CecilRousso
Member
It's the same for me. Two last digits of CC and four last digits on phone number. Not sure if there's another view available that shows more, but I haven't found it yet.
Steam security issue revealed personal info to other users on XMas Day (fixed)
- Thread starter Quirah
- Start date
It's the same for me. Two last digits of CC and four last digits on phone number. Not sure if there's another view available that shows more, but I haven't found it yet.
In my account page it says "The following payment methods are currently associated with your account.
*PayPal Email*"
Is this the thing that saves my details so I don't have to fill them with every purchase? I want to cancel that
It also says "For your security, you will be required to re-authorize your purchase with PayPal." when I try to add funds with PayPal.
I cancelled the pre-approved purchase thing from PayPal's website yesterday, I'm assuming this is the reason for this msg
*PayPal Email*"
Is this the thing that saves my details so I don't have to fill them with every purchase? I want to cancel that
It also says "For your security, you will be required to re-authorize your purchase with PayPal." when I try to add funds with PayPal.
I cancelled the pre-approved purchase thing from PayPal's website yesterday, I'm assuming this is the reason for this msg
I agree, people going "meh" in this situation is baffling to me. Response from Valve even worse.
PSN was also down for a month to fix their issues which affected everyone on their network. Steam was down for a day at most after an hour of vulnerability that affected a minority of people. This breach is a lot less serious than PSN's breach comparatively. About the only thing Valve can be called out for compared to Sony is not saying "Sorry! Our bad."
GHG
Member
Ok this is really bad but let's not go too far here... It's not worse than a hack. Nowhere near.
If this was a full scale hack with all of the details listed being compromised then you'd be on the phone to your bank instead of posting here if you knew what was good for you.
That's part of the fun, you don't!
In most cases "hacks" expose encrypted information and it is highly unlikely that they will be decrypted. Steam Catch bug from yesterday exposed all that information as it is without encryption so it is bigger issue even if only limited number of accounts are affected (we will never know how many).
Barbacoatl
Banned
Fuck valve.
paperspace
Member
fluffydelusions
Member
It did not show anyones full cc number though...so there is that at least
Because doing any action on your account (updating/deleting info) could have exposed your page alongside the ones that were already out there. It could have already been out there, or it could not have had any affect we just don't know.
The severity of the issue depends on what info you had on your account details section. If you were affected your email address would have been exposed, and if you had cc info saved your billing address was exposed too.
I'd stop hoping, Valve aren't going to do anything responsible and customer-beneficial like that. Just look at their laughably inadequate response above, they don't even consider revealing thousands of users' sensitive personal information to complete strangers to be a problem worthy of an apology.
Mr. Enigma
Member
"Less than an hour" is full of shit. The 4chan thread on /v went up around 2:30pm ET. The storefront and account details didn't get shut down until around 4:20pm ET. It was close to about 2 hours.
Who changes config on Christmas day? Especially if it wasn't broken before. It's not like they'd do a release on Christmas.
Frankfurter
Member
"Some users"...
so my paypal account wouldn't be exposed anyway, right? Just my email address?
thequickandthedead
Member
"some users" lol
TheSpoiler
Member
When you go to Review, I believe you can see the last 4 digits of your credit card.
Zeouterlimits
Member
That statement is painfully hollow and unapologetic, nor does it really address the personal information exposed.
Bleugh, kind of shameful.
Bleugh, kind of shameful.
Paypal info would have been safe, but go ahead and delink from paypal itself if you can. I did that under the Approved Payments screen in Paypal for WWW.steampowered.
Email addresses for affected folks was front and centre in the leak.
What I find it funny is:
-Steam implements Steam Guard
-Steam implements regional lock on purchased games and gifting
-Steam implements mobile phone auth
-Steam implements autenthicator
-Steam implements "hostage" period in case of trading
All of this in order TO PROTECT THE USERS.
Then they fucked up hardly (for the second time), and no one cares.
Who is so incompenent do adopt a configuration switch in christmas, when servers are under high volume traffic pretty much the whole time. And why?
At this point I ask myself what Valve employees do the whole day, because Steam support simply is the worse in the industry, even Origin/Uplay are much, much better.
There are no games in sight, if not occasional TF2/CSGO/DOTA2 updates, so a part of those employees work on this...but what about the rest? I mean, Valve is way slower to implement/upgrade Steam, to patch bugs in their client and so on, so what they do all the days?
And this post is not to troll or whatever, because I'm pretty much a PC player only (I have a PS3, but I didn't boot that in years), almost my entire catalogue is on Steam (with some games on GOG too), consisting in around 1800 titles. So yes, I gave Valve money, I don't want a free game/compensation, I just want to be safe with my data, because PSN breach forced me to take another debit card (at least I didn't store CC info on Steam, using only wallet cards), but still there was my address, my phone number, my mail (I recently changed it so it would be a big pain in the ass if I start receiving spam because Valve fucked up, forcing me to change it again on all associated services and people I need to contact) etc. This is inexcusable.
-Steam implements Steam Guard
-Steam implements regional lock on purchased games and gifting
-Steam implements mobile phone auth
-Steam implements autenthicator
-Steam implements "hostage" period in case of trading
All of this in order TO PROTECT THE USERS.
Then they fucked up hardly (for the second time), and no one cares.
Who is so incompenent do adopt a configuration switch in christmas, when servers are under high volume traffic pretty much the whole time. And why?
At this point I ask myself what Valve employees do the whole day, because Steam support simply is the worse in the industry, even Origin/Uplay are much, much better.
There are no games in sight, if not occasional TF2/CSGO/DOTA2 updates, so a part of those employees work on this...but what about the rest? I mean, Valve is way slower to implement/upgrade Steam, to patch bugs in their client and so on, so what they do all the days?
And this post is not to troll or whatever, because I'm pretty much a PC player only (I have a PS3, but I didn't boot that in years), almost my entire catalogue is on Steam (with some games on GOG too), consisting in around 1800 titles. So yes, I gave Valve money, I don't want a free game/compensation, I just want to be safe with my data, because PSN breach forced me to take another debit card (at least I didn't store CC info on Steam, using only wallet cards), but still there was my address, my phone number, my mail (I recently changed it so it would be a big pain in the ass if I start receiving spam because Valve fucked up, forcing me to change it again on all associated services and people I need to contact) etc. This is inexcusable.
Why would they handle it when they happen unless they are worried about being punished for not doing so?
I had already delinked from steam, I assume it's too late to delink from paypal, I'm not seeing any options there.
PLASTICA-MAN
Member
I "believe" what happened yesterday didn't affect any user and it was just servers checking by Valve just like last time, few months ago when you could hack an account by just knowing its login. Seriously Valve? We believe??? After what happened you still aren't sure of the extent of the attack that you don't want to acknowledge (like every time)? Does such statement come from professionals and from the most used online service? This: "We believe" should become a MEME, just like Skyrim's "got an an arrow on the know" that you just got btw. Thanks.
Weltall Zero
Member
Sometimes things kind of work out. My credit card registered with Steam expired a few months ago, and unlike every time that happens, instead of registering the new one, I decided to use Paypal going forward (which doesn't store its password).
Still, this is really shitty, but there's little we can do about it except making a big enough splash that Valve double and triple check before making these kinds of changes in the future.
Seems pretty accurate (software engineer here). It's just an error in configuration, most likely out of a desire for the cache to operate on a wider range of pages (so as to alleviate some of the overload due to Christmas/deals shopping). As far as I can see, either they consciously configured the cache to work on all pages, forgetting that would expose personal information to anyone requesting it (a reasonable mistake if you assume validation occurs before accessing the cache, not after), or they made a honest mistake / typo in the cache wildcards that resulted in all of them being cached. It's still a human error in both cases though, and I wouldn't like to be in the shoes on the one/ones that pushed it online.
Still, this is really shitty, but there's little we can do about it except making a big enough splash that Valve double and triple check before making these kinds of changes in the future.
Seems pretty accurate (software engineer here). It's just an error in configuration, most likely out of a desire for the cache to operate on a wider range of pages (so as to alleviate some of the overload due to Christmas/deals shopping). As far as I can see, either they consciously configured the cache to work on all pages, forgetting that would expose personal information to anyone requesting it (a reasonable mistake if you assume validation occurs before accessing the cache, not after), or they made a honest mistake / typo in the cache wildcards that resulted in all of them being cached. It's still a human error in both cases though, and I wouldn't like to be in the shoes on the one/ones that pushed it online.
CecilRousso
Member
No one cares? Who doesn't care?
Maybe because they were needed because of the high volume traffic? How many times how we been setting here during steam sales, when the servers looked unavailable, and screamed in unison "OMG Valve do something?!11".
Wanting to be seen as acting responsibly towards their customers? Because right now, at least in my opinion, they haven't done that.
PetriP-TNT
Member
They did handle it around a hour of getting notified of it (unless the going by that one guys calculation that starts from the thread on 4chan, because I am sure that every sysop guy is just casually surfing /v/ on Xmas eve) though.
GHG
Member
Do you not remember this?:
http://dl.pcgamer.com/Valve_Handbook_LowRes.pdf
This shouldn't be a surprise to you.
The "no one cares" refers to Valve.
And yeah, of course changes are needed, but if I understood correctly, they experimented something new under christmas (if I'm wrong, then don't consider that part).
Still, is inexcusable such things happen. I can understand being hacked, but I can't tolerate you, the service I'm giving money and trust, screwing up hardly not a single time, but a second one too.
Last night i went on my account page to delete my paypal info from steam after all this shit happened, but i couldn't find my name/billing address in the page. Does that mean i'm "ok" and "only" my paypal and steam email were leaked, and my personal info would have been there only if i linked my credit card? I also saved my phone number but only the last 4 digits are visible.
It definitely lasted more than an hour. I was still seeing the store/account pages of other users shortly before I made this post:
This thread was created almost two-and-a-half hours ago.
Strange. Delinking from Steam shouldn't affect Paypal, you're just removing the info on Steam's end but as far as Paypal knows it still has an open account with them and will approve any transfer automatically
Check this screen for https://www.paypal.com/cgi-bin/webscr?cmd=_manage-paylist for WWW.Steampowered.com with status of Active
In what situation would you not start the time calculation at the first reported occurrence of the issue?
Maybe because they were needed because of the high volume traffic? How many times how we been setting here during steam sales, when the servers looked unavailable, and screamed in unison "OMG Valve do something?!11".
prior preparation prevents piss-poor performance
it's not beyond their scope to plan and test for this and make sure that infrastructure can support worst-case scenarios
making a config change at this date/time and with this much impact was amateur hour
Rebel Leader
THE POWER OF BUTTERSCOTCH BOTTOMS
Has valve issued a new statement?
Similar threads
- Poll