3 ms·

True, but a tracking pixel is an active attack that leaves a visible trail. This leak is passive surveillance; I can silently graph the sleep cycles of 200 frie

by _wkvo 9mo ago

True, but a tracking pixel is an active attack that leaves a visible trail. This leak is passive surveillance; I can silently graph the sleep cycles of 200 friends without ever interacting with them. Trust shouldn't imply consent for invisible, automated logging.

wernerb 9mo ago
But your friends have accepted your request for friendship and your friends are not expecting you to spy on them correct?
- rvnx 9mo ago
  It's about when your friends were last signed-in in their account. From my understanding: Invisible = Sign-in but do not broadcast the games you are playing (though your profile will show that you signed-in) Offline = Stay offline and do not sign-in
  - nemomarx 9mo ago
    I mean the invisible status is supposed to hide all that, yeah. Why have a "show as offline" if it still shows activity like going online?
    - rvnx 9mo ago
      > Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix) On the profile of a friend you can see the last time they signed-in to their account: https://preview.redd.it/can-anyone-beat-my-last-online-friends-list-time-v0-c55ovbyjv1fb1.png?auto=webp&s=8e2074cbca04cd59f80e29fde847a58b703a26db https://preview.redd.it/can-anyone-beat-my-last-online-frien... Before it was public, and now restricted (for a couple of years already) to friends only. I guess this is why they won't change it, since it's a feature.
      - _wkvo 9mo ago
        Incorrect. "Invisible" is a privacy control, not just a UI filter. While the official client freezes the text, the backend still broadcasts live last_logon and last_logoff Unix timestamps in the ClientPersonaState packet. This leaks exact real-time sleep/wake cycles via the socket, completely bypassing the privacy toggle.
        rvnx 9mo ago
        But is it different from the "last signed-in" info that you see on the profile ? (genuinely asking) Because from the fields in the protobuf I somewhat suspect it's the same, but I get your point of view as well EDIT: If it's not, then my bad
- _wkvo 9mo ago
  Exactly. The 'Offline' feature exists specifically to set that boundary, and the backend completely ignores it.
nemomarx 9mo ago
How do you construct a sleep cycle out of login events? Does steam do one if the computer goes into standby etc?
- smileybarry 9mo ago
  Nope, going into standby is the same as logging off, since your client doesn't send keep alive packets anymore. (Not sure if macOS is an exception, because I think my MBP doesn't go into proper sleep if I keep Steam running)
  - nagisa 9mo ago
    MBP never goes into proper sleep. I got one from work that I don't use much outside of travel and haven't changed in any way past initial setup. It stays connected to WiFi and continuously broadcasts various discovery packets for the past month and a half since I last opened it up.
    - smileybarry 8mo ago
      I know that, I meant: Steam is preventing it from going into that sleep phase (it's still a sleep phase after all) and keeps the OS awake.
scratchyone 9mo ago
Do you really need an LLM to talk on HN? Genuinely, this research seems cool but its hard to trust your findings when there's clearly AI being used heavily in writing the article and in your comments here.

by _wkvo 9mo ago

wernerb 9mo ago

But your friends have accepted your request for friendship and your friends are not expecting you to spy on them correct?

rvnx 9mo ago
It's about when your friends were last signed-in in their account. From my understanding: Invisible = Sign-in but do not broadcast the games you are playing (though your profile will show that you signed-in) Offline = Stay offline and do not sign-in
- nemomarx 9mo ago
  I mean the invisible status is supposed to hide all that, yeah. Why have a "show as offline" if it still shows activity like going online?
  - rvnx 9mo ago
    > Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix) On the profile of a friend you can see the last time they signed-in to their account: https://preview.redd.it/can-anyone-beat-my-last-online-friends-list-time-v0-c55ovbyjv1fb1.png?auto=webp&s=8e2074cbca04cd59f80e29fde847a58b703a26db https://preview.redd.it/can-anyone-beat-my-last-online-frien... Before it was public, and now restricted (for a couple of years already) to friends only. I guess this is why they won't change it, since it's a feature.
    - _wkvo 9mo ago
      Incorrect. "Invisible" is a privacy control, not just a UI filter. While the official client freezes the text, the backend still broadcasts live last_logon and last_logoff Unix timestamps in the ClientPersonaState packet. This leaks exact real-time sleep/wake cycles via the socket, completely bypassing the privacy toggle.
      - rvnx 9mo ago
        But is it different from the "last signed-in" info that you see on the profile ? (genuinely asking) Because from the fields in the protobuf I somewhat suspect it's the same, but I get your point of view as well EDIT: If it's not, then my bad
_wkvo 9mo ago
Exactly. The 'Offline' feature exists specifically to set that boundary, and the backend completely ignores it.

nemomarx 9mo ago

How do you construct a sleep cycle out of login events? Does steam do one if the computer goes into standby etc?

smileybarry 9mo ago
Nope, going into standby is the same as logging off, since your client doesn't send keep alive packets anymore. (Not sure if macOS is an exception, because I think my MBP doesn't go into proper sleep if I keep Steam running)
- nagisa 9mo ago
  MBP never goes into proper sleep. I got one from work that I don't use much outside of travel and haven't changed in any way past initial setup. It stays connected to WiFi and continuously broadcasts various discovery packets for the past month and a half since I last opened it up.
  - smileybarry 8mo ago
    I know that, I meant: Steam is preventing it from going into that sleep phase (it's still a sleep phase after all) and keeps the OS awake.

scratchyone 9mo ago

Do you really need an LLM to talk on HN? Genuinely, this research seems cool but its hard to trust your findings when there's clearly AI being used heavily in writing the article and in your comments here.