. No way in hell I'm logging in till we get word.

 

[Gaz_RB]

I was trying to play off it; this is one of those situation in which Valve's usual coy stance won't fly. They've got to address this to prevent people from leaving.

If only we lived in a world where that was true :/

 

[strafer]

TotalBiscuit made a short PSA

https://youtu.be/x80VOkFwsL0

 

[Odrion]

Valve has really been fucking things up this year.

 

[sunshine and gasoline]

What a mess.

I hope that Valve will say something soon. They should have mentioned something hours ago even if was just a "we're looking into things".

 

[Vamphuntr]

Got my account info up now. All anyone could see was the last two letters of my Visa card, country, & one of my email addresses... While not ideal, it could've been a lot worse.

Nothing unusual in the purchase history, and no difference in account funds, but I've deleted my CC info.

The most "dangerous" thing so far seems to be that if you had a payment method saved and someone tried to add a new one it would auto fill all your personal information in the boxes.

 

[DeaviL]

You've blatantly mislead people as to the extent of the risk for some 50 pages now. You don't get to play that card.

I'm sorry for not trying to stoke the fires.
For not claiming you can see full CC info (You can't)
For not claiming you can see phone numbers (You can't)
For not claiming you can get everyones password (You can't)

You can however
- See e-mail addresses
- Purchase with steam credit
- Purchase with any one click purchase method (if you have to give any extra info, it's a no go)

And that's only if you don't switch to a new account by clicking any button.

Here is a post of mine, we didn't know then that you could get a full phone number at that moment in time. (it's not your security phone number though)
Tell me where this post touched you.

 

[Wickerbasket]

You mean besides spending money on jpeg files?

I'm sure you have never spent money on an intangible product, especially one made up of 1s and 0s.

 

[Disaster Nebraska]

Caching for dynamic user related content is a no go per se. If someone pushed a new version of the account page with caching enabled it could cause this problem. It would also explain why people saw the same subset of users. Those poor guys were the first to open the new account page and for every respective server they hit they became the cached page.

Even if that's the case (I don't suspect it is, but web servers can be complicated beasts and I only know some) then it means Steam is (and has been) ignoring basic PCI standards for some time now.

You simply do not cache that kind of info. It's bad practice and opens you up to compromising your customers' data.

To be honest, if it's really due to
caching then it's even worse. It's worse because the caching issue simply revealed a gaping security flaw/PCI non-compliance that has been present for who-knows-how-long.

 

[NoblesseOblige]

TotalBiscuit made a short PSA

https://youtu.be/x80VOkFwsL0

8.5 minutes is pretty long for 'short' in my opinion.

 

[Glycemic Beg]

I don't understand people who are immediately logging on right now when we've had no official statement about what happened.

People are worried about their account and/or purchase details?

 

[Mulgrok]

This just reinforces my reasoning behind never saving any details in store accounts. I just don't trust databases enough.

 

[Maedhros]

A lot of people live in a fantasy world.
Name? Address? Phone number? All that information can be used for identity theft and other horrible things?
Meh, at least I can still play Half-Life 2.

Basically anyone who knows me personally knows that information already. Name, Phone Number, Address.

If any of the people I know is a hacker, does this mean I'm fucked?

I can give you the card number... but even then you need the security key.

 

[CornBurrito]

Not at my laptop. Can someone see my full card info? Thought everything except last 4 digits is hidden.

 

[cartographer]

It's not that bad. Just think of getting access to somebody else's account like getting a CS:GO case and their personal information is just different skins you can try on elsewhere on the Internet.

 

[eMpTy23]

You mean besides spending money on jpeg files?

If that's what they want to spend money on, I don't see what's wrong with it. They probably find it enjoyable, which is a good enough reason in my eyes. I don't understand why you call them idiots for doing so.

 

[SirBaron]

Maybe because they just let a bunch of people access access other users' personal details?

They're probably breaking a few UK and EU data protection laws there unintentionally.

I'm not saying what happened isn't bad, but what I am saying is some individuals are going on the extreme hate valve spree. They're just as bad as the apologists.

Also in the UK were had that many data breach leaks, everyone knows everyone now lol.

 

[Papagaio]

Cached Version still broken on google chrome:

https://store.steampowered.com/account/

 

[Delusibeta]

8.5 minutes is pretty long for 'short' in my opinion.

It's TotalBiscuit, anything less than 10 minutes is short for him.

 

[kevm3]

I'm guessing they'll completely rollback all of the transactions that happened today and possibly yesterday.

 

[Mad Season]

This just reinforces my reasoning behind never saving any details in store accounts. I just don't trust databases enough.

agreed

 

[Yazzees]

8.5 minutes is pretty long for 'short' in my opinion.

He tends to repeat himself....a lot, and is the type to use more words than necessary when speaking. 8 minutes is short for a TB video.

 

[SpacePirate Ridley]

8.5 minutes is pretty long for 'short' in my opinion.

His videos are usually 30 minutes long.

 

[cyba89]

I kind of hope this doesn't just blow over for Valve. Can't have them thinking they can just keep coasting on their good name.

Their response (if they give any at all) will probably be something like this: ¯\_(&#12484_/¯

What are people supposed to do? Buy their PC games from UPlay?

 

[JSoup]

There is a big difference between having your personal information available for random people to see online vs. friends/neighbors knowing where you live and what's your phone number.

That wasn't the argument at all. It was a question of one thing being more important than another.

 

[AxeMan]

An arbitration clause and class-action waiver are not against the law nor is agreeing to them.

Ok, not against the law in Australia but it's not enforceable.
Anything that signs away consumer rights in Australia isn't enforceable, even if a person agreed to sign them away

 

[ekim]

Cached Version still broken on google chrome:

https://store.steampowered.com/account/

That's probably your local browser cache.

 

[Milestoned]

I recently got a pre-paid CC just for Steam, PSN and so on. People were laughing at me saying that I'm paranoid. I added the CC as a payment option to Steam about 3-4 hours ago, had dinner, came back, saw this thread, checked my CC:

Guess who is laughing now.

 

[Reebot]

Here is a post of mine, we didn't know then that you could get a full phone number at that moment in time. (it's not your security phone number though)
Tell me where this post touched you.

Except we did. Nice try though.

I guess only disclosing 1 out of 3 extremely personal things isn't too bad. Bravo Valve!

 

[The Last One]

Just removed my CC information. Luckly nothing happened to my account.

 

[Large Professor]

Nobody's card info was at risk. From what I understand it was just name, address, etc.

Still a very uncomfortable thought that some internet stranger might have had access to your informations.

 

[ChryZ]

It's not possible to change the Steam login ID, right?

I'm at least going to change my PayPal email address and the one linked to my Steam account. Better safe than sorry, before some wanker tries to guess my passwords.