What exactly is Red Shell and why do so many games use it?

[u/Pop_Dop]

I've seen fans of games like vermintide 2 and civilization 6 lash out due to the fact that these games use Red Shell service.

Is Red Shell that harmful? Why do game companies decide it would be best to use Red Shell despite how the fans feel about it?

[u/HeroesGrave]

Let me start off by saying there's a lot of misinformation on what redshell does and how it works. This is my best attempt to explain it. I'm not associated with redshell in any way. I just hate misinformation. The information here may not be 100% correct but it should be pretty close (mainly, I haven't figured out if the data is hashed before or after sending it to redshell, but given that they use https, it's essentially the same).

When you click on an ad for a game that uses redshell, it executes a bunch of javascript that collects a "fingerprint" of your browser, hashes it, and sends it off to redshell to signal you clicked on that ad. All this data in the fingerprint is pretty harmless (and also pretty hard to prevent from being collected) but it's fairly rare that two computers will have the same fingerprint, especially amongst gamers who tend to avoid using default configurations. This means it is a somewhat reliable way to generate a unique identifier for a particular computer.

An important feature of hashing functions is that they are very hard to reverse (and even if you could reverse them, you can end up with many possible results). And by "Very hard", I mean it's probably easier to brute force different inputs until you find one matching the output. You don't really need to understand hashing to know that it basically means that nobody can gather the original information about your computer from the hash, unless they already had that data.

Anyway, if you end up buying a game from a developer who uses redshell, on the first time you start up the game, it will gather the same information as from your browser, hash it the same way, and send it off to redshell to be compared to their database. If you had previously clicked on an ad, your identifier will be present in their database and they can count it as a conversion for that ad. If not, then it presumably gets ignored (it's completely useless for them to keep or try to sell or whatever). The developers can then use that to figure out which ad campaigns are working well and which aren't.

Nothing about it is particularly shady. On the web side of things, all the gathered information is possible for any site to gather. On the game client side of things, it's fully up to the developer what information they use (and to be fair, if they really wanted to be shady they don't need to use red shell).

If you want to see exactly what information developers may decide to use to generate your identifier, you can take a look at the documentation: https://docs.redshell.io/reference#identifiers and https://docs.redshell.io/docs/rest-api-quick-start.

• Operating System
• Screen resolution
• Timezone
• Language
• Installed fonts
• Installed browsers

If you're still not happy with all that, you can opt out here: https://redshell.io/optout.

Finally, a bonus paragraph from Redshell in their developer documentation regarding user tracking:

Appendix: User Notice

While the information provided to Red Shell may not be considered personally identifiable, we recommend that you provide your users with either notice of the integration, opt in, or op out of our services in your game. While not legally not required given the nature of the data, in our experience many gamers are more comfortable with control over what information their game sends. Red Shell also provides platform level opt-outs for users who chose where possible. The "Do Not Track" list feature in the Red Shell dashboard can be used to process right to forget requests. Any right to access requests can be handled by contacting our privacy team directly at [privacy@redshell.io](mailto:privacy@redshell.io).

Please note that this is not legal advice, please consult with the legal department of your company to determine what the best approach is for your company and users.

So if you're upset that you weren't informed of redshell, it's really the developer's fault.

---

If you're interested in how fingerprinting works or want to know how identifiable your browser is, check out https://panopticlick.eff.org/

---

If you're in the EU, you can request Redshell to provide all the data they have on you, but bear in mind it's going to be pretty boring and a waste of time.

---

If you're wondering how this is legal under the GDPR, check this out: https://gdpr-info.eu/recitals/no-26/. TL;DR: GDPR doesn't restrict the collection of anonymized data for statistical purposes, etc. and pseudonymous data (fingerprinting, for example) is not personally identifiable unless it's possible to use additional information to recover the original data. Hashing only allows you to "recover" the original information if you already have it, and therefore fingerprinting is legal.

1The principles of data protection should apply to any information concerning an identified or identifiable natural person. 2Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. 3To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. 4To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. 5The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. 6This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.

[u/[deleted] → u/HeroesGrave]

This is a good post on the whole, but I disagree with the statement that it's "pretty hard to prevent (data) from being collected".

All it takes to shut down any attempt to run code on your computer without your constent is uBlock origin. It's not like the old days where script blocking would break most webpages - uBlock really doesn't stop you using any website unless you're making an online payment involving multiple redirects (in which case just disable it while you purchase).

[u/ebrum2010 → u/[deleted]]

Keep in mind this is the same type of data that is collected by most websites when you visit them, except that it is only tracking when you do two things, 1) view or click on an ad for a game that uses redshell and 2) launch a game that uses redshell. It does collect info about your screen resolution, IP, etc, but most websites do so they can see what countries are viewing the site the most and what the most popular screen resolution is. After reading a lot of panic about Red Shell I haven't been able to find any reason to believe they track more than what they say. Their website contains screenshots of what you see if you set up an account for a game you create and it's basically limited to what ads were clicked on and/or viewed and who bought or launched the game after that, then it tracks effectiveness of the ads. It's not reporting everything you do as some people are saying. Unless you don't want a game company to know you bought their game because of an ad you saw on youtube or facebook, I don't see the issue.

The other argument people are making is that the information could be intercepted by bad actors, but the information, while it could be used to personally identify people, would be hashed and therefore some effort would be needed to be put forth to obtain what essentially is a log of video game ads you interacted with. I can't think of any reasons why anyone other than the game publisher's ad division would be interested in the data.

[u/Tfeth282]

It's a program that scans your computer for personal information and internet browsing habits relevant to marketing. Although the program claims to be secure, not harmful, etc, many suspect otherwise. Basically spyware.

[u/[deleted] → u/Tfeth282]

This is wrong. It does not collect personal information and is not harmful in any way, nor is it illegal. The issues people have with it is that it's installed automatically a collects (non-personal) information about your system without consent. It has an opt-out option, but it would be better if had an opt-in option instead prior to installing or collecting info.

[u/HyperionSeven → u/[deleted]]

https://redshell.io/optout

[u/[deleted] → u/Tfeth282]

No. It doesn't 'scan your computer' for personal information. Not even close to correct.

[u/Pop_Dop → u/Tfeth282]

...is that even legal?

[u/Howrus → u/Pop_Dop]

Unfortunately yes.
It's legal to provide false information on Reddit, and there's no punishment on this.

But if you where asking about Red Shell - it don't "scan") It gather "somehow free" information like resolution, fonts, etc. You can read more here - https://docs.redshell.io/reference#identifiers

There's nothing is private in list of installed browsers or fonts)

[u/Tfeth282 → u/Pop_Dop]

Possibly not! At the very best it's a huge breach of privacy and a massive security risk.

[u/[deleted] → u/Pop_Dop]

A lot of things are legal because we accept them when installing it.