Support NeoGAF

[Big-ass Ramp]

Yep, this is beyond bush league. The most basic responsibility of a service-based company is to announce that something has happened, share any confirmed info, and shut down service until it can be verified to be safe. Valve has done none of that.

I hope people who praise valve's management structure take a good look at this situation. Every part of this fiasco -- the half-assed ddos mitigation, the apparent untested launch of code with a massive security hole, and the complete silence to their customer base -- is a direct result of an organizational culture with no leadership, no responsibility, and no employees who are expected to do difficult or unpleasant work.

this is absolute spot on. this is the result of a culture of not putting customers first. there's this expectation, especially by people just now entering the workforce, of never having an unpleasant day at work and never having to put in effort. We need month long vacations at a moments notice because work should never come before your personal life. But these are the results when your work isn't the priority. Obviously there needs to be a balance and there's problems with the other extreme, but the reality is that we have put a lot of trust in a company that puts their wellbeing above you, the customer.

 

[Palculator]

I'm scared, I had my credit card data on my steam account but since the banks are closed today I can't see if something was purchased on it.

Nothing was purchased.

 

[Spirited]

Forget gaming, this is arguably the worst security failure in internet history.

Forget Internet history, this is arguably the worst security failure since the Trojan Horse.

 

[Hasphat'sAnts]

Look,

this is not the same as the Target hack from two years ago, but the way this has been handled and communicated out to customers is beyond dreadful. It's willful negligence bordering on doing business in bad faith.

 

[Silent Chief]

This was far worse from an actual information leaking standpoint, but it appears to be over. PSN was just offline for ages...

What happened with PSN is that someone got user access and rebooted the servers one by one to get supervisor access. When Sony figured that out they pulled the plug until they were sure the server farm was secure again. They even relocated it.

At this point, Valve might not even know what happened.

And it's way too early to know what the lawsuits against Valve will look like.

 

[Unknown Soldier]

Forget Internet history, this is arguably the worst security failure since the Trojan Horse.

Forget the Trojan Horse, we're talking about betrayed by a guy who let the Persians sneak behind the 300 Spartans at Thermopylae serious here.

 

[Dragon]

Just read about it I guess.

https://en.wikipedia.org/wiki/2011_PlayStation_Network_outage

"the biggest Internet security break-in ever".

I was more getting at how you judged this Valve situation against that if we don't have all the information yet.

 

[kulapik]

So valve has learnt nothing from this?

Sigh, I should have expected it.

 

[Saucycarpdog]

Pending transactions generally show up immediately.

Not for Wells Fargo I guess, I purchased some music from the iTunes Store yesterday but that hasn't even shown up yet.

 

[BennyBlanco]

Look,

this is not the same as the Target hack from two years ago, but the way this has been handled and communicated out to customers is beyond dreadful. It's willful negligence bordering on doing business in bad faith.

It's Christmas day. Valve is probably running on a skeleton crew.

Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

 

[Silent Chief]

Look,

this is not the same as the Target hack from two years ago, but the way this has been handled and communicated out to customers is beyond dreadful. It's willful negligence bordering on doing business in bad faith.

It's Christmas day. The real communication will come out in a day or two.

 

[Salmonax]

Merry Christmas. Don't care if you don't celebrate it.

You're one angry dude.

 

[LurkerPrime]

So... is Steam OK now? Can I log in safely? Valve's response to Kotaku is remarkably nebulous.

 

[robotzombie]

people with glassholes shouldn't throw stones

 

[Nzyme32]

Doesn't seem like cc data was leaked.

Last 4 digits were if someone was looking at the account details page, but there should have been no way to change anything / buy anything etc since they were cached pages rather than actually being logged in with the correct account credentials, so any attempts would just ask you to login. Still, private data is out there, it just depends if someone was nefarious enough to want to collect the data and misuse it.

 

[spinz]

Do correct me if im wrong.
What could anyone do with the info there? It doesnt show your full credit card number, just the last numbers. In order to use it you have to know the security code. I dont see address etc readily accesible from the account page.
So whats the deal?
I mean it is bizarre and discomforting that this happened. But im not seeing a reason to hit the panic button.... yet.

 

[arts&crafts]

So... is Steam OK now? Can I log in safely? Valve's response to Kotaku is remarkably nebulous.

It LET me log in to steam, that is a good sign

 

[Chariot]

Forget the Trojan Horse, we're talking about betrayed by a guy who let the Persians sneak behind the 300 Spartans at Thermopylae serious here.

Forget Sparta, remember when the snake managed to fool Eva into fooling Adam into eating the apple? And god didn't even exterminate the snake afterwards and instead kicked out the victims.

 

[Uzzy]

Forget the Trojan Horse, we're talking about betrayed by a guy who let the Persians sneak behind the 300 Spartans at Thermopylae serious here.

Forget Ephialtes, we're talking about the worst security failure since the garden of eden here.

Edit: GODDAMN IT CHARIOT

 

[Syril]

Is it safe to make purchases now? I removed my credit card for now, and that was the only personal information short of email I had associated.

 

[Palculator]

Forget Sparta, remember when the snake managed to fool Eva into fooling Adam into eating the apple? And god didn't even exterminate the snake afterwards and instead kicked out the victims.

Metal Gear fans in every thread, smh.

 

[boredandlazy]

Glasshole
Banned
(Today, 10:19 PM)

He lived up to his name.

Going under the assumption he's an Australian... Fuck'im.

 

[Hasphat'sAnts]

It's Christmas day. Valve is probably running on a skeleton crew.

Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

It's Christmas day. The real communication will come out in a day or two.

If this happened at Amazon, would you hold them to the same standard?

 

[jmga]

Do correct me if im wrong.
What could anyone do with the info there? It doesnt show your full credit card number, just the last numbers. In order to use it you have to know the security code. I dont see address etc readily accesible from the account page.
So whats the deal?

Some users also had their billing address, real name and phone number cached(and leaked).

 

[Wanderer5]

It's Christmas day. Valve is probably running on a skeleton crew.

Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

While that true, not even just least say a little something on twitter or such? They really should try to least do that.

 

[cartographer]

Do correct me if im wrong.
What could anyone do with the info there? It doesnt show your full credit card number, just the last numbers. In order to use it you have to know the security code. I dont see address etc readily accesible from the account page.
So whats the deal?
I mean it is bizarre and discomforting that this happened. But im not seeing a reason to hit the panic button.... yet.

Those last four digits are golden for social engineering, especially combined with other information like e-mail address, name, username etc.

 

[axisofweevils]

Not impressed by this or the lack of response.

 

[fertygo]

I think at very worst your email and phone number is leaked, don't really care for phone number.. will change my email login tho

 

[Future PhaZe]

Last 4 digits were if someone was looking at the account details page, but there should have been no way to change anything / buy anything etc since they were cached pages rather than actually being logged in with the correct account credentials, so any attempts would just ask you to login. Still, private data is out there, it just depends if someone was nefarious enough to want to collect the data and misuse it.

potential names from email accounts + last 4 digits of credit card plus recent payment history = fantastic start to begin phishing with

its a security breach--plain and simple

 

[spinz]

Some users also had their billing address, real name and phone number cached(and leaked).

Well that would be bad. I dont even see a place in account details to view billing address. Did they take it down?

 

[Silent Chief]

It's Christmas day. Valve is probably running on a skeleton crew.

Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

Exactly. The entire Washington DC, including the White House could be offline and I wouldn't be answering my phone. It's Christmas.

Is it too much to ask for Gordon Freeman to announce "Probably not a problem"?

 

[Relaxed Muscle]

Is it safe to make purchases now? I removed my credit card for now, and that was the only personal information short of email I had associated.

I wouldn't purchase anything until Steam releases an official statement. But that's me, if they restarted the service is because they properly tested that the problem was resolved, if they didn't do that it would be like dropping a buggy config file in your production enviroment that allowed users to see private info of other users, haha that would be silly right? how would that happen?! so yeah, go buy some games, that will make Gabe Santa happy.

 

[shadowkat]

It's Christmas day. Valve is probably running on a skeleton crew.

Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

It's Christmas day. The real communication will come out in a day or two.

No excuse for zero communication. You run an online, 24 hour service. Someone is always on call for something like this.

 

[Nzyme32]

potential names from email accounts + last 4 digits of credit card plus recent payment history = fantastic start to begin phishing with

its a security breach--plain and simple

For sure, didn't say otherwise

 

[Mjöölnir]

So basically people would get the information of a totally random steam user for about an hour and people are going to sue them for it? Meanwhile in the real world...

 

[Codeacious]

Odds are it was not valve, but their cache service / CDN.

From the statement released, it sounds like it was a configuration change by Valve. Additionally, Valve writes the code that deals with caching authorized pages containing PII via something like Varnish. If a CDN made a configuration change that caused something like this, we'd have seen issues with more than just Steam as that change would've rolled out to more than just the servers caching Valve's content.

 

[Dragon]

Exactly. The entire Washington DC, including the White House could be offline and I wouldn't be answering my phone. It's Christmas.

Is it too much to ask for Gordon Freeman to announce "Probably not a problem"?

If Valve's thinking is similar, they should shut down Steam during certain times.

 

[Tomat]

I think at very worst your email and phone number is leaked, don't really care for phone number.. will change my email login tho

Paypal emails were visible too.

 

[jmga]

Well that would be bad. I dont even see a place in account details to view billing address. Did they take it down?

I think you have to add it with your CC data. I use PayPal so I don't have it.

 

[Silent Chief]

Valve doesn't seem to get how serious what happened was yet.

Maybe a couple of class action lawsuits will wake them up.

At least one per country. Maybe a single one for EU?

 

[Mass_Pincup]

It's Christmas day. Valve is probably running on a skeleton crew.

Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

It's Christmas day. The real communication will come out in a day or two.

But they did release a statement to Kotaku, want's stopping them to do so to their customers?

 

[strafer]

eh... im going to bed now...i will try steam tomorrow.

 

[Dragon]

So basically people would get the information of a totally random steam user for about an hour and people are going to sue them for it? Meanwhile in the real world...

No one's talking about suing. Why are you crapping on people who are worried about their personal information?

 

[Willy Wanka]

The only anomaly I can see on my account so far is that the 2015 'winter sale trading cards' that I had in my inventory so far are now completely different. No transactions have been made, no items traded, steam wallet funds are intact and I have no pending transactions on pay-pal etc.

 

[Costia]

It's Christmas day. Valve is probably running on a skeleton crew.
Not saying this should be swept under the rug but I'll give them a day or two to release a statement as long as everything is now secure.

It's Christmas day. The real communication will come out in a day or two.

That's a bad excuse. If they leave enough manpower to handle selling stuff and making money, they should also leave enough people to handle a crisis.
Basically, if they didn't leave enough people to handle this, they should have shut down the store completely for the holidays.
But since that would be commercially stupid, they should have left or had enough people on a short notice to handle this fiasco.
A response a few days after the problem happens would be too late.

So if the worst thing that could come from this caching issue is having some stranger see your purchase history, account username, and last 4 digits of your credit card, how can anyone buy anything off your account otherwise? Steam Wallet?
I don't want to undermine anyone who got legit hacked in the past few hours but how would that even work? Valve is claiming there's nothing to worry about.

Also real full name, address and phone number.

 

[chaobreaker]

So if the worst thing that could come from this caching issue is having some stranger see your purchase history, account username, and last 4 digits of your credit card, how can anyone buy anything off your account otherwise? Steam Wallet?

I don't want to undermine anyone who got legit hacked in the past few hours but how would that even work? Valve is claiming there's nothing to worry about.

 

[whyman]

How Valve responded to this serious information leak is appalling to say the least. I have lost any trust I had in Valve keeping my information secure. I fully expect both compensation for the event that took place today, as well as an apology and a transparent email about what happened. Anything less would be a horrible way to care for costumers.

 

[Unknown Soldier]

Forget Ephialtes, we're talking about the worst security failure since the garden of eden here.

Edit: GODDAMN IT CHARIOT

Forget Sparta, remember when the snake managed to fool Eva into fooling Adam into eating the apple? And god didn't even exterminate the snake afterwards and instead kicked out the victims.

Damn guys, I was trying to keep it in Greek history but then you went all Biblical and shit

 

[cartographer]

So basically people would get the information of a totally random steam user for about an hour and people are going to sue them for it? Meanwhile in the real world...

Basically, a bunch of personal information was cached that shouldn't be cached. Enterprising people know what to do with that if they want to. You can start searching if you want. Can even view some still cached information if you want.

 

[CommandThrower]

Well, I cancelled my debit card when I heard this news initially. I guess I didn't need to.

Better to be safe than sorry? I have a hard time deciding if I should feel angry or relieved.