PSA: A website called SteamHistory enables stalkers through Steam mass data harvesting. Here's how stalkers found me despite creating a new, private, anonymous account.
PSA: A website called SteamHistory enables stalkers through Steam mass data harvesting. Here's how stalkers found me despite creating a new, private, anonymous account.
cross-posted from: https://lemmy.cafe/post/4800845
tl;dr: Watch what you put online and who you friend, especially on Steam. Once it's on the internet, it's there forever.
There's a website similar to SpyPet for Discord, but for Steam. They compile all of our users' profile pictures, name history, comments, URL history, "real name" history, our friend networks, forever, and they give us no option to opt out of it. Not even a private profile will stop it from scouring your friends' lists, the forums, your avatars and name history. So what's the purpose of it?
Stalking. I'm a victim of it.
And despite all of my efforts to not leave a trail leading to my new Steam account, SteamHistory enabled my stalkers to find me.
There are a number of unfortunate folks that have dedicated their time to follow me into whatever game servers I visit and spoil my day. I had deleted my old Steam account and repurchased all of my games on a new account that was privated from the start. I was very careful to not disclose any information that could lead to my identification, including using VPNs and prepaid methods to avoid leaking my real name to Steam. Despite that, my stalkers managed to attribute my new anonymous account to me, even though my profile is private and haven't posted anything. But how? Well, they were "kind" enough to tell me how.
How did they find me? Enter SteamHistory.
The task itself would have been impossible without a massive database of Steam friend networks, but the website simplifies such an endeavor that it is basically trivial. Assume the role of a stalker for a second and that you know nothing about your victim's new account. All you know is that they have a few friends with whom they sometimes play and their profiles are also private. What can you do? Initially, it seems like a lost cause, SteamHistory gives you a lead.
Go on their website and look up your victim's friends. Despite that all involved profiles are private, it is unlikely that the victim's friends would create new Steam accounts and repurchase their games. It's more likely that they would simply private their profiles. With this knowledge, look at each friend's friend history and find the friends that they all have in common, then eliminate all of those in this intersection that you are sure are not your victim. This process will always narrow the scope into only one last person: the target. Bingo. You've found your victim. And you didn't even need any data from them. That's how they found me.
What does SteamHistory store?
They store and put on an exhibit your embarrassing names, your immature profile pictures, for the whole world to see. Your deadname, your abusive ex's comments, made forever available for any imaginable bad actor. They etch in stone the fact that you once were Steam friends with this guy that turned out to be a sexual predator.
So what can you do?
Nothing besides not using Steam. Or get Valve to implement better control of our privacy, but good luck with that. The owner of SteamHistory has been confronted on the matter, and what they said is that you can opt out of data collection by deleting your Steam account. They don't care about the GDPR because they're situated in the US.
So heads up.
FWIW they don't get the option to not care about GDPR, it doesn't matter where they're headquartered.
What’re they going to do? Force eu laws on the US?
...well yeah...
If a US based company (via their websites) collects data on citizens in the EU, they have to comply. Otherwise the EU can issue fines. This is why some websites are geo-blocked.
- https://reutersinstitute.politics.ox.ac.uk/news/many-eu-visitors-shut-out-us-sites-response-gdpr-never-came-back
- https://www.eqs.com/compliance-blog/biggest-gdpr-fines/
If you are a website admin and know some of your traffic will come from the EU, you have to comply with the GDPR set for their residents, or block anyone from that region from accessing. You have complied by taking one of those actions.
In other words, it sounds like they found you because you re-friended the same people with your new account that you had on the old one?
What I'm confused (and concerned) about is, if all the accounts involved are private, how did SH still manage to get an up to date list of their friends?
I get that everything you put on there while the account is public is fair game and can be archived and offered for search even after you change it.
But if an account goes private and then acquires a new friend who's also private, this information should not be available anywhere.
So, is Steam actually publishing information that's supposed to be private?
Yeah, this doesn't add up. If the friends added you after setting their profiles to private then SH can't see that you're friends.
tl;dr: Watch what you put online and who you friend, especially on Steam. Once it’s on the internet, it’s there forever.
That right here is very much what it boils down to. Whether it's SteamHistory or The Internet Archive or whatever public or private data store... Any information you publish is out of your control as soon as you do.
There's a website similar to SpyPet for Discord, but for Steam. They compile all of our users' profile pictures, name history, comments, URL history, "real name" history, our friend networks,
How do they have "real name" data from the public (or even private) profiles? The only place to enter your real name into Steam is when giving the store your credit card info and none of that should be publicly available under any circumstances.
It's the second field on the edit profile page. Can't recommend putting it in, but victim blaming doesn't help anyone that already did so.
The edit profile page has a statement that "providing your real name can help friends find you on the Steam Community" with no indication that doing so also puts you at the risk of capital-G Gamers. I can see quite a bunch of people thinking that that's perfectly reasonable and not going to be abused.
There’s a “Real Name” section on your profile as well. Though there isn’t a hard requirement to have your real name there.
Nothing besides not using Steam
So if I understand the concern, it's that someone can look at someone who is friends with you but doesn't have a private profile and find your Steam username.
While I can see an argument that the default should be not to expose a friend list publicly (hell, I think that the default should be for profiles to be private entirely), you can also just not use the friend functionality in Steam. I don't play multiplayer games, but are there any fundamental limitations on playing games multiplayer with people you haven't friended in Steam?
A not insignificant portion of online games utilize the steam friend system exclusively to enable inviting others to your party, and would not function otherwise. One example off the top of my head is Hunt: showdown.
I checked my account through the site and they don't seem to have shit other than my current display name. When did they start collecting this data?
Just as an FYI, Steam has some granularity for privacy settings, your profile can be private while your friends list is not. Steam defaults profiles to private since 2018 and as I recall I had to go and open mine back up after they made that change in 2018 (I enjoy having SteamDB able to give me some analytics on my account, which it cannot do while things are private, so I took my stuff public.) I believe that they made that change retroactive to some degree else I could have continued using SteamDB without having had to change anything in my profile which worked before the change.
I just sicced SteamHistory on a Steam account that I use for managing some dedicated servers I host, I've never futzed with the privacy settings on that account, but it does have a single friend that I set up so one of the server admins could find the account, and SteamHistory is completely unaware of that fact. It shows that the account has 0 friends and I was able to confirm that this is not the case from the perspective of that account.
You (or your friends) can check your privacy settings for Steam at https://steamcommunity.com/my/edit/settings
That said, and you did touch on this OP, nothing on the Internet should be considered private, even in the best cases it's still data that you don't have 100% control over and you should assume that it COULD be public at any time because that scenario is always only one data breach away. If you're not comfortable with your data being known by others, you should not put it on the internet in any form under any circumstances; privacy settings will not save you.
TL;DR: It seems that whatever means SteamHistory is using, they are bound by the limitations of the Steam Privacy settings, so if your stalkers were able to figure out where your account moved via SteamHistory, it's probably because your friends do not have 100% of their stuff set private or because someone inside your circle of trust is giving the stalkers an inside scoop.
ha ha. im immune.
No friends either? Glad I'm not alone in being alone.
lol. yes.
This probably violates California privacy protection laws. Which they will have to follow if they are in the US and have data on persons in California