4 ms·

Simply say that there is a typo in the steam configuration, it is connecting to the (insecure) URL http://.. http://... This allows steam network traffic to be

Simply say that there is a typo in the steam configuration, it is connecting to the (insecure) URL http://.. http://... This allows steam network traffic to be intercepted. It can be fixed by correcting the URL to https. For example, somebody using steam from a coffee shop could have his credentials/cookies/accounts intercepted by the coffee shop operator or any other visitor. I believe coffees and other gaming venues are a supported use case for steam and you do not wish to leave your users at risk. IMO There is really no need to blow this out of proportion. It's just a typo. Developers make typos all the time. Bet they're more likely to double check something trivial like that if pointed to.

restingrobot 7y ago
This is most likely not a typo. The redirect from http to http is most likely due to valve using a self signed ssl certificate and not directly exposing it to ATS, (iPhone). If they went directly to the https endpoint the OS would block the traffic to an invalid, (not CA authority signed), SSL certificate.
- kbenson 7y ago
  store.steampowered.com is a fully web accessible site with a CA signed certificate though. It's the main steam marketplace. I think the whole point is that they are leveraging this for their app, so using a self-signed CA doesn't make a lot of sense in that case (not that I'm sure it ever would for a company these days, SSL certs are cheap).
  - restingrobot 7y ago
    I don't think you understand. There is no such thing as a "self-signed" CA cert, (its one or the other). This not about money, it's about control. There are many benefits to using a self-signed SSL cert over purchasing a CA one. However, Apple and Android inherently distrust self-signed certs so you have to actually provide the cert directly to ATS/Android OS which involves bundling it within the app, (a messy process). The current industry "hack" is to use http within the app, and then re-direct to https, (which is exactly what the steam app does).
    - Arnavion 7y ago
      >There is no such thing as a "self-signed" CA cert, (its one or the other). Not sure what you're trying to say here. What a cert is signed by and what a cert's usage is set to are orthogonal things. There are CA certs that are self-signed (look in your OS's trusted roots cert store) and there are CA certs that are signed by other CA certs (intermediate CA certs).
    - detaro 7y ago
      Why does the redirected request accept a self-signed cert, but the initial request doesn't? That seems weird.
      - restingrobot 7y ago
        It depends on how the app is displaying the link. They could be setting all sorts of cookie info/metadata in the original http request. There are many answers as to why it is accepted. I'm obviously not the developer of the valve app so I can't tell you exactly.
        detaro 7y ago
        What doe cookies and metadata have to do with certificate validation?
        restingrobot 7y ago
        The http link could theoretically be serving the cert to the device. I'm not sure WHY they would do this, just guessing. However, the redirect makes it seem intentional for whatever reason.
    - kbenson 7y ago
      I understand, I mis-typed. I meant self-signed cert. That should have been pretty obvious from what I actually posted though. https://store.steampowered.com https://store.steampowered.com is the official steam marketplace. It does not use a self-signed certificate. > There are many benefits to using a self-signed SSL cert over purchasing a CA one. I'm sure there are (not that any are immediately coming to mind), but this is the official web marketplace. It is NOT self-signed. It's signed by DigiCert, Inc, which is easy to check if you go there. To clarify, store.steampowered.com is not some special app store subdomain. It's the official store, and where you are redirected in a browser if you go to steampowered.com. It is very unlikely they are using a self-signed certificate given it's an actual web address used by many tens of millions of people in their browsers primarily.

restingrobot 7y ago

This is most likely not a typo. The redirect from http to http is most likely due to valve using a self signed ssl certificate and not directly exposing it to ATS, (iPhone). If they went directly to the https endpoint the OS would block the traffic to an invalid, (not CA authority signed), SSL certificate.

kbenson 7y ago
store.steampowered.com is a fully web accessible site with a CA signed certificate though. It's the main steam marketplace. I think the whole point is that they are leveraging this for their app, so using a self-signed CA doesn't make a lot of sense in that case (not that I'm sure it ever would for a company these days, SSL certs are cheap).
- restingrobot 7y ago
  I don't think you understand. There is no such thing as a "self-signed" CA cert, (its one or the other). This not about money, it's about control. There are many benefits to using a self-signed SSL cert over purchasing a CA one. However, Apple and Android inherently distrust self-signed certs so you have to actually provide the cert directly to ATS/Android OS which involves bundling it within the app, (a messy process). The current industry "hack" is to use http within the app, and then re-direct to https, (which is exactly what the steam app does).
  - Arnavion 7y ago
    >There is no such thing as a "self-signed" CA cert, (its one or the other). Not sure what you're trying to say here. What a cert is signed by and what a cert's usage is set to are orthogonal things. There are CA certs that are self-signed (look in your OS's trusted roots cert store) and there are CA certs that are signed by other CA certs (intermediate CA certs).
  - detaro 7y ago
    Why does the redirected request accept a self-signed cert, but the initial request doesn't? That seems weird.
    - restingrobot 7y ago
      It depends on how the app is displaying the link. They could be setting all sorts of cookie info/metadata in the original http request. There are many answers as to why it is accepted. I'm obviously not the developer of the valve app so I can't tell you exactly.
      - detaro 7y ago
        What doe cookies and metadata have to do with certificate validation?
        restingrobot 7y ago
        The http link could theoretically be serving the cert to the device. I'm not sure WHY they would do this, just guessing. However, the redirect makes it seem intentional for whatever reason.
  - kbenson 7y ago
    I understand, I mis-typed. I meant self-signed cert. That should have been pretty obvious from what I actually posted though. https://store.steampowered.com https://store.steampowered.com is the official steam marketplace. It does not use a self-signed certificate. > There are many benefits to using a self-signed SSL cert over purchasing a CA one. I'm sure there are (not that any are immediately coming to mind), but this is the official web marketplace. It is NOT self-signed. It's signed by DigiCert, Inc, which is easy to check if you go there. To clarify, store.steampowered.com is not some special app store subdomain. It's the official store, and where you are redirected in a browser if you go to steampowered.com. It is very unlikely they are using a self-signed certificate given it's an actual web address used by many tens of millions of people in their browsers primarily.