You mean profile pages, steam community's been down this morning afaik.
Steam security issue revealed personal info to other users on XMas Day (fixed)
- Thread starter Quirah
- Start date
You mean profile pages, steam community's been down this morning afaik.
hardcastlemccormick
Banned
Okay, I understand.
We knew that there was a problem with the Google cache where you can see the information of a particular user. That's not the same as the other problem where looking at your own account would serve up another user's account page.
Reizo Ryuu
Member
Anecdotal? No, it's simply not how web caching works. There is absolutely no way to easily get the information of any specific account.
One random post saying he is still seeing the issue could easily be just spreading panic.
Yup, the sheer amount of incompetence that seems to reside behind the biggest digital retailer on the PC platform is truly scary.
I see, but isn't this pretty sketchy too?
Here's a great example.
Could you imagine if like a movie theater did this? Or a publisher? Or even a golf club? You think their customers would be tripping over themselves to downplay the seriousness of the breach?
Disaster Nebraska
Banned
Why was this information being passed unencrypted to the cache and/or CDN in the first place? This should've been done over an SSL (https connection) in which case it wouldn't have exposed the information to
random people vowing Steam's store.
The fact this info was encrypted at all should be a massive red flag. This isn't just a "whoops we clicked a button and some info got exposed". If this info is still available through a non-SSL connection then the problem still remains, hiding in the background.
random people vowing Steam's store.
The fact this info was encrypted at all should be a massive red flag. This isn't just a "whoops we clicked a button and some info got exposed". If this info is still available through a non-SSL connection then the problem still remains, hiding in the background.
Have a look at your post and see which part people have a problem with.
orthodoxy1095
Banned
Even if that's true, then that's Valve messing around with CC info and not telling you.
hardcastlemccormick
Banned
According to who, SteamDB? That factually inaccurate non-response from Valve? There have been some good theories as to how this unfolded, but I stand by the fact that we still don't know the full extent of the issue.
Definitely. But we need to make sure users realize you're not talking about a new issue.
AcademicSaucer
Member
Maybe just Gaben, not all Valve. I just cant with people defending this or victim blaming.
Geraldo_Ray
Member
So...is it fixed or not? I'm getting mixed messages here.
I did the whole cache thing when searching on Google, and it's the same guy from Mexico that people keep mentioning from an hour or two ago.
I did the whole cache thing when searching on Google, and it's the same guy from Mexico that people keep mentioning from an hour or two ago.
Which means that steam's servers are fine. It's just some other site's copy of the steam page from a while ago.
The only thing valve can to about it is to ask that site to remove the cached copy.
It's fixed. Google will have to remove the cached copy they have. It's not in valve's hands.
If Valve was a responsible company, they would have immediately shut down all their servers immediately after finding about this mishap. If I didn't have over 500 games, I'd delete my account over this huge beach.
Should we even be accessing our account to remove personal info or will that makes thing worse?
Should we even be accessing our account to remove personal info or will that makes thing worse?
davepoobond
you can't put a price on sparks
Well this is concerning. Hopefully it is fixed
Disaster Nebraska
Banned
Yeah, this.
This isn't just an accidental misconfiguration of the cache. Their website code is passing info that should be behind an SSL. I'd be interested to see if they can maintain their PCI compliance, seeing how that's required to process CC transactions.
ElectricBlanketFire
Member
It's already a clusterfuck. It's great that you don't care for some reason, but saying this isn't a big deal is baffling.
It's safe until we get confirmed proof otherwise.
orthodoxy1095
Banned
We're still waiting for you to share your info. Full name, address, phone number, and email address. Chop chop.
hardcastlemccormick
Banned
I'll quote what I said earlier:
Also anyone wondering about internet security in general should read the free PDF copy of Blown To Bits, an excellent basic overview of the subject.
We have yet to get confirmed proof it's safe, aside from Valve's non-statement. We have plenty of proof that it wasn't safe at one point.
Valve has already generously done that for him. What a great company!
orthodoxy1095
Banned
Thank God for Gaben and Steam. Truly the visionaries of our time!
Jibbajabbawockky
Member
Yeah... I guess its just cause I've sadly grown accustomed to this type of thing from all sorts of companies but this particular instance doesn't seem that bad when compared to other breaches of personal information. That doesn't excuse that it happened or Valve's very blasé response to it but in the grand scheme of personal data breaches, this seems pretty minor if the only thing that got out there was email addresses, account names, purchase history and last digits of CC numbers and phones. I mean, if people want to do nefarious stuff with that sort of info, I'm sure they could find it on the internet anyway. If actual CC numbers and full phone numbers and full personal names, addresses and so on got out there, then this would be a massive problem but at least as far as I understand this, that hasn't happened.
Its this kind of thing though that makes me never save any CC info on websites. And the fact that this seems like a self inflicted wound on Valve's part screwing up and not some malicious outside attack is definitely worrisome, especially when so much digital commerce is predicated on some level of trust that the company you're giving your personal information to isn't going to screw up like this.
So are you suggesting every consumer should assume ever online service will not work as advertised?
I am not sharing shit man. That being said if my info leaks from an online site there is some responsibility I take by saving it there.
You should panic. Everyone should panic.
Alternatively: Hold off on checking your account page or buying new stuff until we get a more definitive response from Valve. We're most likely safe at the moment but Steam's being a little fucky for me and I'd appreciate more information on the issue.
Not in connection to my username on steam (which I might use in other places as well). Same with the e-mail. This is far more serious than just "oh, a first name and address, just like the phone book!".
NoblesseOblige
Banned
So we can blame you for Steam's leaking of personal info?
We have a winner!
Wouldnt be so sure.
The fact the community market keeps going up and down all morning and (If legit - not that im calling people liars here ofc) that people in here saying they had their cc numbers removed is really odd. It had to be valve that did that , unless there is something else very wrong we're not aware of.
All i know is I still cannot access the community market. However the store shows me logged in (Cant even access my inventory however as thats part of the comm market) and my account balance so idk.
Yeah I'm trying to sell people my cards and can't through the mobile app
Hasphat'sAnts
Member
You know the easiest way to avoid that is to have Valve come out and address the situation.
O wait, that'd make too much sense.
Pie and Beans
Look for me on the local news, I'll be the guy arrested for trying to burn down a Nintendo exec's house.
Ha ha ha, its happening again? What a fucking joke.
It's horrible that this is happening to peoples sensitive information, but I'm glad its happened to show how fucking off the rails Valve has been for years and that things need to seriously change hardcore over there. Steam has been a disgrace for a long time but chugged on protected entirely by a holy field of fans goodwill. Now theres a great big gash in that once unmoveable shield and fuzzy hype feelings aren't going to cut it any more.
Childish lack of management structure needs to finally kick its own arse up and into corporate adulthood.
It's horrible that this is happening to peoples sensitive information, but I'm glad its happened to show how fucking off the rails Valve has been for years and that things need to seriously change hardcore over there. Steam has been a disgrace for a long time but chugged on protected entirely by a holy field of fans goodwill. Now theres a great big gash in that once unmoveable shield and fuzzy hype feelings aren't going to cut it any more.
Childish lack of management structure needs to finally kick its own arse up and into corporate adulthood.
Could you imagine if banks worked this way?
"Sorry, you took the risk of getting your money stolen by banking with us at this location."
Your bizarre partially-at-fault view is just wrong.
Thought so. Then kindly shut up or fuck off.
orthodoxy1095
Banned
Then you should stop talking.
No. That's not how consumer-customer relationships work. Aside from giving a really shady business my data, if I entrust a company with my data I don't have responsibility for their mistake.
What a weird way to look at things.
So you think that's advice that normal people should be expected to follow?
Hasphat'sAnts
Member
Good thing there are regulators in these industries looking out for the consumer!
That literally has nothing to do with the topic at hand.
You're trying to downplay the risk while still openly afraid of replicating its consequences.
It is exactly the topic at hand.
100%.
I hope you never have any complaints about anything ever then.
hardcastlemccormick
Banned
In an ideal world, yes. Everyone should value their personal data as a commodity and very rarely share it with anyone.
Well actually in an ideal world, privately stored data is never publicly revealed. But to keep yourself and your data safe, you should avoid entering it on the internet as much as possible.
That being said, there's no excuse for blaming Steam users for this mess.
EDIT: Ah, hlhbk has been banned. What they were saying had a ring of truth, but surrounded by a lot of nonsense.
Similar threads
- Poll