6 ms·

Can someone confirm if I've understood this right? When you view a red shell enabled ad, a script on the page (or perhaps the ad server itself, based on HTTP h

Can someone confirm if I've understood this right? When you view a red shell enabled ad, a script on the page (or perhaps the ad server itself, based on HTTP headers) computes a fingerprint of your browser (IP address, browser version, fonts installed, screen size etc.) and stores (ad_id, fingerprint) in a database somewhere. When you install and run a red shell enabled game, it computes the fingerprint of your machine and sends (game_id, fingerprint) to the server, which stores this in another table. By joining these tables on the fingerprint, you can get some info on which ads are correlated with which game purchases. Apart from this, red shell does NOT modify your browser settings, inject code into all pages you visit, add a browser toolbar, constantly run in the background, MITM your TLS or anything else like that. [EDIT: not trying to defend red shell here, just checking whether I need do a full reinstall of my PC to get rid of this thing]

durzagott 8y ago
Are you implying this somehow makes it ok?
- red_admiral 8y ago
  No - what part of my post are you interpreting like that? I'm happy to edit if I'm giving the wrong impression. I just want to know how worried I need to be about my own gaming PC at the moment.
  - durzagott 8y ago
    "Apart from this, red shell does NOT modify your browser settings, inject code into all pages you visit, add a browser toolbar, constantly run in the background, MITM your TLS or anything else like that." This is the part that made me think you were defending it. My apologies for misunderstanding.
  - ekianjo 8y ago
    > I just want to know how worried I need to be about my own gaming PC at the moment. Not sure if you play on Linux at all, but a good way to start is to run Steam in firejail. It isolates that environment from the rest of the OS. https://wiki.archlinux.org/index.php/Firejail https://wiki.archlinux.org/index.php/Firejail
    - ac29 8y ago
      Be careful with firejail, it comes with its own security implications, and has bad a history of pretty nasty exploits: https://www.reddit.com/r/linux/comments/79mmzk/sandbox_your_applications_with_firejail/dp37pga https://www.reddit.com/r/linux/comments/79mmzk/sandbox_your_...
- Jommi 8y ago
  Isn't this just beneficial for everyone? Why wouldn't it be okay?
  - probably_wrong 8y ago
    It is detrimental to the privacy of the players. That makes it not okay.
    - Jommi 8y ago
      So where do we draw the line? Is all analytics without permission not okay?
      - probably_wrong 8y ago
        If you live in Europe, the answer seems to be "indeed, all analytics without permission are not okay". If you live in the US, it seems to be "whatever you can get away with". Gamers seem to agree that this company should not get away with this. Wherever "we" have drawn the line, Red Shell has apparently crossed it.
  - IGI-111 8y ago
    Pretty sure spying on people who just want to play a video game without telling them or letting them opt out ahead of time is not only a bit immoral but also very much illegal, at least in Europe. I doubt the form they have on their website where you have to know your id to opt out of the spying would hold up in court.
    - pndy 8y ago
      And that's probably why they gladly removed that piece of software - they would risk being fined in long term in Europe, I believe. Opt-out as someone already noted, is available on red shell company site but I would try to block it in hosts instead of going on site where you can be again tracked. In a nearly ideal world, Firaxis would ask their customers if they agree for this e-life "improvement" of more accurate ads and whatnot else. In a perfect one, they wouldn't bother including Red Shell at all.
durzagott 8y ago
Just to answer your question properly, I don't think you need to reinstall your PC to get rid of it. Most games are now removing it through an update. There's a thread on Reddit that collates which games are still using Red Shell and which have removed it: https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell_spyware_holy_potatoes_were_in_space/ https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell... I think you can just uninstall the ones that aren't planning to remove it yet. Also, you can opt-out from RedShell's website. Although it doesn't seem straight forward to me: https://redshell.io/optout https://redshell.io/optout
- ryandrake 8y ago
  It would be nice if malware and antivirus scanners could find/remove it too. I'm kind of miffed that the antivirus software I pay for let this stuff remain on my Windows partition for months even after the software was known to exist.
  - icebraining 8y ago
    Removing it will probably break the game (it's a DLL loaded by the game executable, and I'm guessing most game devs don't bother to correctly handle its absence).
- uremog 8y ago
  People were suggesting the home remedy of adding redshell sites that the software reports to to your hosts list.
hiccuphippo 8y ago
Is there some Panopticlick-like program to test how trackable my PC can be? Other than what fonts are installed, what other ways are there to id a PC from an arbitrary program that can be also checked from the browser?
- blattimwind 8y ago
  Pretty sure everything but VM clones are uniquely identifiable. Windows itself generates a ton of GUIDs at installation-time, things like graphics drivers also generate install-IDs and so on.
crag 8y ago
Why fonts? Or do they use fonts as an ID?
- heroprotagonist 8y ago
  It's one factor in a set of variables, that when combined can pinpoint you uniquely. This helps them overcome anti-tracking mechanisms like disabling cookies and such. Basically, by implementing this kind of technology, they know you don't want to be tracked and are attempting to do so anyway. See the mechanisms used for this browser test, particularly the link for 'fingerprinting' after running the test: https://panopticlick.eff.org https://panopticlick.eff.org
- ballenf 8y ago
  Because every browser except the latest from Apple will happily tell every website you visit exactly what fonts you have installed. And that list changes very slowly over time, if ever, you know kind of like those patterns of skin ridges on your fingers.
- drbawb 8y ago
  Fonts are part of the fingerprint, especially if you know the OS. You take the set of installed fonts and subtract the set of OS default fonts, and you are likely to arrive at a unique key. Take my corporate domain for instance: you could identify any machine on my domain since we'd all have a custom typeface installed (used on our company letterhead.) You could further identify our marketing coordinator, because she has a lot of strange typefaces used for signage and promotions. You could probably further identify me as a web developer since I have a lot of WOFF2 packaged fonts installed.
  - ballenf 8y ago
    Side question -- do/could type foundries find pirate companies by looking at IP addresses using paid fonts without a license? Hardest part would be linking paid licenses to IP addresses, making individual unpaid usage harder to nail down. But if a company with dozens or hundreds of users at a single IP address all had a particular font installed, that IP was linkable to the company, and company didn't have a license, wouldn't that be pretty damning evidence? Typeface piracy is otherwise pretty difficult to detect isn't it? Is it part of normal enterprise asset tracking / inventory systems?

durzagott 8y ago

Are you implying this somehow makes it ok?

red_admiral 8y ago
No - what part of my post are you interpreting like that? I'm happy to edit if I'm giving the wrong impression. I just want to know how worried I need to be about my own gaming PC at the moment.
- durzagott 8y ago
  "Apart from this, red shell does NOT modify your browser settings, inject code into all pages you visit, add a browser toolbar, constantly run in the background, MITM your TLS or anything else like that." This is the part that made me think you were defending it. My apologies for misunderstanding.
- ekianjo 8y ago
  > I just want to know how worried I need to be about my own gaming PC at the moment. Not sure if you play on Linux at all, but a good way to start is to run Steam in firejail. It isolates that environment from the rest of the OS. https://wiki.archlinux.org/index.php/Firejail https://wiki.archlinux.org/index.php/Firejail
  - ac29 8y ago
    Be careful with firejail, it comes with its own security implications, and has bad a history of pretty nasty exploits: https://www.reddit.com/r/linux/comments/79mmzk/sandbox_your_applications_with_firejail/dp37pga https://www.reddit.com/r/linux/comments/79mmzk/sandbox_your_...
Jommi 8y ago
Isn't this just beneficial for everyone? Why wouldn't it be okay?
- probably_wrong 8y ago
  It is detrimental to the privacy of the players. That makes it not okay.
  - Jommi 8y ago
    So where do we draw the line? Is all analytics without permission not okay?
    - probably_wrong 8y ago
      If you live in Europe, the answer seems to be "indeed, all analytics without permission are not okay". If you live in the US, it seems to be "whatever you can get away with". Gamers seem to agree that this company should not get away with this. Wherever "we" have drawn the line, Red Shell has apparently crossed it.
- IGI-111 8y ago
  Pretty sure spying on people who just want to play a video game without telling them or letting them opt out ahead of time is not only a bit immoral but also very much illegal, at least in Europe. I doubt the form they have on their website where you have to know your id to opt out of the spying would hold up in court.
  - pndy 8y ago
    And that's probably why they gladly removed that piece of software - they would risk being fined in long term in Europe, I believe. Opt-out as someone already noted, is available on red shell company site but I would try to block it in hosts instead of going on site where you can be again tracked. In a nearly ideal world, Firaxis would ask their customers if they agree for this e-life "improvement" of more accurate ads and whatnot else. In a perfect one, they wouldn't bother including Red Shell at all.

durzagott 8y ago

Just to answer your question properly, I don't think you need to reinstall your PC to get rid of it. Most games are now removing it through an update. There's a thread on Reddit that collates which games are still using Red Shell and which have removed it: https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell_spyware_holy_potatoes_were_in_space/ https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell... I think you can just uninstall the ones that aren't planning to remove it yet. Also, you can opt-out from RedShell's website. Although it doesn't seem straight forward to me: https://redshell.io/optout https://redshell.io/optout

ryandrake 8y ago
It would be nice if malware and antivirus scanners could find/remove it too. I'm kind of miffed that the antivirus software I pay for let this stuff remain on my Windows partition for months even after the software was known to exist.
- icebraining 8y ago
  Removing it will probably break the game (it's a DLL loaded by the game executable, and I'm guessing most game devs don't bother to correctly handle its absence).
uremog 8y ago
People were suggesting the home remedy of adding redshell sites that the software reports to to your hosts list.

hiccuphippo 8y ago

Is there some Panopticlick-like program to test how trackable my PC can be? Other than what fonts are installed, what other ways are there to id a PC from an arbitrary program that can be also checked from the browser?

blattimwind 8y ago
Pretty sure everything but VM clones are uniquely identifiable. Windows itself generates a ton of GUIDs at installation-time, things like graphics drivers also generate install-IDs and so on.

crag 8y ago

Why fonts? Or do they use fonts as an ID?

heroprotagonist 8y ago
It's one factor in a set of variables, that when combined can pinpoint you uniquely. This helps them overcome anti-tracking mechanisms like disabling cookies and such. Basically, by implementing this kind of technology, they know you don't want to be tracked and are attempting to do so anyway. See the mechanisms used for this browser test, particularly the link for 'fingerprinting' after running the test: https://panopticlick.eff.org https://panopticlick.eff.org
ballenf 8y ago
Because every browser except the latest from Apple will happily tell every website you visit exactly what fonts you have installed. And that list changes very slowly over time, if ever, you know kind of like those patterns of skin ridges on your fingers.
drbawb 8y ago
Fonts are part of the fingerprint, especially if you know the OS. You take the set of installed fonts and subtract the set of OS default fonts, and you are likely to arrive at a unique key. Take my corporate domain for instance: you could identify any machine on my domain since we'd all have a custom typeface installed (used on our company letterhead.) You could further identify our marketing coordinator, because she has a lot of strange typefaces used for signage and promotions. You could probably further identify me as a web developer since I have a lot of WOFF2 packaged fonts installed.
- ballenf 8y ago
  Side question -- do/could type foundries find pirate companies by looking at IP addresses using paid fonts without a license? Hardest part would be linking paid licenses to IP addresses, making individual unpaid usage harder to nail down. But if a company with dozens or hundreds of users at a single IP address all had a particular font installed, that IP was linkable to the company, and company didn't have a license, wouldn't that be pretty damning evidence? Typeface piracy is otherwise pretty difficult to detect isn't it? Is it part of normal enterprise asset tracking / inventory systems?