> In the end I am guessing the blame will be shifted onto the group that was DDOSing steam earlier today instead of Valve running a configuration where this typ

> In the end I am guessing the blame will be shifted onto the group that was DDOSing steam earlier today instead of Valve running a configuration where this type of breach was possible. I doubt it. The "fail-state" for their website should be to just not work, vs expose other people's credentials. If it was proven that the attackers were able to change server configs, that'd be one thing, but that doesn't seem to be the case.