3 ms·
On a related note, Steam could (should?) also encrypt that data on disk, using a key derived from your Steam account ID (not your Steam password, because you ma
by k_sze 8y ago
On a related note, Steam could (should?) also encrypt that data on disk, using a key derived from your Steam account ID (not your Steam password, because you may need to change the password), so that no other process can snoop on your Steam profile without your explicit consent to begin with.
- Asooka 8y agoYour Steam account ID is trivial to figure out and once you know that, you can derive the decryption key, so what's the point? Though I guess TPM could be used here..
- k_sze 8y agoI was assuming that your steam account ID isn’t persisted in cleartext on disk either. Failing that, we could have a key that’s just stored on the Steam cloud and requires login to retrieve.
- guitarbill 8y agokey wrapping works fine. massively simplified: generate random secret, encrypt data with random secret, encrypt random secret with password, store that. so when your password is updated, you only have to update the encrypted random secret, not all the files.
- k_sze 8y agoWhat happens if you have your Steam profile on multiple machines and you need to change/reset the password?
- philpem 8y agoThe simple fact of the matter is, this shouldn't even be necessary. An application shouldn't be sniffing the user's private data from another app without explicit permission. This is literally the sort of thing a piece of malware would do, grab your data and upload it to the botnet...
- k_sze 8y agoI agree. But it doesn’t hurt to put up preemptive defense. In fact, the OS should also isolate and encrypt per-app profiles. And when one app wants to access data that belongs to another app, it should ask the user’s permission. I don’t know if any of the major desktop OSes (including Linus distros) already provide this kind of mechanism, and that it’s just the app developers not bothering to use the mechanisms.