An anonymous blog claims that the Steam client continues to broadcast your log-on and log-off times, even if you set your status as “Invisible” or “Offline.” According to the Xmrcat blog, “Setting yourself to ‘Offline’ is basically a UI illusion. You might appear offline to the world, but the backend Connection Manager (CM) continues broadcasting your live activity to the socket. This leak bypasses everything, even ‘Private Profile’ settings. It essentially hands your friends a real-time log of exactly when you sleep and wake up, making your privacy settings effectively useless.”
According to the report, the Steam client apparently broadcasts raw Unix timestamps to all the friends you added on the platform every time your status changes, even if you turned on your privacy settings to hide your information. The only difference with going “Invisible” or “Offline” is that the client on your friends’ PCs and devices will put your profile under the “Offline” list, so they cannot see you, but the client still knows when you last logged in or out.
This might not be an issue for the average user, but those who know their way around programming and development could potentially extract the information from Steam’s backend. It’s possible to intercept the ClientPersonaStaste protobuf message payload, which will potentially reveal your sleep cycle or gaming habits, allowing someone else to track your behavior without your knowledge.
The anonymous user said that they raised the issue, only to be brushed off by the company. “I sent this to Valve on HackerOne,” wrote Xmrcat. “I showed them how I could reconstruct a target’s daily sleep cycles despite them being ‘invisible’ for weeks.” Unfortunately, the ticket was closed as “Informative,” and they were told that the packets are only sent to your friends on Steam, so they’re presuming a pre-existing relationship of trust between the two parties.
However, many people add people they do not personally know on Steam as friends, which means this issue could concern some users.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.