Thursday, November 10th 2011
Steam Hack More Severe Than Thought: Change Your Password NOW
Gabe Newell of Valve has issued a statement that the forum hack they experienced over the weekend actually goes much deeper than they thought. The criminals accessed the main database containing such goodies as user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. Apparently, no personally identifying information was taken - but we await the result of the full investigation before breathing a sigh of relief. Due to this serious breach, TechPowerUp advises all Steam users to change their account password immediately. People starting up their Steam client will now see the following message from Gabe Newell about this:
10 November 2011
Dear Steam Users and Steam Forum Users:
Our Steam forums were defaced on the evening of Sunday, November 6. We began investigating and found that the intrusion goes beyond the Steam forums.
We learned that intruders obtained access to a Steam database in addition to the forums. This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information. We do not have evidence that encrypted credit card numbers or personally identifying information were taken by the intruders, or that the protection on credit card numbers or passwords was cracked. We are still investigating.
We don't have evidence of credit card misuse at this time. Nonetheless you should watch your credit card activity and statements closely.
While we only know of a few forum accounts that have been compromised, all forum users will be required to change their passwords the next time they login. If you have used your Steam forum password on other accounts you should change those passwords as well.
We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords (which are separate from forum passwords). However, it wouldn't be a bad idea to change that as well, especially if it is the same as your Steam forum account password.
We will reopen the forums as soon as we can.
I am truly sorry this happened, and I apologize for the inconvenience.
Gabe.
127 Comments on Steam Hack More Severe Than Thought: Change Your Password NOW
Release Half Life 3 soon. All will be forgiven.
Love,
Erocker.
Your theory has not been thought through, and is quite an accusation you are doing against steam for a few bucks.
Seriously, calm down the paranoia about conspiracies. No, by defending steam I'm not secretly working for that you make them 10$
So it might land them more than $10 till this issue gets resolved. A theory is all I can make from this point.
And can't most access their steam accounts? I can... Most will try more than once to access it and will get through anyways...
you seriously have a flawed theory. It's like saying that a hot girl wants to bang you and marry you or be your sex slave because she smiled at you and asked what you wanted at McD...
Also, I don't give a rats butt about the steam forums. I have never even read it. And like I said, if all that was hacked was some forum database, I wouldn't care. But based on what I'm reading on their page, it sounds like they were able to also access the database which contains user and CC information (Though encrypted).
It makes no sense for Valve to admit credit card information was exposed when it really wasn't. They ARE responsible for keeping our information secure, and if what they say is true then they failed at that. As unlikely as it is that anyone was able to copy the information, let alone decrypt it, Valve still screwed up if it was exposed (Especially if it was by the people you seem to think did it).
It's a perfectly valid attack to draw attention to one attack meanwhile another, more serious, attack takes place unnoticed due to the distraction.
You do realize that the THOUGHT of credit card information and identity theft happening because of a company, and a company admitting it, could mean a MASSIVE lost in business for that company due to a lack of trust from consumers. If I don't trust them and don't think they will keep my information safe, I am not going to buy a game from them. That's different, that's people with too much money throwing it away for the chance to cheat. What I am saying is the average users who would quit because of their information being insecure would outweigh the number of people buying their games off of steam after they lose access to their account, especially if they contact steam to get it back and it fails. I'm not talking about people who got banned, I'm talking about honest people who don't cheat forgetting their information. If Valve doesn't help them get their account back, I doubt enough of them are going to purchase their stuff again to make this a valid scheme from Valve.
I'm not saying people wont buy their stuff again, I'm saying there aren't enough people who will to make Valve admit to their CC information even possibly being exposed when it wasn't. Seriously, I don't know where you come up with half of this. Even if it wasn't, and even if they say it MIGHT have happened instead of "it did" it's still a big deal and not something a company is going to admit to unless it REALLY happened or there is a risk of it having happened. I'm argueing against what looked like you saying Valve is over hyping this to the proportion of CC information being exposed so people buy more stuff from them, that makes no sense at all.
However, as a consumer I would be foolish to take it as a joke. And honestly, most companies don't joke about credit card information getting leaked. First off, they aren't going to be investigating it by themselves. If there is the potential for stolen credit card information, the government IS going to get involved. Steam/Valve doesn't want that, nor would they joke about it. Screw that, there is no way I would pay a company that got my credit card information exposed to a third party and wouldn't help me recover my account. I would get them from the store, direct2drive or one of the other locations. I wouldn't buy them from the company that couldn't protect my information.
You're the one calling them a money trap, I'm saying if they were insecure enough to protect my data then it makes them look bad and I won't buy from them. Not because they are a money trap, but because they couldn't keep my data safe. I think DLC is a money trap, not them. And I don't buy DLC either (With the exception of fallout NV because it was all on sale one day for really cheap)
Edit: Furthermore, I wouldn't buy the games again. At that point, I would just say "screw it" and find something else to do. I can't think of any reason why I would buy something I already paid for, and lost due to a company not securing my data. To add to that, I can't think of any reason why I would buy the games from said company even if I were going to buy them again.
That's assuming the game is anywhere near finished of course...
You think I got my parents to buy the games again? Heck no(edit: To clarify, I didn't even ask them to buy it again), you think I bought them now that I'm older? Heck no. A friend of mine bought them for me, I told him what happened and not to do it,but he did it anyway. His money so whatever. Sure, I buy stuff on there now, but there is no way I'm going to pay them for something I already bought. I have more control over what I do and I care about my money enough that I will quit playing games before I do that, I'm sorry if you can't do that but that doesn't mean I can't.
Furthermore, if they banned me I'm not going to waste a couple hundred USD to buy games again.
If you honestly want to keep believing that I'm going to buy games I already paid for, then have fun with it. I don't care about games that much, honestly I'm starting to think you're just trying to defend these points because you were one of the idiots who paid for all your games again. Edit: Also, I'm done arguing something that's off topic with you, and quite frankly pointless for me to argue with you about. You're obviously going to continue saying "Hurr yes you would".
Also, please, don't waste your time trying to make me angry. You won't, I have dealt with internet trolls and stupid people for a good 12 years.
Try again, "dufus", :laugh:
Way to show your age, "kid" :rolleyes:
Also, I'm just telling you what their support staff told me when I contracted them about it. Maybe they were just BSing? Who knows now, but the point was I got banned and never baught the games that were on it again. This was back in mid 2004, I believe. All I had were source based games. I never said anything about using a CD key twice. I said I wouldn't buy the games twice like you did, even if I lost my account. How was I being deceiving?
And where did I say I bought them twice? Show me proof that I said it. You can't, cause I didn't. I only used it as an example. It's you, you have been assuming ever since. Then changing your arguement when proven wrong. The burden of proof is on you. Like they say, GIGO (look that up).
To answer your question, I am assuming so because you are so heavily defending something as asinine as "They are claiming what they are to get people to buy all their games again thinking their accounts where hacked", which honestly if you bought them all twice I couldn't blame you for needing to justify it and pass the blame off on the company rather than you. Don't need to. I was asking in what way I was being deceiving, because I was not.
Also, the chances are remote, that's why I still buy stuff off of steam with the new account a friend of mine bought me and have had no problems so far. And since then I have learned a lot more about computers (networking/security/webdesign [specifically PHP backends to sites]).
I don't recall changing my arguments, however. We can move on, but if you pointed it out I would be happy to clarify and/or retract it (I really don't like contradicting myself or changing my arguments, nor do I ever mean to unless some one changes my mind). I have edited my post, but that was to correct or reword something to more match what I was thinking but that's all I remember doing.
They say Steam accounts weren't compromised as far as they're aware of, but how did they get game purchases and CC info? That information is tied in with steam accounts, not forum accounts.
I'm confused! :/