Steam security issue revealed personal info to other users on XMas Day (fixed)
- Thread starter Quirah
- Start date
hardcastlemccormick
Banned
I can't think of a way Valve could have handled this situation worse. A "lynch mob" mentality is the usual internet explosions, but criticizing Valve for their utter, total incompetence in every category is justified. Frankly, I'm glad there are users getting emotional about this whole thing - this is serious business and Valve's usual aloofness won't fly here.
I agree that it's not the consumer's fault, but savvy consumers have ways to make sure they aren't hit by these sorts of issues.
There are ways to stop the buck, despite what you say. I don't see how it can't be so. If it's so bothersome, don't make accounts, buy everything in cash, etc etc.
Only Saved info - AND you have to have used the account page or checkout page (where the info was displayed and cached) during a specific period of probably a few hours before the issue started and during, in order to be vulnerable - since the pages rendered were cached and thus accessible because they were visted by the user.
For example if you used those two pages 6hrs prior to the issue, it is likely you would have been absolutely fine.
Yeah I know, it sucks. I wish there were some good ways for us to use services more anonymously. I know I'll be filling out at little, or as fake, as possible in the future.
Personally I've been using different usernames and e-mail addresses on different services since a while back (prevent cross-referencing of database leaks), but this is a pain the ass for most people and you can't expect them to do that. My bank used to generate one time-CC numbers for you to use for internet purchases, it was great but they removed that feature for some reason.
Disaster Nebraska
Banned
I'd like there to be a follow-up investigation on how this occurred. Maybe journalists could do more than simply take the "it was caching" at face value.
The original problem from yesterday may be fixed, but it happened because of a fundamental code or security oversight which allowed normally-encrypted information to be passed and cached by the cache or CDN.
As someone who works with this stuff as a part of my job, I do not buy the explanations offered so far and would like to hear how this could have happened.
Otherwise, customers are simply hoping Valve found the issue and everything will be perfect.... Yeah right.
The original problem from yesterday may be fixed, but it happened because of a fundamental code or security oversight which allowed normally-encrypted information to be passed and cached by the cache or CDN.
As someone who works with this stuff as a part of my job, I do not buy the explanations offered so far and would like to hear how this could have happened.
Otherwise, customers are simply hoping Valve found the issue and everything will be perfect.... Yeah right.
human onion
Banned
Man fuck this shit.
Thank you very much.
Yeah, because continued UI design and tweaking isn't as fun trying to implement radical new ideas through game programming. Same reason why it will have taken nine years for Team Fortress 2 to implement competitive matchmaking.
There is a balance between having a corporate style managerial style that stifles creativity and having unfocused whims of fancy overwhelming the fundamentals and underlying architecture. And there doesn't have to be one grand standardized paradigm either: for instance, design work and security are very different and you can't get effective results from both using just one standardized management style for everything.
It's about ethics in caching.
Pewpewlazors99
Member
I still can't believe Valve hasn't said much about this yet...Unless I missed something the only thing they confirmed is that this was a caching issue?
efyu_lemonardo
May I have a cookie?
paperspace
Member
I'm just curious, who are defending it?
poppedcollar69
Member
valve is evil now
It's a combination of both Steam / Valve fanboys trying to minimise the issue, and fanboys of other platforms baiting the hell out of them or just going far over the top with what has happened.
Regardless, Valve have yet to communicate directly to Steam Users since the incident - which in my opinion is utterly wrong when personal data has been compromised. It could be possible that they are trying to get more information together to make a more detailed statement, but I find that hard to believe over this much time.
All the 'it's not a big deal' and 'well that will serve the user right' hydra-heads
hardcastlemccormick
Banned
The stickied post in r/Steam, for one.
DrForester
Kills Photobucket
So what was the window on this? I made a purchase on Christmas Eve. Would that have been before the issue?
Some people function well, even thrive, when they know exactly what is expected of them and what they should do. I'm sure Valve could create a branch dedicated to customer support and have a lot of happy employees with that personality type working there too. I don't think they should change what's working for them on the technological/creative side but perhaps they should revisit their approach elsewhere,.
Take a read through this very thread. Go back one, maybe two pages.
well aren't you so wonderful, floating above us in your saintly middle ground.
No-one really knows unless we get data of the user accounts we did see during that time and what actions they performed and when
There is no commitment to any one vision because there is only one leader at Valve by design and the company has grown too much to remain focused and for de facto leadership based on status to produce results. That, and everyone probably wanting to work exclusively on VR because it is the "coolest".
Too much structure and direction leads to corporate style focus group approved exercises in fillimg checkboxs, but too little leads to no games being made at all.
"After nine years of development on a game that was nine years in development, we hope this basic matchmaking that the community has ran for free without our help for years was worth the wait!"
This makes too much sense, they'll never do it.
My objective opinion is this seems like a small issue honestly. Was there any regulated personal data involved? Was there confirmed fraud on accounts? Sounds like people can just see your account details. If it's just stuff like name, email and home address, this type stuff happens thousands of times each week. And lots of companies already have this info, so you should assume it's already out there.
I am surprised there hasn't been a response from Valve, it might be that their incident response program is investigating and they want to be sure before they put their foot in their mouth.
I am surprised there hasn't been a response from Valve, it might be that their incident response program is investigating and they want to be sure before they put their foot in their mouth.
human onion
Banned
Not defending, sorry, more like victim blaming.
I only recently read and found out about this, and then realized I had card info saved. I find it sad that there have been people doing this, but that post was uncalled for, I'll retract it.
Silvawuff
Member
I'm not defending Valve (or their lack of response here), but isn't their customer service/communication pretty awful in the first place? I don't know how or why that would change after an event like this.
This situation sucks for everyone affected, wacky security breeches are no joke.
This situation sucks for everyone affected, wacky security breeches are no joke.
It was a security breach plain and simple. There's no way around it. You can't shift blame to another entity like a group of hackers because it was Valve who did it. I cannot understand the defense for them screwing up and downplaying the bad parts of this and the legitimate criticism that no company should change configurations during the holiday rush. You always do that stuff before in preparation or after when things have settled down. Not to mention their configuration was not properly tested. Lack of response for hours was horrendous, not even an email to notify their users that steam will be going down for a moment and telling people to stay calm. No apology, just nothing at all from them that journalists had to beat a response out of them. We're expected to trust this company to handle our things with care but they're not, they don't really care as they just shrugged it all off like nothing happened.
Er...didn't they just launch 2 hardware products? Guessing they have OS updates too. Not fair to keep painting them as just hat makers.
The thing is, no one knows. We speculate. All we got is speculation. Valve outside of one comment to Kotaku has said nothing. They said it was okay and nothing got out but considering peoples information was viewable people are still massively concerned. No one knows how bad this might have been and with Valve being so silent it's questionable if they even know yet the full extant until they do check out a number of things. Until then, speculation.
Oh look. Another one.
Bitmap Frogs
Mr. Community
Nothing will come out of this. Valve won't improve their security or response nor they will improve customer service.
But oh hey, I'm sure we can look forward to a few more pieces of fan art featuring Lord Gaben leading the PC master race towards gaming heaven eh?
But oh hey, I'm sure we can look forward to a few more pieces of fan art featuring Lord Gaben leading the PC master race towards gaming heaven eh?
Yes, it's terrible. They were graded F in customer service and so far they're still all talk with "we have to do better."
Yeah, "just." Go ahead and post that info. Throw in your phone number and the last digits of your credit card.
"Just."
Gaz Pwnage
Member
If this is how they plan to go on, I would have 0 confidence in an OS that has even slightly been modified by valve.
Exactly, they've made their creative structure into a part of their greater identity and are now unable to coordinate because they've made structure as a concept out to be inherently their enemy as opposed to a neutral part of coordinating efforts that sometimes gets out of hand.
Phone can be intrusive if people want to harass you. Last 4 of credit card is worthless.
Uh...
Gaz Pwnage
Member
Hahahahahahahahahha...........wait your serious.
it may not be super valuable. But it can be used with a customer support site combining 4 digits of card and email and number, and then they possibly get more data from the customer support.
Umm... No.
ElectricBlanketFire
Member
Being able to view someone else's account is a huge issue.
Phone is added to a pool using some other identifier (any piece of related data like postal or zip code) and then sold to canvassing companies. Those companies are under no obligation to keep your info safe and can sell it onto others, and so on.
So do you really believe that or....?
Also, come on. Don't hold out on me, post the info if its no big deal.
Similar threads
- Poll