5 ms·
Steam: Seeing other people's accounts when logged in
- minimaxir 11y agoReddit thread with more discussion: https://www.reddit.com/r/Games/comments/3y7maa/something_is_really_wrong_with_steam_be_careful/ https://www.reddit.com/r/Games/comments/3y7maa/something_is_... To get an indication how bad this is, the default Steam account page was showing other people's accounts. EDIT: Steam fully down for now. If you had a Steam Account, I recommend checking email/credit card on any linked accounts. (and, as always, sign up for 2FA if you haven't!) EDIT2: Steam Community Moderator response (not linked): - No, Steam is not hacked - Creditcard info and phone numbers are, as required by law, censored and not visible to users
- pbz 11y agoAnd the language randomly changes if you keep refreshing; maybe because I'm being logged in as a different person every time I refresh?
- TophWells 11y agoQuite possibly, yes - if you can find the page that gives "your" account information, the language often matches the location. I should really stop poking around, but this is a fascinatingly bizarre error. Has anyone seen anything like it before?
- pbz 11y agoNot sure how authoritative: https://www.reddit.com/r/Games/comments/3y7maa/something_is_really_wrong_with_steam_be_careful/cyb83ni https://www.reddit.com/r/Games/comments/3y7maa/something_is_...
- deleted 11y ago[deleted]
- xj9 11y agoI had a similar problem with a site I worked on a couple of years back. Setting headers to disable caching did the trick. Annoying, but effective.
- jaxb 11y agoNot on Steam; there was a Tomcat bug where it'd send HTTP response to wrong client: https://bz.apache.org/bugzilla/show_bug.cgi?id=57340 https://bz.apache.org/bugzilla/show_bug.cgi?id=57340
- busterarm 11y agoSo maybe that's why Steam store pages have been displaying for me in Korean randomly over the last two years...
- dageshi 11y agoBest guess at the moment is that it's a caching issue and you're seeing pages previously sent to other people. In other words get the hell out of steam since if you actually do get to your profile it's likely that'll be cached and sent to other people.
- krapp 11y agoI'm getting an error trying to access the store right now, so I guess someone hit a Big Red Switch...
- simoncion 11y ago> EDIT: Steam fully down for now. Steam is up for me. Haven't tried the Steam Store, but messaging, game access, and Family Sharing are all fully functional.
- Havoc 11y agoTake that link down ASAP please. If it is a caching issue as suspected then all the hn crowd clicking on your link are getting their info cached & potentially exposed. Everyone just leave it alone & don't access any steam pages until the caching is fixed.
- minimaxir 11y agoRemoved it, but the point was that account info could be accessed by a logged-out user. Apparently, Google has actually cached these pages too.
- shawn-butler 11y agoThis is my worry. Steam shutting down doesn't mean anything to page that has been crawled already. Can't wait for the postmortem on this nonsense. Makes me wonder why I would trust Valve with any confidential info going forward.
- pbz 11y agoTheVerge: http://www.theverge.com/2015/12/25/10665814/valve-steam-holiday-sale-security-problems?utm_campaign=theverge&utm_content=chorus&utm_medium=social&utm_source=twitter http://www.theverge.com/2015/12/25/10665814/valve-steam-holi...
- pbz 11y agoThis is the kind of bug (assuming it's not a security breach) that would warrant a shutdown.
- anyfoo 11y agoI just tried it out after reading this, it's pretty crazy. I am clearly logged in with my own credentials, but if I go to "Account Details", I see the details of another user, which sometimes changes. As indicated in article, if I click on "Purchase History" or the link below, I sometimes see other user's data as well.
- Santzes 11y agoApparently it's a caching bug - if you add some random query parameters like ?r=123456789 to the url you get the correct page.
- benwilber0 11y agoyeah pretty obvious caching bug. im sure they accidentally told their cache to ignore cookies or something stupid.
- geofft 11y agoAmazon CloudFront all but encourages you to ignore cookies and query strings in caching. This is exactly what you want in some cases, like images or CSS, but it seems like a very dangerous option, and there's no scary text around the option.
- ChipWolf 11y agoValve would have to entirely rewrite their current caching system in order to repair this which they've avoided for so long.
- bottled_poe 11y agoEw, cookies? I thought those days were behind us..
- gizmo385 11y agoAs someone who really doesn't do that much web programming, what is the modern way to handle the kinds of information that cookies are/were used for?
- bottled_poe 11y agoSession variables are awful, which is the main selling point for cookies. I prefer basic auth with server-side user settings. This is how I implement stateless web apps and services, which greatly simplifies application architecture and makes it easy to implement automated atomic web testing.
- shiado 11y agoThis is an extremely serious breach of privacy. I hope there is massive legal fallout for Valve. You simply can't get away with leaking that kind of sensitive information. In the end I am guessing the blame will be shifted onto the group that was DDOSing steam earlier today instead of Valve running a configuration where this type of breach was possible.
- CaptSpify 11y ago> In the end I am guessing the blame will be shifted onto the group that was DDOSing steam earlier today instead of Valve running a configuration where this type of breach was possible. I doubt it. The "fail-state" for their website should be to just not work, vs expose other people's credentials. If it was proven that the attackers were able to change server configs, that'd be one thing, but that doesn't seem to be the case.
- bagels 11y agoUpdate on the article indicates they shut the site down. I was also confused when I started getting random pages in other languages, definitely stopped me from buying a game today.
- ChuckMcM 11y agoVery bad Christmas present for Valve it seems. Which is sad since I picked up Age of Empires and now can't login to get it on my system.
- xchaotic 11y agoI bet they had thought, let's turn up caching to the max so we don't get performance problems over Christmas.
- coderzach 11y agoHuh, I saw all the games in my cart disappear, I wonder if someone else mysteriously ended up with a cart full of games.
- SignMeTheHELLUp 11y agoCan anyone confirm, was it possible for someone to view data of a specific, chosen account or were people just being logged into random accounts. In other words, could an attacker exploit this bug to "dox" a specific target?
- renekooi 11y agoIt was random. According to SteamDB[1] it was a caching issue that ended up sending random pages to the wrong people. Possible explanation from unknown source: https://www.reddit.com/r/Steam/comments/3y7le9/im_logged_in_as_someone_random_on_steam/cyb88ym https://www.reddit.com/r/Steam/comments/3y7le9/im_logged_in_... [1]: https://twitter.com/SteamDB/status/680490823226671104 https://twitter.com/SteamDB/status/680490823226671104
- SignMeTheHELLUp 11y agoThanks. Based on that information any privacy-conscious users should simply not use Steam or the Steam website until the bug is fixed. By not using Steam, their pages won't end up in cache and will not be leaked to others.
- ryanlol 11y agoYeah, but there's other bugs that do let you do that (pull peoples account info). I've found a plenty of exploitable vulnerabilities on steam but stopped reporting them after their support told me to go post "suggestions" on their forums instead.
- XMPPwocky 11y agoEmail security@valvesoftware.com; I've reported loads of things there (some serious, some pretty trivial), and they're actually very good about responding to things these days. Steam Support is totally useless, though.
- XMPPwocky 11y ago
- tyfon 11y agoThis reminds me when one norwegian was a victim of a cache error in the yearly release of tax information. Everyone that logged in got his page until they shut it down. Although this steam error is a bit different with everyone getting random users, it seems likely that it is along the same lines. Over stressed servers maybe? http://www.tu.no/it/2012/03/23/altinn-feilen-er-funnet http://www.tu.no/it/2012/03/23/altinn-feilen-er-funnet (Norwegian)
- meesterdude 11y agoFor such a large company with so many developers, it's depressing how super crappy the steam client is, on both OSX and windows. Maybe it's "good enough" but it's clearly unpolished, and has been for years. Things like this do NOT instill any confidence that they are competent or care. Anytime I try to do something in steam, nothing ever seems to work.
- sotojuan 11y agoI don't know how a company that can afford to hire the best of the best and probably has a lot of people who want to work there can produce such a mediocre product as well as have huge errors like what is going on right now.
- sangnoir 11y agoThe "best" probably don't want to work on something as boring as the steam client. Given the choice of working on the Steam client, the Source Engine, or HL3 - which one would you choose? It's the downside of a flat organization where the staff choose what they work on, without being assigned tasks by management.
- rdl 11y agoIf I got to pick (not that I'm even a good developer, but as a PM) - the store/client hands down. Both because it is a glaring flaw now and because doing account and identity management securely is way more interesting to me than a random game.
- hellbanner 11y agoWell, you should apply!
- BuckRogers 11y agoI also find that to be interesting. I simply enjoy leaving no stone unturned, optimization as well as getting things right. That said, I'd never pass their interview process. I've failed many interviews because I'm more of a junior than a senior engineer. That's the downfall of only hiring the best and brightest. A bunch of cowboys leads to everyone wanting to do what a cowboy programmer thinks is cool or fun. I love writing utilities and making them user friendly as possible. I know many don't think it's possible but I love designing interfaces and dummy proofing them is one of my favorite things and I think I achieve it.
- JorgeGT 11y agoAbsolute silence from VALVe during a massive data breach, superb handling of the situation!
- rincebrain 11y agoSomeone upstream linked a moderator's quick notification that it's not someone having compromised their servers, and presumably we'll see some level of post-mortem after the fact. After the security issue a while ago where they forced everyone to change their passwords, I'm honestly not going to be concerned about their quiet until a while after things are back to normal.
- minimaxir 11y agoNote that data breach != "someone hacked us"
- deleted 11y ago[deleted]
- CaptSpify 11y agoThat is just how Valve is though. They are terrible at communication
- Guyag 11y agoIt's Christmas Day - I'm sure 99% of their staff are on holiday.
- ryanlol 11y agoIt's also probably their single biggest day of the year.
- baby 11y agoNot so long ago you could reset anyone's account password by just entering an empty reset token. I don't know what to think of steam. Is that what happens when an important piece of software is coded by game developers? Or when a company doesn't have a bug bounty?
- minimaxir 11y agoContext behind reset-anyone's-password: http://kotaku.com/steam-accounts-hijacked-following-security-lapse-1720288836 http://kotaku.com/steam-accounts-hijacked-following-security... Additionally, Steam was vulnerable to Heartbleed for a brief period of time: http://www.pcinvasion.com/steam-has-security-vulnerability-do-not-use-until-fixed http://www.pcinvasion.com/steam-has-security-vulnerability-d...
- CaptSpify 11y agoI wonder how many new accounts GOG will get out of this?
- em3rgent0rdr 11y agogog is great, but they don't have most newer games (although they get more everyday). Humble Bundle store does on the otherhand have most recent non-DRM games found on steam.
- danso 11y agoAs an OSX user who bought the Steam controller early, Valve gave me all of their current games plus put me on their Friends and Family list, which gifts me all of Valve's future games (ha, if they ever make them)...this was because the controller was mostly non-functional on OSX during the early launch...I wonder what the apology gift will be this time around? Edit: I should note that this gift totally pacified me...but probably cost Valve virtually nothing. To this day I still don't know if my steam controller experience on OSX is actually up to par with Windows/Steam users (beta client release notes feature OSX controller fixes frequently) because, who cares, I'm getting Half Life 3 free! OTOH there's just a handful of OSX Steam users relative to Windows, and even fewer who were early adopters of Steam software...I probably saw 5 other users in the same boat talk about the gift on Reddit.
- eswat 11y agoThey’ve been complacent for too long on polishing up the non-Windows and mobile clients. Their recent push to use the mobile app as an authenticator and the bugs surrounding that is a good example. I’m not at all surprised an issue like this has happened.
- sakopov 11y agoI don't get it. How can a company claim to hire the best and the brightest, have some of the toughest interviewing processes in the industry and yet produce a clunky slow piece of shit software that's been dragging its feet for nearly a decade resulting in your account information splattered all over someone's screen. What an embarrassment.
- brian-armstrong 11y agoRemember, these are people who are passionate about games, not necessarily games commerce platforms. It may be that most people, the best and brightest, choose not to wheel their desk to the Steam pod to do tedious, yet necessary, work to upgrade and polish it.
- dogma1138 11y agoValve puts more resources into Steam than all their games combined. Steam is their main platform, I had a chance to speak about several people who I know for a fact interned there (one stayed on as an employee) it's really not as chaotic and arbitrary as people think, you do not get to do just what ever the fuck you want regardless of what the scuttlebutt says.
- wlesieutre 11y agoFlip side of the "flat, work on what you're interested in" company hierarchy. If nobody goes to work for Valve thinking "I really love writing online stores wrapped in native apps with friends lists and voice chat bolted on the side," they don't progress very quickly.
- sergiotapia 11y agohttp://steamcommunity.com/discussions/forum/0/458604254431478327/ http://steamcommunity.com/discussions/forum/0/45860425443147... --- Account information incorrect We've gotten reports that people sometimes see other people's account information on the account page. Valve has been made aware of this and are working on a fix. Some frequently asked questions: - No, Steam is not hacked - Creditcard info and phone numbers are, as required by law, censored and not visible to users --- Wow, steam as always with the killer customer support.
- minimaxir 11y agoIt should be noted that this is from a moderator, and is not a official PR response.
- deleted 11y ago[deleted]
- ChuckMcM 11y agoWell at 3:15 PST there is some progress, now I can get to the store site again but it complains of too many failed logins. I wonder how long that will take to clear up.
- Xelom 11y agoIf no one at Valve choosing to work on Steam platform. I volunteer to work on it!
- r721 11y ago>Valve has issued a statement regarding today's issues. >"Steam is back up and running without any known issues," a Valve spokesperson told GameSpot. "As a result of a configuration change earlier today, a caching issue allowed some users to randomly see pages generated for other users for a period of less than an hour. This issue has since been resolved. We believe no unauthorized actions were allowed on accounts beyond the viewing of cached page information and no additional action is required by users." http://www.gamespot.com/articles/steam-issue-allowing-access-to-other-users-account/1100-6433371/ http://www.gamespot.com/articles/steam-issue-allowing-access...
- mastax 11y agoI'm surprised to see unanimus hate for the steam client on here. I've never had any problems with steam. Downloads are fast, the client is easy to use and not "slow and clunky" the voice chat works well, the new community features for games are great. Actually my only complaint is that there's no 'unsubscribe all' button on steam workshop. Is my experience entirely unique or is everyone remembering the old crappy steam client from 2004 (which was before I used steam)? Edit: Or, more likely, some third option in which case I'd like to hear your thoughts.