11 ms·
Epic Games Launcher appears to collect Steam friends and play history
- deleted 8y ago[deleted]
- hoorayimhelping 8y agoSkip the clickbaity title drama and read Epic's response, which is included a little bit lower down on the top post, before forming an opinion.
- minimaxir 8y agoThe title isn't clickbait and is the most fair phrasing possible for this situation. (the Epic response provides more sensible context for the allegations)
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- maze-le 8y agoStop that bikeshedding and apologism please, its neither constructive nor relevant
- eeeeeeeeeeeee 8y agoI bought Metro Exodus on Epic Games recently. It was my second experience outside of playing Fortnite on PC. I completely understand why people do not want to pay the Steam tax, but the Epic launcher is a scummy experience. Steam is popular and has a loud following because it does not make unethical choices that annoy users. I have no issue installing multiple launchers, either, but I don't want something running on my system that operates in an unethical manor. And it's tiring how common it is for companies to operate in this way, so we, as users, have to scrutinize their behavior heavily. For example: 1) By default, the Epic launcher appears to advertise "free games" via Windows notification (popups). I never deliberately opted in to this. When I first saw the notification, I was certain I had some sort of spyware on my system. It looked like a spammy advertisement you see in free mobile games. I don't believe even EA/ORIGIN has been gutsy enough to try something like this. 2) Epic launcher defaults to starting when Windows starts. I never explicitly opted in to this. I'm sure I "affirmed" this somehow via some kind of user agreement, but I don't ever remember seeing an explicit option.
- deleted 8y ago[deleted]
- DoofusOfDeath 8y ago> When I first saw the notification, I was certain I had some sort of spyware on my system. Apparently you were correct, based on this story.
- gruez 8y ago>1) By default, the Epic launcher appears to advertise "free games" via Windows notification (popups). I never deliberately opted in to this. How's that any different than steam showing popups for newly released games on startup? >When I first saw the notification, I was certain I had some sort of spyware on my system. It looked like a spammy advertisement you see in free mobile games. I don't believe even EA/ORIGIN has been gutsy enough to try something like this. So you're upset that the notification made you think your computer was infected? And you expect that epic games to have forseen this outcome? >2) Epic launcher defaults to starting when Windows starts. I never explicitly opted in to this. I'm sure I "affirmed" this somehow via some kind of user agreement, but I don't ever remember seeing an explicit option. AFAIK steam does the same. edit: Here are the default settings for a fresh steam install: https://i.imgur.com/2SNpi1O.png https://i.imgur.com/2SNpi1O.png. As you can see, steam engages in the same "unethical" behavior as epic.
- elefanten 8y agogp is referring to a Windows system notification, it appears in the bottom right. They don't look like the Epic client. The notification related setting in your screenshot causes the pop-up window upon launching Steam. But it's a window that belongs to the Steam client. It has the obvious interface styling of Steam and is titled "Steam - News". I agree with you that the "launch on startup" option would be better as opt-in. I agree with gp that Windows notifications are a step worse. edit- changed description of pop-up
- gruez 8y ago>I agree with gp that Windows notifications are a step worse. Let me get this straight: you think that showing a medium sized banner ad in a window is better than a few lines of text using the OS provided notification API? Why? If the position was reversed, I could very well imagine the opposite argument. eg. "boo epic shows this massive ad in your face, whereas steam uses a discreet notification"
- xupybd 8y agoI just attempted to sign up with Epic. Only my email address had already been signed up. I used the password reset and took over the account. No games just setup with a strange name and in Thailand. Now I can’t buy games because of the country. I can’t change country. Support wants a photo of my passport, that’s not happening, to change country. I found an article showing many email addresses had been signed up in the same way. Epic was not validating email addresses. They’ve lost my business.
- mattigames 8y agoWhat is the incentive for people to pretend they own those email addresses?
- xupybd 8y agoNo idea the only feasible possibility I've come up is to damage Epics customer relations. I don't know maybe it was just some idiot with a list of emails and script but no real game plan. Here is the an article discussing others with the same issue https://twinfinite.net/2019/03/psa-epic-store-doesnt-validate-email-addresses/ https://twinfinite.net/2019/03/psa-epic-store-doesnt-validat... Here is the last email I got from Epic: Jan E. March 15, 2019, 11:39 +1300 | Conversation ID: #9950515 Hi (Player's Name), Thanks for the information! I know how important it is for you to update and change your country to your Epic account. No worries, I got your back and I'll do my very best to assist you with your request. Additionally, I know how frustrating it can be. Please know that here at Epic Games, we are serious about the player's security and we assure you that your email address is secured as long as you keep the password updated or enable 2FA. In order to change the country on your account I will need you to reply with an image of one of the following items with your name and address visible: Passport Personal identification *Recent rent or mortgage statement Any other personal information should be blacked out. I'll be looking forward to hearing from you soon.
- RandomTisk 8y agoCanned response hell. So helpful it isn't.
- vamos_davai 8y agoI don't see what's wrong with this if they asked for permission first. I gave access to Epic Games to collect info on who my steam friends are so I could play Apex with them.
- minimaxir 8y agoPart of the allegations are that information was collected before permission was given.
- phonypc 8y agoConfusing Epic launcher for Origin? Or Fortnite for Apex?
- vamos_davai 8y agoAh I did confuse Origin Launcher for Epic. Thanks for addressing that.
- slashink 8y agoI’ll post Epic Games response in the thread here also. ——————————— We use a tracking pixel (tracking.js) for our Support-A-Creator program so we can pay creators. We also track page statistics. The launcher sends a hardware survey (CPU, GPU, and the like) at a regular interval as outlined in our privacy policy(see the “Information We Collect or Receive” section). You can find the code here. The UDP traffic highlighted in this post is a launcher feature for communication with the Unreal Editor. The source of the underlying system is available on github. The majority of the launcher UI is implemented using web technology that is being rendered by Chromium (which is open source). The root certificate and cookie access mentioned above is a result of normal web browser start up. The launcher scans your active processes to prevent updating games that are currently running. This information is not sent to Epic. We only import your Steam friends with your explicit permission. The launcher makes an encrypted local copy of your localconfig.vdf Steam file. However information from this file is only sent to Epic if you choose to import your Steam friends, and then only hashed ids of your friends are sent and no other information from the file. Epic is controlled by Tim Sweeney. We have lots of external shareholders, none of whom have access to customer data. Daniel Vogel VP of Engineering Epic Games Inc.
- foxes 8y ago>The launcher makes an encrypted local copy of your localconfig.vdf Steam file. This should not be done preemptively.
- sigmar 8y agoTotally agree. It is too difficult for the average consumer to find out what is does with that "local copy." Software shouldn't touch another program's file without user consent.
- AnIdiotOnTheNet 8y agoIt's high time we started enforcing that by default at the OS level.
- keithnoizu 8y agoJokes on them, I don't have any friends.
- m463 8y agoThe fact that they even mess with files outside their directory means any answer they give is ingenuous. Some other steam games have much worse behavior. The EULA you had to accept for Square Enix games was so horrible that I have games purchased on my system that I will not play. I should probably ask steam for a refund. If you want an interesting book to read, I recommend Dan Ariely's "The honest truth about dishonesty". In particular, license agreements seem to work like disclosure he mentions. The way it works is that there is a veneer of justification that allows for all sorts of unethical behavior.
- rurounijones 8y agoOh dear, I have a bunch bought(mostly due to nostalgia, haven't played them on steam) Can you give an example and the shennanigans it does?
- m463 8y agoI remember the last time I tried launching a square enix game I got to the accept dialog and read the terms and conditons. Since then I think they have reworded their privacy policy. It used said they could collect basically every interaction you ever had with their games, information on your system unrelated to the game, and when agreeing it was binding, irrevocable and forever. the current policy is here, and it is still amazing: https://www.square-enix-games.com/en_US/documents/privacy https://www.square-enix-games.com/en_US/documents/privacy read the first section - they basically collect everything they can and can share it with everybody.
- Benjamin_Dobell 8y agoI don't know if it was in response to this debacle, but Epic Games have published a public roadmap for the Epic Games launcher on Trello: https://trello.com/b/GXLc34hk/epic-games-store-roadmap https://trello.com/b/GXLc34hk/epic-games-store-roadmap
- Disparallel 8y agoNote that the original reddit thread[1] is pretty suspect and alarmist. The OP is clearly inexperienced with the process inspection tools they are playing around with. They complain about the launcher using minified JS, opening dlls, and checking root certificates among other things all of which are very normal things for a desktop application to do. [1]https://www.reddit.com/r/PhoenixPoint/comments/b0rxdq/epic_game_store_spyware_tracking_and_you/ https://www.reddit.com/r/PhoenixPoint/comments/b0rxdq/epic_g...
- k_sze 8y agoOn a related note, Steam could (should?) also encrypt that data on disk, using a key derived from your Steam account ID (not your Steam password, because you may need to change the password), so that no other process can snoop on your Steam profile without your explicit consent to begin with.
- Asooka 8y agoYour Steam account ID is trivial to figure out and once you know that, you can derive the decryption key, so what's the point? Though I guess TPM could be used here..
- k_sze 8y agoI was assuming that your steam account ID isn’t persisted in cleartext on disk either. Failing that, we could have a key that’s just stored on the Steam cloud and requires login to retrieve.
- guitarbill 8y agokey wrapping works fine. massively simplified: generate random secret, encrypt data with random secret, encrypt random secret with password, store that. so when your password is updated, you only have to update the encrypted random secret, not all the files.
- k_sze 8y agoWhat happens if you have your Steam profile on multiple machines and you need to change/reset the password?
- philpem 8y agoThe simple fact of the matter is, this shouldn't even be necessary. An application shouldn't be sniffing the user's private data from another app without explicit permission. This is literally the sort of thing a piece of malware would do, grab your data and upload it to the botnet...
- stunt 8y agoIt would be Epic, if it was true.
- xwat 8y agoThere's also this annoying problem with the launcher multicasting stuff on network constantly. https://www.epicgames.com/fortnite/forums/bug-reports/battle-royale-aa/455395-aggressive-multicasting https://www.epicgames.com/fortnite/forums/bug-reports/battle...
- scoutt 8y agoAny explanation on why the links for the source code on Github are dead, and the repositories are gone?
- Criper1Tookus 8y agoWhy I'm not surprised some people are already defending or at least minimizing this? I certainly don't want one program snooping data from other installed programs without my explicit permission. And this explains how Galyonkin knew how much of the Fortnite players had Steam installed and, specifically, were using it on a regular basis.
- Gunstig2Snath 8y agoEven if you didn't install it, one of your steam friends probably did which included you with it :O
- ratling 8y agoI mean, they're owned by Tencent and have zero experience with this outside of Fortnite. Pretty much what I expected to happen (not this specific gaffe but in general). About what I expected. Say what you want about Steam but they made most of their most dumbass mistakes years ago and learned from them.