Epic Games Launcher appears to collect Steam friends and play history

Totally agree. It is too difficult for the average consumer to find out what is does with that "local copy." Software shouldn't touch another program's file without user consent.

It's probably to keep things working through a change in steam.

"I am altering the deal. Pray I don't alter it any further."

~ Darth Vader

You can read the changes to the ToS at www.palpatine2020.com/toremotetomakeaneffectdemonstration

I'm starting to think something like flatpak or snap is necessary, but in a more sandboxed way, to enforce on the user level that certain apps won't have access to certain files. I would like to see options to fully sandbox an app (has it's own separate permissions for certain documents) or not sandbox it at all (for things we trust implicitly that need that access).

gp is referring to a Windows system notification, it appears in the bottom right. They don't look like the Epic client.

The notification related setting in your screenshot causes the pop-up window upon launching Steam. But it's a window that belongs to the Steam client. It has the obvious interface styling of Steam and is titled "Steam - News".

I agree with you that the "launch on startup" option would be better as opt-in.

I agree with gp that Windows notifications are a step worse.

edit- changed description of pop-up

I generally opt out of any kind of thing that is going to popup on my screen unannounced.

I think there is a grey area on whether those sorts of notifications you mention should be enabled by default. There is an argument to be made that they should be enabled by default, as it's basically a mechanism to train/educate the user that the feature exists. As long as they can easily opt-out.

But I do think it's a very different thing between those and what Epic is doing with advertisements regarding completely unrelated games that they want me to play/buy. It serves me no functional purpose, it only serves Epic, especially because the only reason I have Epic Launcher on my system is because it's the only way to play Metro Exodus right now; it's a means to an end.

I have no problem with Steam's notifications since they appear for a second then piss off. Windows notifications are fucking awful. They stay in your tray with a taunting (1) symbol until you get rid of them, the collective amount of time I've wasted opening that horrible right menu and clicking away notifications must be staggering.

It's partly first-mover advantage, but also Valve has repeatedly made moves that demonstrate their relative good will towards gamers and developers. Aside from their own (vanishingly few) games, Valve has never enforced any kind of exclusivity. You can even sell Steam keys through other vendors and Valve doesn't even get a cut. They helped launch the indie explosion in the mid oughties with their cross promotional stunts. They have so many sales, with such outrageous discounts, that many of their customers have dozens if not hundreds of games they unlikely to ever play. Said discounts set a new bar for what a sale even looks like, with '40% off' often eliciting general consensus of 'meh'. They have more tools to try and help users find games they might like than anyone. They worked with HTC to develop new VR tech, again with no exclusivity (unlike their competition). And as every Linux gamer here should recognize: they've done more to make Linux gaming a realistic option than anyone ever, and they never charged a dime for it.

As much flak as Valve gets for not curating games and letting games with questionable content slide until some internets make a fuss, Steam is actually, objectively, really great.

> Steam has done many things to annoy users

I think people forget how much people hated Steam when it came out. I'm not sure I'd really call it "right place at the right time" either, since that sort of implies wild success pretty easily. My impression is more that Steam was 2-3 years ahead of its time but Valve believed in it and stuck through the hard times.

Here are some quotes from 2004, when Steam & Half-Life 2 were brand new:

"no one I know likes Steam at all."

"Steam is one of the worst programs I've seen in the last few years. Everyone seems to have trouble with it... why would ANYONE use it?"

"Bugs or no bugs, Steam is unacceptable IMHO."

"All hail Valve, our next Microsoft Product Activation-like overlord."

"Glad to see that they have given me an excuse to not purchase the game"

"Some ideas of Steam are nice, but I still don't like the idea of buying a product through it. Skipping the publishers is a bad thing."

"Sorry Valve, but I have no intention of letting Steam ever tough my PC."

https://games.slashdot.org/story/04/10/23/0812224/half-life-...

https://games.slashdot.org/story/04/09/20/2012208/no-half-li...

>Steam has done many things to annoy users--they allow their store to be filled with absolute garbage shovelware for one.

I consider this to be an advantage rather than annoyance.

This argument is nonsense. Perhaps they should robocall me to tell me as well?

If I want to be notified about anything (except emergencies) I should have to explicitly opt into it.

How can you complain about all these AMAZING DEALS we're offering?

I don't recall steam ever doing this. And I've used it since the HL2 days. Are you confusing it with the popup that shows on steam startup?

Been using steam since 2011 and I've never seen an OS level notification about ... anything. There's a window that pops up with information about current deals when you open Steam (after it's been completely closed), perhaps that's what you're thinking of?

And, importantly, their cut is completely in line with pretty much every distribution channel's cut. Notably not itch.io and now Epic.

I believe they are referring to the amount that the store takes out of each sale from developers and publishers, not what consumers pay.

No idea the only feasible possibility I've come up is to damage Epics customer relations. I don't know maybe it was just some idiot with a list of emails and script but no real game plan.

Here is the an article discussing others with the same issue https://twinfinite.net/2019/03/psa-epic-store-doesnt-validat...

Here is the last email I got from Epic:

Jan E. March 15, 2019, 11:39 +1300 | Conversation ID: #9950515 Hi (Player's Name),

Thanks for the information!

I know how important it is for you to update and change your country to your Epic account. No worries, I got your back and I'll do my very best to assist you with your request. Additionally, I know how frustrating it can be. Please know that here at Epic Games, we are serious about the player's security and we assure you that your email address is secured as long as you keep the password updated or enable 2FA.

In order to change the country on your account I will need you to reply with an image of one of the following items with your name and address visible:

Passport Personal identification *Recent rent or mortgage statement

Any other personal information should be blacked out.

I'll be looking forward to hearing from you soon.

Probably either Denial of Service or hoping a way to make money off it became available later.

Epic can report huge user growth numbers in the hot and growing Asian market to their investors.

Edit: I am effected by this issue. I am of course not dumb enough to add a credit card to the account.

If they allow you to log on in via a third party authentication like log in via google account or log in via facebook etc I foresee a flow like this.

Create a bunch of fake accounts attached to various emails.

For each account periodically check to see if a new method of payment is attached to the account. When one is immediately buy a bunch of gifts for other users that will be sold through some side channel like facebook/whatsapp/what have you. Example make a post on any sort of forum say message me to buy a copy of $40 game only $10 for the first 5 users to message me. For each user that pays buy a game and send the legit code for the game. This trust will keep you from being taken down immediately or perhaps even at all if the user doesn't notice the losses.

This could work because a user could say log in via oauth via another service, link their account to the unknown preexisting account by setting the same email account. Virtually no services allow more than one account with the same email address its the unique key that defines the account.

As soon as they create the account the first thing they do is buy a game because most new users installed so they could buy a game from epic. They check whatever box is required to save their method of payment.

You now have an account that can be accessed via oauth via the users preferred provider and the hackers chosen password + victims email address with a saved payment method the hacker cannot access directly but can spend and monetize via side channel.

There are loads of people that got hit by this https://twitter.com/catahstrophic/status/1098657650575732736

Yeah I like competition in the market and would like to help Epic out but the way they're handling this is so poor.

Satisfactory is the game I wanted to buy but it's not worth it for me to send a photo of my passport to anyone. They fail to validate email addresses then I'm supposed to trust them with data that identifies me and could be used to steal my identity, no thanks.

I just discovered that I am effected by this. I might have been interested in checking out epic games store. I am utterly disinterested in uploading a passport/id or other personal data to prove I'm not from Thailand.

Seeing as the accounts seem to share the same fake name. Ican Icanaw I suggest purging all such accounts and making people actually confirm email addresses before using them as identifiers like adults.

This is a junior high level mistake. So basic and so bad I no longer think anyone should trust Epic to have access to credit card info.

Can you just delete the fake account and create a new one on your email address?

I had to do that when someone created a samsung account in my name and I couldn't change the country/language of it.

Interestingly enough I sent a Request For Correction to a company which manages a conference in Berlin.

Their response was, in summary, "thanks for your request, we need a full copy of your passport, driving licence and a recent utility bill to correct your records".

I can open a bank account with less information!

I remember the last time I tried launching a square enix game I got to the accept dialog and read the terms and conditons.

Since then I think they have reworded their privacy policy.

It used said they could collect basically every interaction you ever had with their games, information on your system unrelated to the game, and when agreeing it was binding, irrevocable and forever.

the current policy is here, and it is still amazing:

https://www.square-enix-games.com/en_US/documents/privacy

read the first section - they basically collect everything they can and can share it with everybody.

Ah I did confuse Origin Launcher for Epic. Thanks for addressing that.

I was assuming that your steam account ID isn’t persisted in cleartext on disk either.

Failing that, we could have a key that’s just stored on the Steam cloud and requires login to retrieve.

I agree. But it doesn’t hurt to put up preemptive defense. In fact, the OS should also isolate and encrypt per-app profiles. And when one app wants to access data that belongs to another app, it should ask the user’s permission. I don’t know if any of the major desktop OSes (including Linus distros) already provide this kind of mechanism, and that it’s just the app developers not bothering to use the mechanisms.