4 ms·
This sucks. We run steam on some public PCs with unprivileged accounts and we wouldn't be very happy to find that users were able to gain admin access and steal
by mordae 7y ago
This sucks. We run steam on some public PCs with unprivileged accounts and we wouldn't be very happy to find that users were able to gain admin access and steal other people's passwords through a keylogger. Sigh.
- sushisource 7y agoThat seems to me the most obvious problem use case here. How can Valve possibly think that isn't important?
- chii 7y agobecause their security model is too myopic. By defining security vulnerability to be only remote code execution from within the steam client, they save themselves a tonne of work (and cost). I can understand that perspective - steam can't spend the time to rewrite to fix the EoP/LPE issues. Their stance must be that the user has to "be careful" not to install malware or other vulnerable software, instead of fixing steam.
- ohithereyou 7y agoCybercafes, LAN gaming centers, and PC bangs are about to have some interesting times.