Hacker News Reader

Comment by gentleman11 | Hacker News Reader

Edit: the link broke shortly after I posted it, this one is working: https://www.zenimax.com/legal_privacy_us/

Bought Doom Eternal on the steam sale just recently and found this:

"Customer Records: paper and electronic customer records containing personal information, such as name, signature, physical characteristics or description, address, telephone number, education, current employment, employment history, social security number, passport number, driver’s license or state identification card number, insurance policy number, bank account number, credit card number, debit card number, or any other financial or payment information, medical information, or health insurance information."

This is explicitly listed as collected and disclosed

They also list browsing history:

"Usage Data: internet or other electronic network activity information, including, but not limited to, browsing history"

View on HN

I did a Google for the literal phrase "or any other financial or payment information, medical information, or health insurance information", and this seems like boilerplate that many other ToS use:

https://www.google.com/search?q=%22or+any+other+financial+or...

Motel 6: https://www.motel6.com/en/app/privacy-policy.html

Ritz-Carlton: https://www.ritzcarltonclub.com/privacy-ccpa.shtml

Starz: https://www.starz.com/us/en/privacy

Papa Murphys: https://www.papamurphys.com/privacy-policy

I sure hope the law treats these cancerous contracts of adhesion with the full contempt they are due.

Somehow I doubt it does, though :/

I'd want to say: "Good thing they don't have access to any of that", but unfortunately, one place Steam has not innovated at all is security: It's very good at installing games on your computer, but those games can mostly do whatever they want once they're there.

Microsoft got a lot of hate (some deserved, some not) for pushing the Microsoft Store and UWP as a potential game distribution platform (originally with some exclusives from the Xbox side of the world), but for all its faults, it used sandboxing.

It's ironic you post this after Bethesda installed a root-kit anti-cheat for this very game (yes, it has since been updated, but not automatically removed if it was already there).

So, yeah, they may have very well collected that data from your hard drive.

EDIT: Brain flatulance, s/DRM/anti-cheat/g

It wasn't even DRM, it was anti-cheat that only ran when you launched the game, and it's not like it was a secret that it was added in an update. Your comment is pure FUD.

Anti-cheat is even worse. There is a peverse incentive for the publisher to spy on your computer that isn't there so much with DRM. You can imagine them thinking it would be a good idea to upload your 'suspicious' files that might be cheat-related to their servers for analysis.

It was not a secret, but it certainly caused an uproar, which prompted Bethesda to scale it back dramatically. Being in ring-0, it has access to all contents on disk, and all contents in memory. What is actually sent up to Bethesda's servers could be, quite literally, anything on your system.

It's why Sony's rootkit DRM (got it right this time) was so poorly received a decade and a half ago - because you, as the computer's owner, can't control what it does or isolate its access.

DRM is definitely a big offender, the other one off hand that is amazing is anti-cheat systems. Both types of technology for PC games basically are predicated on the concept of "if we monitor everything it's remotely possible to monitor about your PC, we can detect if you do something bad with it".

It's probable that Steam would not be remotely as successful if it interfered with DRM and anti-cheat strategies on privacy or security grounds.

I have lots of friends who play shooting games semi-competitvely (they're all in the very high ranks of overwatch/csgo/etc). They are all very, very, very excited about Valorant's ring-0 anticheat. Lots of people want features that can't be achieved with a sandbox.

I definitely understand that. Cheaters have pushed me out of most first-person shooters I'd enjoyed. But I also have significant concerns about game companies having that much access to my general-use computer.

Perhaps the solution here is not to do personal/sensitive work on gaming machines, but then we're right back to having separate game consoles...

Alternatively: Only play video games with people in your trust network. Friends, friends of friends, etc., so that you have some recourse against griefing and cheating.

This doesn't really help: I don't have a choice on whether or not my shooter of choice implements anti-cheat.

Perhaps an ideal scenario would let a player choose whether or not to enable a game's anti-cheat, but that it'd be required for certain matchmaking and (obviously) competitive features. So that I can opt out if I'm just trying the game casually or just playing with friends in a private room, but can enable it if it's something I intend to play seriously and am invested in enough to give deep access to my system?

Ring zero doesn’t prevent cheats stored in spoofed input devices

https://m.youtube.com/watch?v=d1jz8qbzfIk

And like virus scanners, it can't recognize anything it doesn't already have a signature for.

But, it could upload "suspicious" data to the home servers to be evaluated and fed into the signature database. Just like any other feedback loop in anti-cheat (and anti-virus) systems, only this one can access everything on your system.

If you implement the sandboxing very thoroughly and only permit signed code to run, you can make it even more difficult to cheat. e.g. on iOS, it would be very hard to change the client code of a multiplayer game without being detected.

How would that work on a general purpose computer?

The same way "anti-cheat" software already works today? With the addition of a sandbox running signed code, which is yet another barrier.

The technology is just about here today. If your PC has secure boot, you can theoretically lock it down to only allow booting a suitably restrictive OS, which then is responsible for restricting the apps and games that can run & the permissions they have. Lots of layers of signed code checking, really.

The main weakness (other than code vulnerabilities) is the network: it's very difficult to guarantee that a remote computer is running the allowed OS & game code, and not a hacked version. However, technologies like Intel's SGX x86 extensions can make this possible: because of the added encryption in the core CPU, one machine can send a cryptographic challenge to another one, and it can only respond correctly if the remote CPU has validated the code it is executing.

So, the tech is there. But in reality, people really don't want to lock down their PCs so securely and effectively give full control to their OS vendor.

Does it actually work though? What's stopping me from running the game in a virtual machine with GPU-passthrough and emulating inputs?

It's quite hard to hide the fact you're running in a VM, if possible at all. I think Valorant refuses to run in a VM.

Interesting. I actually have a GPU-passthrough and regularly play a japanese MMO with a similarly invasive rootkit. I haven't actually tried Valorant, but I might when I have some time out of curiosity.

I think up to now, despite how easy it is to detect, anticheat has largely ignored VMs. Valorant is noteable for being the first game widely reported to refuse running in a VM.

I don't think they've ignored VMs. In fact the very game I mentioned before refuses to run in VMWare and VirtualBox, even though I've managed to run it on Qemu out of the box. Though I'm not sure if it's incompetence or they just don't care :p

Many Asian MMOs block VM execution, namely mostly anything by GameGuard/HackShield/XIGNCODE.

Valorant doesn't even like my legit Intel CPU drivers

I personally think that a single player game should not be hoovering up data to begin with. Just because they disclosed it 30 page contract almost no one reads does not make it right in any sense of the word. At best, it is legal. I am getting mildly miffed over the fact that I have to consider having my privacy raped to play a simple shooter game.

How is this normal or even in the realm of being accepted AND defended?

I'm glad you found and posted this. I'm surprised at how much this policy page looks like a website from 1995. How did you find this?

>I'm surprised at how much this policy page looks like a website from 1995.

It's almost as someone planned to make it hard to read!

How is it hard to read? Both versions I've seen linked here are essentially plain text with sensible use of simple styling (bold and italics), with a couple tables of text, and some borders in a couple sections to group things.

The only things that might make it a little harder for some people are one of them used green text on a black background, and for both of them if you browser window is wide the lines might be a bit too long.

It's what happens when legal gives the web team a word document and they don't feel like spending the time to make it look nice. Been there, it's awful.

> Edit: the link broke shortly after I posted it, this one is working: https://www.zenimax.com/legal_privacy_us/

Now this one isn't working for me and the original works.

Reply on news.ycombinator.com