23 ms·

Dozens of PC games drop tracking software after surveillance fears

195 points by pferde 8y ago

rostigerpudel 8y ago
>"People can have their own opinions on it but our data is not personally identifiable information (PII)," Err..isn't the point of this exercise to have enough data to identify who bought the game and why? I feel the exact kind of computer I use and the various customizations that lead to it being a unique machine are very personal and identifiable.
- zimbatm 8y ago
  That's the whole game, pretend that the information is not personally identifiable but it's just one lookup away when the person uses his credit card on any website that is part of the net.
  - nerdponx 8y ago
    The definition of PII needs to be expanded to "combinations of attributes that can uniquely identify a single individual with high probability."
    - mrmr1993 8y ago
      For the EU, the definition in the GDPR should cover this. From Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
    - daxelrod 8y ago
      That’s already the definition used in many contexts.
      - dahart 8y ago
        What contexts are you thinking of? I’d agree in the context of discussing de-anonymizing data. But all the policy, e.g., GDPR, and licenses that I’ve seen so far mean specifically 100% directly identifiable (such as name & address or SSN) when they say “personally identifiable information”, and especially when they use the acronym PII.
        DanBC 8y ago
        No, that's not what GDPR says. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...] > ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
        dahart 8y ago
        Yeah you’re right. I stand corrected, and I even read that section last week.
        mysterydip 8y ago
        One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.
    - deleted 8y ago
      [deleted]
    - tonyarkles 8y ago
      I'm a fun example here too. Through a quirk of how addresses are assigned in my city, and how postal codes are assigned in Canada, my house has a unique postal code. Given our postal code, you have 100% certainty, and 50% probability between me or my partner.
  - Cthulhu_ 8y ago
    A famous experiment was when Yahoo (I think) released a dump of anonymised search queries, however, they had a user identifier for each query so it was simple enough to combine the queries and find the person.
    - ryandrake 8y ago
      It was AOL, but yea, they didn't really think their method of "anonymizing the data" through.
  - manicdee 8y ago
    Just the fact that I browse exclusively in private mode from Australia, don't accept third party cookies, apparently have Ghostery installed and use Safari vX.Y is enough to narrow down my identity to about one person give or take. The information collected in this program is more than enough to identify me personally, and probably enough to start making some kind of psychological profile to help them predict how to convince me to vote for Donald Trump (or in my case, a Liberal Party member).
- black_puppydog 8y ago
  They "just" have a profile of "a person" that happens to match you to the last tiny detail. They don't put your name as a label onto that data, so it's "not" identifiable. Makes no difference for marketing purposes if they don't want to address you by name. But yeah, once linked to your name by one of those manymany data points they collected, it is very personal....
  - organsnyder 8y ago
    That would be considered PII at the healthcare organization I work for.
    - mattnewton 8y ago
      Because the people who work in the heath industry understand all usually all it takes is a name and some tiny fact like your adresss to unmask the dataset after the fact.
      - reaperducer 8y ago
        Because the health care industry has enough money to hire the best lawyers to advise on this sort of thing.
        tjoff 8y ago
        It really is common sense though. You only need good lawyers if you are trying to game it.
        mattnewton 8y ago
        I don’t think it’s about availability of money, companies don’t spend money they don’t have to. INAL but I believe it’s about HIPAA and related legislation making it their liability.
  - sdoering 8y ago
    Regarding the GDPR this is PII. They can squeel and wiggle. But as the use a thing called the internet to transfer this data, they receive something like an IP address. And that is PII. It wouldn't be a problem to collect that. If I am informed as well as have the (easy) ability to opt out. Did they collect after 25. of May? Wouldn't they be liable regarding GDPR?
- Flammy 8y ago
  No, the point is to collect enough info to link a user who launched the game to someone who clicked an ad. The problem Red Shell is trying to solve is the "download divide" -- You can track clicks/users on the web before they download, and you can track them after they launch your product, but you can't easily connect the two. As for why devs want this, if you know ad campaign 1 cost $1 and had 2000 clicks, and ad campaign 2 cost #1 had 1000 clicks, that is helpul but what you really want to know is "what is the lifetime value (LTV) vs cost of acquisition of users from campaign 1 vs 2" because if LTV is significantly different then despite higher cost it may clearly be worth it. But if you can't connect a user from before the download to after you can't do this sort of calculation. Devs really don't care who the users are, we just want to know how effective a campaign is compared to one another. Source: Was planning on integrating Red Shell ourselves before this (false) outrage made us cancel our plans.
  - rostigerpudel 8y ago
    While I agree that is what they officially say they do, the means employed go beyond that. From the article: > "These are generally data points about the user’s device, such as its operating system, installed fonts, browsers (and versions) used, timezone, language, the user’s in-game ID, and screen resolution. This is what Red Shell calls a ‘fingerprint’, which can also be made on games consoles as well as PCs." Such a fingerprint is very unique and can easily be connected to a person with very little effort down the line, even if now nobody does that (yeah, right). Personally, I do not trust any company that collects such detailed information without my informed consent and without a clear (i.e. verifiable and legally enforceable) pledge to delete that information when the original purpose has been served. This is exactly the overshooting behaviour that was rightfully targeted by the Europeans with their recent data protection law. edit: formatting
    - Flammy 8y ago
      That is correct. Red Shell also specifies to devs you should configure it to report some of those and not all should be reported. It provides guidelines for how many to report based on how many unique users you have/are expecting. All of these factors are available to web browsers (which is why they were chosen, so they can be matched up to web clicks). These are tracked in most web analytics suites today by default. Based on my research I don't believe that these (even all of them together) are PII.
- FussyZeus 8y ago
  If the data isn't at least somewhat identifiable, then how is it actionable? This is why I roll my eyes back into my head every time some marketing suit says "well we anonymize the information" and it's just flat out ridiculous if you think about it, if the information was properly anonymized, then IT COULDN'T BE USED FOR AD TARGETING. Full. Stop. So if the data collection is for ad targeting, then it's identifiable because it can't not be otherwise it would be useless for the thing it's collected for.
  - avarun 8y ago
    It's not being used for ad targeting. It's being used to track ad conversions, which is a completely different thing and can be done without PII.
    - actsasbuffoon 8y ago
      A web cookie can in some circumstances be considered PII: https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...
- duxup 8y ago
  >"People can have their own opinions on it but our data is not personally identifiable information (PII),"* *We sell it to others who do that!
jstanley 8y ago
I'm glad (some proportion of) the public at large is becoming as paranoid about being tracked as I have become. I never thought it would happen.
- jasonkostempski 8y ago
  Maybe one day it will be enough people that it's libre or GTFO for everything.
speeder 8y ago
The article wonders, why people got upset about Red Shell on Conan Exiles for example, but not on Civilization VI... I think it is related to two very important details. First, Red Shell purpose, as stated by Red Shell themselves, is to create a "fingerprint" of the computer, yes, each tidbit of info separately is not "identifiable" but the purpose of the software is build indentifiable information in first place. And second... the game where people found Red Shell first, and went nuts about it, Conan Exiles, is a game that lots of people don't want anyone to know they play it, the game has lots of very politically incorrect themes (slavery for example), and is very popular to use for Erotic Roleplay... People of course get paranoid when there tracking software in their porn!
- cbg0 8y ago
  > The article wonders, why people got upset about Red Shell on Conan Exiles for example, but not on Civilization VI... Actually there has been quite a bit of backlash, there's a thread with around 2000 comments about it in the forums: https://steamcommunity.com/app/289070/discussions/0/1709564118762025388/ https://steamcommunity.com/app/289070/discussions/0/17095641... Also, the recent reviews have been negative because of Red Shell. > Conan Exiles, is a game that lots of people don't want anyone to know they play it [...] and is very popular to use for Erotic Roleplay Citation required?
  - fao_ 8y ago
    > Citation required? Are you saying that it's difficult for you to google those search terms?
  - MaxBarraclough 8y ago
    I wonder if the top comment in that thread is accurate in saying it's against the GDPR. I suppose the real answer is that time will tell.
    - mrmr1993 8y ago
      As a general rule, if the data can be used to identify some users, it falls under the GDPR. From Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
deleted 8y ago
[deleted]
moviuro 8y ago
Steam (and others) really should scan for that kind of spyware in the files they provide to the players. Add a warning maybe (Contains a known spyware) or flat out refuse the editor to bundle that file with their game/app/whatever.
- nerdponx 8y ago
  I'd be surprised if Valve didn't have their own fingerprinting tech, e.g. for tracking users across multiple accounts (practical, benign use case: banning cheaters who were VAC banned but make new accounts).
  - hankhill 8y ago
    sure, I'm pretty sure they check for cheating, but it's not being collected to sell personal data to advertising firms to make an extra buck off the backs of people who already paid for their games
  - jrhurst 8y ago
    There no real benefit to any of that though. The steam client already collects all the data they need for this.
    - nerdponx 8y ago
      Does it matter if it's in the client or in the game itself?
- LinuxBender 8y ago
  That would be a great start. One of the ways malicious people circumvent that is to leverage the scripting that many of the games support. I have dug into many games that use LUA scripting and have appalling security practices. The worse offender is Garry's Mod. Trivial to dox players and fairly trivial in some cases to take over the players machines.
- ryandrake 8y ago
  Great suggestion. I agree that the distributor (Steam) should have to answer why they are allowing this malware to be distributed over their platform. They would reject a game that contained a virus or ransomware, but spyware is OK?
Flow 8y ago
I hope this tracking software never made it into the macOS versions of any of those games.
- hankhill 8y ago
  to be honest if i was a horrible person I'd develop a macOS version of the spyware first on the assumption that anyone playing on a mac is probably more wealthy (mac user and goes through the extra effort of playing games on macOS? yeah that's probably someone with a lot of money and technical knowledge) and thus a more valuable target for data harvesting and who knows what other purposes....
- gcb0 8y ago
  it likely have a different vendor with the exact same issues, but will take longer to be noticed. there is absolutely no game on steam without DRM and anti-cheat rootkits. none. zero. All games there have either or. including steam itself. It's all a matter of how far they go.
  - throwaway2048 8y ago
    Plenty of games on steam do not use steam DRM, and don't need steam running to launch, including most of valve's games. Most games, and obviously all single player games, also have no form of anti-cheat. https://pcgamingwiki.com/wiki/The_Big_List_of_DRM-Free_Games_on_Steam https://pcgamingwiki.com/wiki/The_Big_List_of_DRM-Free_Games... This list is pretty incomplete, and in my experience many if not most indie games fall into this category. Your assertions are entirely incorrect.
    - gcb0 8y ago
      > do not have DRM i said DRM and/or anti-cheat. 100% of valve games have anti-cheat. Both of those run as administrator and have a great deal of opaque control of your machine.
deleted 8y ago
[deleted]
shmerl 8y ago
Didn't every Unity3D game insert a tracking code that's working without users' consent?
- swebs 8y ago
  I don't know. Why don't you look it up?
  - shmerl 8y ago
    https://unity3d.com/legal/privacy-policy https://unity3d.com/legal/privacy-policy https://unity3d.com/legal/gdpr https://unity3d.com/legal/gdpr Despite their claims, I've never seen any opt out options like that. Games simply always collect data and send it "home". And really this should be opt-in.
ryandrake 8y ago
The responses from the game companies have been absolutely pathetic so far. They amount to "Blah blah blah, bbbbbut marketing!!" No apologies for what they were doing, just "sorry we got caught". No shame at all, and no recognition that they were shipping malware to their customers. Some have promised to remove it but find some other way of using my computer against their users. My computer is not a free resource for your marketing department. If the software is so benign, offer it to users as totally optional install or a separate download, and see how many agree to that offer. EDIT: For example, see the official response from the Quake Champions team [1]. Summary: This data vacuum is actually for your own good. That said, we’re busted! So we will remove it for now, and we will tell you about it when we add it later, when everyone chills out. EDIT2: Wow, so much garbage the further you get through the article: > [Adam Lieb] expressed his frustration with the response online, which he says painted a false picture of Red Shell as a spyware programme trying to sell data for malicious purposes. spy·ware noun software that enables a user to obtain covert information about another's computer activities by transmitting data covertly from their hard drive. While they may not be selling the data for malicious purposes, it is, by definition, spyware. 1: https://steamcommunity.com/games/611500/announcements/detail/1674658681938498204 https://steamcommunity.com/games/611500/announcements/detail...
- AdmiralAsshat 8y ago
  There needs to be some kind of codified Consumer Bill of Rights that says, in effect, "We paid for your product. You do not get to monetize us further after the point of sale." Companies could then signal whether they agree to adhere to that code of conduct or not, and use it as a selling point for consumers to tell, at a glance, whether they want to support said company or not.
  - wilsonnb2 8y ago
    Calling it a "codified Consumer Bill of Rights" makes it sound like you want it to be a law, but the second half of your statement makes it sound like you want it to be like the "certified humane" label on the eggs that I buy. I have no problem with it being an optional label, but I see no reason it should be enforced legally.
mattlondon 8y ago
The "contact us" link on the tracker's website appears to be broken: https://www.redshell.io https://www.redshell.io Not sure if that is deliberate or not, but I'd like to submit a GDPR subject access request! Coincidence? perhaps. Edit: privacy@redshell.io Looks like their webpage might be trying to do a "mailto:" link? For me it just opens a blank window and I cant be bothered to try and pick apart their javascript.
- agentdrtran 8y ago
  It's not broken, it's just a mailto. It works fine for me.
olodus 8y ago
Since what they check against is a fingerprint, couldn't Red Shell just hash the data they create that fingerprint from, making it so they can guarantee that they don't really know anything about the player's data, just that it fits the one that saw the ad? This seems so simple I almost feel like they would have some reason not to do it. Do they make money selling the data aswell as the fingerprint matching? Or am I completely misunderstanding it all?
- rincebrain 8y ago
  The problem with hashing it, from their perspective, is probably that they would like to be able to do analysis on the shared traits of the individuals whose data they harvested.
- whyever 8y ago
  They are hashing the data.
  - oehpr 8y ago
    Well... Yes they do. After you send the unhashed data to them. Check redshells API docs. They turn the data the games client sends to them into a hashed ID.
- kyle-rb 8y ago
  If you mean hashing the whole blob of data, one issue could be that if they ever wanted to add a new tracking data point, they would lose backward compatibility with their previously collected values. I guess they could fix that by making the hash of the added stuff separate, but that would be pretty weak when there isn't a ton of possibilities for the new data points.
legitster 8y ago
I don't get why this would stir controversy while Google Analytics would not - it appears they collect the same type of information. Are game devs not allowed the same type of tools that web devs are?
- majewsky 8y ago
  On the web, you can at least use a tracking blocker. That's much harder to do in games (unless you're blocking on the DNS level, which is at least a bit more involved than installing uBlock Origin).
  - legitster 8y ago
    Also, if you use a web-blocker, they can't create a fingerprint anyway.
    - swebs 8y ago
      You'd be surprised. Even though ublock origin and uMatrix are blocking most things, they're still able to build a unique fingerprint based on installed fonts, hash of canvas fingerprint, webGL fingerprint, etc. https://panopticlick.eff.org https://panopticlick.eff.org
- swebs 8y ago
  Perhaps it's because this tracking software is installed onto your machine without your consent, allowing it to be considered spyware. I agree that Google Analytics is just as bad, if not worse, but the fact that it's contained within webpages makes it harder to claim that it's spyware.
- epicide 8y ago
  For better or for worse, people get way more privacy conscious when they are paying for something.
- deckard1 8y ago
  GA is at least sandboxed by the browser. Red Shell could theoretically do whatever the hell it wants on your machine. And if it uses online updates, then you really never know what it could be tracking at any given time.
ChuckMcM 8y ago
If you have a product that runs on thousands of machines you will be approached by folks that sell this kind of app. Saying no takes integrity
davidhyde 8y ago
Why don't these game companies use a promotion code in their ads to track the ad to a sale? That way the customer feels like they're getting a deal and there is no need to fingerprint their machine. This seems like a fairly common practice in other industries.
- olyjohn 8y ago
  Why bother giving somebody a deal when they can just do whatever they want to your computer and have no repercussions?
  - trophycase 8y ago
    Well presumably they pay Red Shell? Or they sell your data. Idk how else Red Shell is making money.
- moviuro 8y ago
  Because then, you actually have some intellectual work to do: create specific vouchers, and keep track of them! Oh dear!
greymeister 8y ago
Just want to add that https://pi-hole.net/ https://pi-hole.net/ or something similar is a nice way to block at least DNS based traffic from this malware.
- monetus 8y ago
  Thanks for this.
actsasbuffoon 8y ago
> "Google tracks a lot more things than Red Shell, but people never complain about it." Sorry Abid, but that's not true. I avoid Google products and services because I am uncomfortable with how invasive their tracking program is. I've worked in advertising tech, and I have a good idea of what goes on inside these companies. I do not ever want to participate in that ecosystem again. I even browse the web with JavaScript disabled in order to avoid tracking. That said, I don't blame Abid. I know it can be hard to bootstrap a small games studio. In fact, I played one of his studio's games (the weapon shop one) and it was fun. I wish him and his company luck, but I hope he doesn't go back to tracking customers without consent. I avoid purchasing products that include this kind of tracking.
beenBoutIT 8y ago
Having a PS4/PS3 or a separate dedicated PC just for gaming is an easy way to keep any game-related problems from becoming much bigger.
manno23 8y ago
SWR
codedokode 8y ago
To me this looks like deceiving the customer. The advertisement for the game doesn't say that it would spy on you. People buy software thinking that it is just a game. There should not be such type of hidden functionality. This should not be normal. If the company wants to use tracking and analytics then they should at least disclose it in advertising materials, and on the game store page. Or maybe make two versions of the game, with and without tracking, so that anyone would be free to chose whatever they prefer. And who cares about marketing or ad performance? That is not a consumer's problem.
duxup 8y ago
Gah, I got a full screen pop up on mobile on wired.co.uk.... anyone else?

195 points by pferde 8y ago

>"People can have their own opinions on it but our data is not personally identifiable information (PII)," Err..isn't the point of this exercise to have enough data to identify who bought the game and why? I feel the exact kind of computer I use and the various customizations that lead to it being a unique machine are very personal and identifiable.

zimbatm 8y ago
That's the whole game, pretend that the information is not personally identifiable but it's just one lookup away when the person uses his credit card on any website that is part of the net.
- nerdponx 8y ago
  The definition of PII needs to be expanded to "combinations of attributes that can uniquely identify a single individual with high probability."
  - mrmr1993 8y ago
    For the EU, the definition in the GDPR should cover this. From Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  - daxelrod 8y ago
    That’s already the definition used in many contexts.
    - dahart 8y ago
      What contexts are you thinking of? I’d agree in the context of discussing de-anonymizing data. But all the policy, e.g., GDPR, and licenses that I’ve seen so far mean specifically 100% directly identifiable (such as name & address or SSN) when they say “personally identifiable information”, and especially when they use the acronym PII.
      - DanBC 8y ago
        No, that's not what GDPR says. https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; [...] > ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
        dahart 8y ago
        Yeah you’re right. I stand corrected, and I even read that section last week.
      - mysterydip 8y ago
        One of the various "protecting personal information" trainings I had to do for a US Govt job made mention of multiple non-identifiable pieces of information that combined could identify a person falling under PII, but how many is ok to put together was left purposely ambiguous.
  - deleted 8y ago
    [deleted]
  - tonyarkles 8y ago
    I'm a fun example here too. Through a quirk of how addresses are assigned in my city, and how postal codes are assigned in Canada, my house has a unique postal code. Given our postal code, you have 100% certainty, and 50% probability between me or my partner.
- Cthulhu_ 8y ago
  A famous experiment was when Yahoo (I think) released a dump of anonymised search queries, however, they had a user identifier for each query so it was simple enough to combine the queries and find the person.
  - ryandrake 8y ago
    It was AOL, but yea, they didn't really think their method of "anonymizing the data" through.
- manicdee 8y ago
  Just the fact that I browse exclusively in private mode from Australia, don't accept third party cookies, apparently have Ghostery installed and use Safari vX.Y is enough to narrow down my identity to about one person give or take. The information collected in this program is more than enough to identify me personally, and probably enough to start making some kind of psychological profile to help them predict how to convince me to vote for Donald Trump (or in my case, a Liberal Party member).
black_puppydog 8y ago
They "just" have a profile of "a person" that happens to match you to the last tiny detail. They don't put your name as a label onto that data, so it's "not" identifiable. Makes no difference for marketing purposes if they don't want to address you by name. But yeah, once linked to your name by one of those manymany data points they collected, it is very personal....
- organsnyder 8y ago
  That would be considered PII at the healthcare organization I work for.
  - mattnewton 8y ago
    Because the people who work in the heath industry understand all usually all it takes is a name and some tiny fact like your adresss to unmask the dataset after the fact.
    - reaperducer 8y ago
      Because the health care industry has enough money to hire the best lawyers to advise on this sort of thing.
      - tjoff 8y ago
        It really is common sense though. You only need good lawyers if you are trying to game it.
      - mattnewton 8y ago
        I don’t think it’s about availability of money, companies don’t spend money they don’t have to. INAL but I believe it’s about HIPAA and related legislation making it their liability.
- sdoering 8y ago
  Regarding the GDPR this is PII. They can squeel and wiggle. But as the use a thing called the internet to transfer this data, they receive something like an IP address. And that is PII. It wouldn't be a problem to collect that. If I am informed as well as have the (easy) ability to opt out. Did they collect after 25. of May? Wouldn't they be liable regarding GDPR?
Flammy 8y ago
No, the point is to collect enough info to link a user who launched the game to someone who clicked an ad. The problem Red Shell is trying to solve is the "download divide" -- You can track clicks/users on the web before they download, and you can track them after they launch your product, but you can't easily connect the two. As for why devs want this, if you know ad campaign 1 cost $1 and had 2000 clicks, and ad campaign 2 cost #1 had 1000 clicks, that is helpul but what you really want to know is "what is the lifetime value (LTV) vs cost of acquisition of users from campaign 1 vs 2" because if LTV is significantly different then despite higher cost it may clearly be worth it. But if you can't connect a user from before the download to after you can't do this sort of calculation. Devs really don't care who the users are, we just want to know how effective a campaign is compared to one another. Source: Was planning on integrating Red Shell ourselves before this (false) outrage made us cancel our plans.
- rostigerpudel 8y ago
  While I agree that is what they officially say they do, the means employed go beyond that. From the article: > "These are generally data points about the user’s device, such as its operating system, installed fonts, browsers (and versions) used, timezone, language, the user’s in-game ID, and screen resolution. This is what Red Shell calls a ‘fingerprint’, which can also be made on games consoles as well as PCs." Such a fingerprint is very unique and can easily be connected to a person with very little effort down the line, even if now nobody does that (yeah, right). Personally, I do not trust any company that collects such detailed information without my informed consent and without a clear (i.e. verifiable and legally enforceable) pledge to delete that information when the original purpose has been served. This is exactly the overshooting behaviour that was rightfully targeted by the Europeans with their recent data protection law. edit: formatting
  - Flammy 8y ago
    That is correct. Red Shell also specifies to devs you should configure it to report some of those and not all should be reported. It provides guidelines for how many to report based on how many unique users you have/are expecting. All of these factors are available to web browsers (which is why they were chosen, so they can be matched up to web clicks). These are tracked in most web analytics suites today by default. Based on my research I don't believe that these (even all of them together) are PII.
FussyZeus 8y ago
If the data isn't at least somewhat identifiable, then how is it actionable? This is why I roll my eyes back into my head every time some marketing suit says "well we anonymize the information" and it's just flat out ridiculous if you think about it, if the information was properly anonymized, then IT COULDN'T BE USED FOR AD TARGETING. Full. Stop. So if the data collection is for ad targeting, then it's identifiable because it can't not be otherwise it would be useless for the thing it's collected for.
- avarun 8y ago
  It's not being used for ad targeting. It's being used to track ad conversions, which is a completely different thing and can be done without PII.
  - actsasbuffoon 8y ago
    A web cookie can in some circumstances be considered PII: https://en.wikipedia.org/wiki/Personally_identifiable_information https://en.wikipedia.org/wiki/Personally_identifiable_inform...
duxup 8y ago
>"People can have their own opinions on it but our data is not personally identifiable information (PII),"* *We sell it to others who do that!

jstanley 8y ago

I'm glad (some proportion of) the public at large is becoming as paranoid about being tracked as I have become. I never thought it would happen.

jasonkostempski 8y ago
Maybe one day it will be enough people that it's libre or GTFO for everything.

speeder 8y ago

The article wonders, why people got upset about Red Shell on Conan Exiles for example, but not on Civilization VI... I think it is related to two very important details. First, Red Shell purpose, as stated by Red Shell themselves, is to create a "fingerprint" of the computer, yes, each tidbit of info separately is not "identifiable" but the purpose of the software is build indentifiable information in first place. And second... the game where people found Red Shell first, and went nuts about it, Conan Exiles, is a game that lots of people don't want anyone to know they play it, the game has lots of very politically incorrect themes (slavery for example), and is very popular to use for Erotic Roleplay... People of course get paranoid when there tracking software in their porn!

cbg0 8y ago
> The article wonders, why people got upset about Red Shell on Conan Exiles for example, but not on Civilization VI... Actually there has been quite a bit of backlash, there's a thread with around 2000 comments about it in the forums: https://steamcommunity.com/app/289070/discussions/0/1709564118762025388/ https://steamcommunity.com/app/289070/discussions/0/17095641... Also, the recent reviews have been negative because of Red Shell. > Conan Exiles, is a game that lots of people don't want anyone to know they play it [...] and is very popular to use for Erotic Roleplay Citation required?
- fao_ 8y ago
  > Citation required? Are you saying that it's difficult for you to google those search terms?
- MaxBarraclough 8y ago
  I wonder if the top comment in that thread is accurate in saying it's against the GDPR. I suppose the real answer is that time will tell.
  - mrmr1993 8y ago
    As a general rule, if the data can be used to identify some users, it falls under the GDPR. From Article 4(1): > ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

deleted 8y ago

[deleted]

moviuro 8y ago

Steam (and others) really should scan for that kind of spyware in the files they provide to the players. Add a warning maybe (Contains a known spyware) or flat out refuse the editor to bundle that file with their game/app/whatever.

nerdponx 8y ago
I'd be surprised if Valve didn't have their own fingerprinting tech, e.g. for tracking users across multiple accounts (practical, benign use case: banning cheaters who were VAC banned but make new accounts).
- hankhill 8y ago
  sure, I'm pretty sure they check for cheating, but it's not being collected to sell personal data to advertising firms to make an extra buck off the backs of people who already paid for their games
- jrhurst 8y ago
  There no real benefit to any of that though. The steam client already collects all the data they need for this.
  - nerdponx 8y ago
    Does it matter if it's in the client or in the game itself?
LinuxBender 8y ago
That would be a great start. One of the ways malicious people circumvent that is to leverage the scripting that many of the games support. I have dug into many games that use LUA scripting and have appalling security practices. The worse offender is Garry's Mod. Trivial to dox players and fairly trivial in some cases to take over the players machines.
ryandrake 8y ago
Great suggestion. I agree that the distributor (Steam) should have to answer why they are allowing this malware to be distributed over their platform. They would reject a game that contained a virus or ransomware, but spyware is OK?

Flow 8y ago

I hope this tracking software never made it into the macOS versions of any of those games.

hankhill 8y ago
to be honest if i was a horrible person I'd develop a macOS version of the spyware first on the assumption that anyone playing on a mac is probably more wealthy (mac user and goes through the extra effort of playing games on macOS? yeah that's probably someone with a lot of money and technical knowledge) and thus a more valuable target for data harvesting and who knows what other purposes....
gcb0 8y ago
it likely have a different vendor with the exact same issues, but will take longer to be noticed. there is absolutely no game on steam without DRM and anti-cheat rootkits. none. zero. All games there have either or. including steam itself. It's all a matter of how far they go.
- throwaway2048 8y ago
  Plenty of games on steam do not use steam DRM, and don't need steam running to launch, including most of valve's games. Most games, and obviously all single player games, also have no form of anti-cheat. https://pcgamingwiki.com/wiki/The_Big_List_of_DRM-Free_Games_on_Steam https://pcgamingwiki.com/wiki/The_Big_List_of_DRM-Free_Games... This list is pretty incomplete, and in my experience many if not most indie games fall into this category. Your assertions are entirely incorrect.
  - gcb0 8y ago
    > do not have DRM i said DRM and/or anti-cheat. 100% of valve games have anti-cheat. Both of those run as administrator and have a great deal of opaque control of your machine.

deleted 8y ago

[deleted]

shmerl 8y ago

Didn't every Unity3D game insert a tracking code that's working without users' consent?

swebs 8y ago
I don't know. Why don't you look it up?
- shmerl 8y ago
  https://unity3d.com/legal/privacy-policy https://unity3d.com/legal/privacy-policy https://unity3d.com/legal/gdpr https://unity3d.com/legal/gdpr Despite their claims, I've never seen any opt out options like that. Games simply always collect data and send it "home". And really this should be opt-in.

ryandrake 8y ago

The responses from the game companies have been absolutely pathetic so far. They amount to "Blah blah blah, bbbbbut marketing!!" No apologies for what they were doing, just "sorry we got caught". No shame at all, and no recognition that they were shipping malware to their customers. Some have promised to remove it but find some other way of using my computer against their users. My computer is not a free resource for your marketing department. If the software is so benign, offer it to users as totally optional install or a separate download, and see how many agree to that offer. EDIT: For example, see the official response from the Quake Champions team [1]. Summary: This data vacuum is actually for your own good. That said, we’re busted! So we will remove it for now, and we will tell you about it when we add it later, when everyone chills out. EDIT2: Wow, so much garbage the further you get through the article: > [Adam Lieb] expressed his frustration with the response online, which he says painted a false picture of Red Shell as a spyware programme trying to sell data for malicious purposes. spy·ware noun software that enables a user to obtain covert information about another's computer activities by transmitting data covertly from their hard drive. While they may not be selling the data for malicious purposes, it is, by definition, spyware. 1: https://steamcommunity.com/games/611500/announcements/detail/1674658681938498204 https://steamcommunity.com/games/611500/announcements/detail...

AdmiralAsshat 8y ago
There needs to be some kind of codified Consumer Bill of Rights that says, in effect, "We paid for your product. You do not get to monetize us further after the point of sale." Companies could then signal whether they agree to adhere to that code of conduct or not, and use it as a selling point for consumers to tell, at a glance, whether they want to support said company or not.
- wilsonnb2 8y ago
  Calling it a "codified Consumer Bill of Rights" makes it sound like you want it to be a law, but the second half of your statement makes it sound like you want it to be like the "certified humane" label on the eggs that I buy. I have no problem with it being an optional label, but I see no reason it should be enforced legally.

mattlondon 8y ago

The "contact us" link on the tracker's website appears to be broken: https://www.redshell.io https://www.redshell.io Not sure if that is deliberate or not, but I'd like to submit a GDPR subject access request! Coincidence? perhaps. Edit: privacy@redshell.io Looks like their webpage might be trying to do a "mailto:" link? For me it just opens a blank window and I cant be bothered to try and pick apart their javascript.

agentdrtran 8y ago
It's not broken, it's just a mailto. It works fine for me.

olodus 8y ago

Since what they check against is a fingerprint, couldn't Red Shell just hash the data they create that fingerprint from, making it so they can guarantee that they don't really know anything about the player's data, just that it fits the one that saw the ad? This seems so simple I almost feel like they would have some reason not to do it. Do they make money selling the data aswell as the fingerprint matching? Or am I completely misunderstanding it all?

rincebrain 8y ago
The problem with hashing it, from their perspective, is probably that they would like to be able to do analysis on the shared traits of the individuals whose data they harvested.
whyever 8y ago
They are hashing the data.
- oehpr 8y ago
  Well... Yes they do. After you send the unhashed data to them. Check redshells API docs. They turn the data the games client sends to them into a hashed ID.
kyle-rb 8y ago
If you mean hashing the whole blob of data, one issue could be that if they ever wanted to add a new tracking data point, they would lose backward compatibility with their previously collected values. I guess they could fix that by making the hash of the added stuff separate, but that would be pretty weak when there isn't a ton of possibilities for the new data points.

legitster 8y ago

I don't get why this would stir controversy while Google Analytics would not - it appears they collect the same type of information. Are game devs not allowed the same type of tools that web devs are?

majewsky 8y ago
On the web, you can at least use a tracking blocker. That's much harder to do in games (unless you're blocking on the DNS level, which is at least a bit more involved than installing uBlock Origin).
- legitster 8y ago
  Also, if you use a web-blocker, they can't create a fingerprint anyway.
  - swebs 8y ago
    You'd be surprised. Even though ublock origin and uMatrix are blocking most things, they're still able to build a unique fingerprint based on installed fonts, hash of canvas fingerprint, webGL fingerprint, etc. https://panopticlick.eff.org https://panopticlick.eff.org
swebs 8y ago
Perhaps it's because this tracking software is installed onto your machine without your consent, allowing it to be considered spyware. I agree that Google Analytics is just as bad, if not worse, but the fact that it's contained within webpages makes it harder to claim that it's spyware.
epicide 8y ago
For better or for worse, people get way more privacy conscious when they are paying for something.
deckard1 8y ago
GA is at least sandboxed by the browser. Red Shell could theoretically do whatever the hell it wants on your machine. And if it uses online updates, then you really never know what it could be tracking at any given time.

ChuckMcM 8y ago

If you have a product that runs on thousands of machines you will be approached by folks that sell this kind of app. Saying no takes integrity

davidhyde 8y ago

Why don't these game companies use a promotion code in their ads to track the ad to a sale? That way the customer feels like they're getting a deal and there is no need to fingerprint their machine. This seems like a fairly common practice in other industries.

olyjohn 8y ago
Why bother giving somebody a deal when they can just do whatever they want to your computer and have no repercussions?
- trophycase 8y ago
  Well presumably they pay Red Shell? Or they sell your data. Idk how else Red Shell is making money.
moviuro 8y ago
Because then, you actually have some intellectual work to do: create specific vouchers, and keep track of them! Oh dear!

greymeister 8y ago

Just want to add that https://pi-hole.net/ https://pi-hole.net/ or something similar is a nice way to block at least DNS based traffic from this malware.

monetus 8y ago
Thanks for this.

actsasbuffoon 8y ago

> "Google tracks a lot more things than Red Shell, but people never complain about it." Sorry Abid, but that's not true. I avoid Google products and services because I am uncomfortable with how invasive their tracking program is. I've worked in advertising tech, and I have a good idea of what goes on inside these companies. I do not ever want to participate in that ecosystem again. I even browse the web with JavaScript disabled in order to avoid tracking. That said, I don't blame Abid. I know it can be hard to bootstrap a small games studio. In fact, I played one of his studio's games (the weapon shop one) and it was fun. I wish him and his company luck, but I hope he doesn't go back to tracking customers without consent. I avoid purchasing products that include this kind of tracking.

beenBoutIT 8y ago

Having a PS4/PS3 or a separate dedicated PC just for gaming is an easy way to keep any game-related problems from becoming much bigger.

manno23 8y ago

SWR

codedokode 8y ago

To me this looks like deceiving the customer. The advertisement for the game doesn't say that it would spy on you. People buy software thinking that it is just a game. There should not be such type of hidden functionality. This should not be normal. If the company wants to use tracking and analytics then they should at least disclose it in advertising materials, and on the game store page. Or maybe make two versions of the game, with and without tracking, so that anyone would be free to chose whatever they prefer. And who cares about marketing or ad performance? That is not a consumer's problem.

duxup 8y ago

Gah, I got a full screen pop up on mobile on wired.co.uk.... anyone else?