6 ms·
Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix)
- bigyabai 9mo ago> Their logic: You have to be friends with the user to receive this packet. Therefore, a "trust relationship" exists. That logic is acceptable. You could also DM an offline friend a tracking pixel to reconstruct their activity, a lot of this endpoint security is entirely up to the user.
- pityJuke 9mo agoDisagree, that trust relationship implicitly includes a "I can opt out of you seeing my status if I set my status to offline" contract, because that is my expectation of Steam.
- deleted 9mo ago[deleted]
- _wkvo 9mo agoTrue, but a tracking pixel is an active attack that leaves a visible trail. This leak is passive surveillance; I can silently graph the sleep cycles of 200 friends without ever interacting with them. Trust shouldn't imply consent for invisible, automated logging.
- wernerb 9mo agoBut your friends have accepted your request for friendship and your friends are not expecting you to spy on them correct?
- rvnx 9mo agoIt's about when your friends were last signed-in in their account. From my understanding: Invisible = Sign-in but do not broadcast the games you are playing (though your profile will show that you signed-in) Offline = Stay offline and do not sign-in
- nemomarx 9mo agoI mean the invisible status is supposed to hide all that, yeah. Why have a "show as offline" if it still shows activity like going online?
- rvnx 9mo ago> Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix) On the profile of a friend you can see the last time they signed-in to their account: https://preview.redd.it/can-anyone-beat-my-last-online-friends-list-time-v0-c55ovbyjv1fb1.png?auto=webp&s=8e2074cbca04cd59f80e29fde847a58b703a26db https://preview.redd.it/can-anyone-beat-my-last-online-frien... Before it was public, and now restricted (for a couple of years already) to friends only. I guess this is why they won't change it, since it's a feature.
- _wkvo 9mo agoIncorrect. "Invisible" is a privacy control, not just a UI filter. While the official client freezes the text, the backend still broadcasts live last_logon and last_logoff Unix timestamps in the ClientPersonaState packet. This leaks exact real-time sleep/wake cycles via the socket, completely bypassing the privacy toggle.
- rvnx 9mo agoBut is it different from the "last signed-in" info that you see on the profile ? (genuinely asking) Because from the fields in the protobuf I somewhat suspect it's the same, but I get your point of view as well EDIT: If it's not, then my bad
- _wkvo 9mo agoExactly. The 'Offline' feature exists specifically to set that boundary, and the backend completely ignores it.
- nemomarx 9mo agoHow do you construct a sleep cycle out of login events? Does steam do one if the computer goes into standby etc?
- smileybarry 9mo agoNope, going into standby is the same as logging off, since your client doesn't send keep alive packets anymore. (Not sure if macOS is an exception, because I think my MBP doesn't go into proper sleep if I keep Steam running)
- nagisa 9mo agoMBP never goes into proper sleep. I got one from work that I don't use much outside of travel and haven't changed in any way past initial setup. It stays connected to WiFi and continuously broadcasts various discovery packets for the past month and a half since I last opened it up.
- smileybarry 8mo agoI know that, I meant: Steam is preventing it from going into that sleep phase (it's still a sleep phase after all) and keeps the OS awake.
- scratchyone 9mo agoDo you really need an LLM to talk on HN? Genuinely, this research seems cool but its hard to trust your findings when there's clearly AI being used heavily in writing the article and in your comments here.
- embedding-shape 9mo agoI dunno, the ground condition here is "You're invisible/office and no one can see your activity" but that turns out to not actually be fully true. Maybe if it said "You're invisible/offline to the public, but mostly invisible to your friends" it'd be more true and setting the correct expectations. But of course, that's not how that feature is being sold.
- causalscience 9mo agoIt's not acceptable. Nobody turns on invisible thinking "my friends can still see me".
- breakingcups 9mo agoI'm curious, in your logic, who else would you use the setting to go invisible for?
- vermilingua 9mo agoI have some workmates on Steam, and sometimes I come down with a cold right around game releases.
- Spunkie 9mo ago> You could also DM an offline friend a tracking pixel to reconstruct their activity, a lot of this endpoint security is entirely up to the user. Only for as long as they have the steam chat window open and your tracking pixel/message is a recent enough message to be actually loaded. I don't use steam chat enough to remember if they do any of these, but your plan also ignores any possible automatic security/scanning/proxy shenanigans on steams part that will muddy your pixels tracking data or just break it. > That logic is acceptable. I completely disagree. I use invisible status all the time on steam. I very much have an expectation that when set to invisible my friends would not be able to track my online status.
- ycombinatrix 9mo agoThe tracking pixel still needs to be clicked on. e.g. FB Messenger & WhatsApp have their own web scraping infrastructure to provide server side link previews & thereby mitigate tracking links. Not sure if Steam does the same currently.
- viraptor 9mo agoThis is why Signal allows you to disable automatic previews and read-indicators. Because it does matter for privacy.
- HeliumHydride 9mo agoWhat if the user keeps their PC on and never logs off?
- _wkvo 9mo agoPrivacy shouldn't require leaving your PC running 24/7.
- causalscience 9mo ago[flagged]
- dangus 9mo agoIt’s not that stupid, I think many PC gamers do exactly this, including me. Still, it’s a bug that should be fixed.
- Proofread0592 9mo agoYes in that case there would be no data transmitted, and no risk. Another example: if the user turns off "Turn on when Windows starts up" or whatever equivalent, this would also be a non-issue.
- ycombinatrix 9mo agoNot true - if users want to play a game without appearing online, this would still out them.
- deleted 9mo ago[deleted]
- uberman 9mo agoI'm not saying any tracking is great, but a couple of things here. I cant remember when if ever I logged out os steam and this is just shared with friends right? Not sure if this is a nothing burger or not.
- _wkvo 9mo agoIn this context, 'Logoff' triggers whenever the socket disconnects. So every time you shut down your PC or put it to sleep, that timestamp is updated and broadcast, even if you never explicitly clicked 'Sign Out'.
- uberman 8mo agoStill, I dont run steam on my laptop and on my gaming system that I let my kids use it never sleeps and restarts only as a result of windows update. The monitors do turn off but unless that counts as sleep as well I dont really see how this would be a thing at least as how we use steam.
- explodes 9mo agoPeople should always consider the "abusive friend" scenario with regards to privacy. Even marriages can be extremely abusive... The assumption that people on your friend's lists, Steam or anywhere (even just people in the same household) should be able to see your personal information, such as computer use, is a bananas assumption. It is an assumption that I'm pleased to say has failed privacy reviews at at least one company larger than Steam.
- snowmobile 9mo agoI think it's a quite small demographic that have abusive friends on Steam that they can't simply unfriend for whatever reason, and it's not a reasonable expectation on Steam to design for that case. It'd be like a pencil company trying to prevent people from writing hurtful messages.
- cluckindan 9mo agoWhat about people who have their online friends on Steam just to play together with someone else? Worst case, this could leak a child’s daily schedule to a predator.
- ycombinatrix 9mo agoBy that logic, we should remove all friend-level privacy settings entirely. I don't think that would go over well with most of the userbase.
- snowmobile 9mo agoNo, that is obviously not logical. A feature can be nice-to-have for most people, while still not needing to be perfectly secure against all sorts of far-fetched scenarios. If you want to guess how most of the userbase would react, just imagine how much the average user would care when you told them about this "vulnerability".
- godelski 9mo agoI'd think it's quite common to have "abusive friends" on Steam. It's not uncommon to get invites from people you've never met offline and were just in a game you played together. In that setting I don't think there's much "trust" happening. Certainly an average user would not think they are sharing this information with that type of person and certainly the average user believes that setting themselves to be invisible means nobody can see when they're online or any of their activity. Besides, why would it matter if it is common? At any given point in time Steam has 20m-45m active users. 0.01% is still 2k-4.5k people. Take every single person you know by name, this is probably 10x that. This is 10x-20x the number of friends the median facebook user has. It's a very small percentage but a very large number. We work in computing... scaling means small percentages are still big numbers.
- OsrsNeedsf2P 9mo agoSeems like a reasonable report to me. Offline mode intentionally hides you from friends in the UI, so you would assume it would keep you hidden. I have a number of friends who, for various social reasons, keep their Steam status as "Offline" so their friends don't know they're still logging in. If "Offline" can be bypassed, it ruins the point
- lifetimerubyist 9mo agoOffline status means "don't bother me".
- spartanatreyu 9mo agoIf Offline meant "don't bother me", it would be called "Don't bother me", or "do not disturb", and not "Offline"
- anonymous908213 9mo agoThe first thing I have to point out is that this entire article is clearly LLM-generated from start to finish. The second thing I have to point out is that bug bounty programs are inundated with garbage from people who don't know anything about programming and just blindly trust whatever the LLM says. We even have the 'author' reproducing this blind reinforcement in the article: "Tested Jan 2026. Confirmed working." The third thing I have to point out is that the response from Valve is not actually shown. We, the reader, are treated to an LLM-generated paraphrasal of something they may or may not have actually said. Is it possible this issue is real and that Valve responded the way they did? Perhaps, but the article alone leaves me extremely skeptical based on past experiences with LLM-generated bug bounty reports.
- gruez 9mo ago>The first thing I have to point out is that this entire article is clearly LLM-generated from start to finish. Is your LLM detector on a hairtrigger? At best the headings seem like LLM, but the rest don't look LLM generated.
- tim-kt 9mo agoIt does for me too. Especially the short parts with headings, the bold sentences in their own paragraph and especially formulations like "X isn't just... it's Y".
- hamstergene 9mo agoImagine being a person like me who has always been expressing himself like that. Using em dash, too. LLMs didn’t randomly invent their own unique style, they learned it from books. This is just how people write when they get slightly more literate than nowadays texting-era kids. And these suspicions are in vain even if happen to be right this one time. LLMs are champions of copying styles, there is no problem asking one to slap Gen Z slang all over and finish the post with the phrase “I literally can’t! <sad-smiley>”. “Detecting LLMs” doesn’t get you ahead of LLMs, it only gets you ahead of the person using them. Why not appreciate example of concise and on-point self-expression and focus on usefulness of content?
- Krede 9mo ago> I showed them how I could reconstruct a target's daily sleep cycles despite them being "Invisible" for weeks. Yes, if the target gets on their PC every day after they wake up.
- iLoveOncall 9mo agoAnd have Steam auto-launch on startup.
- accrual 9mo ago> Setting yourself to "Offline" is basically a UI illusion. I always assume this is such in every case. Every "I'm offline" or "hide me" or "don't save this" or "delete this forever!" UI element is a facade until proven otherwise. "Temporary" chats with LLMs are also permanent and are likely eventually public via massive data leak in future year 20XX.
- cptroot 9mo agoYou do know that you don't have to have Steam turn on on boot, right? You can launch Steam only when you want to play video games.
- cluckindan 9mo agoBut then you may have to wait for an update to download and install before playing.
- tabarnacle 9mo agoYou better be good for goodness sake.
- winterbloom 9mo agoif you're tracking someone's sleep schedule, you need a life
- BoredPositron 9mo agoIt's a hobby for someone extreme stans on twitch.
- throwerxyz 9mo agoIf your Steam online status is your sleep and wakeup schedule you've got bigger problems to worry about. If this is an issue to your friends on a gaming platform, you may want to relax more.
- liviux 9mo agoOMG, some of you guys are so paranoia with privacy. No one gives a &$#$ when you sleep. Get over it
- zwb2324550 9mo ago[dead]
- _wkvo 9mo agohttps://xmrcat.org/discord-invisibility-bypass https://xmrcat.org/discord-invisibility-bypass seems like steam is not alone :D