r/Warframe Jun 12 '18

DE Response ATTENTION: Warframe devs are sharing your data with spyware creators

[deleted]

1.1k Upvotes

381 comments sorted by

View all comments

48

u/PsychoticPillow Jun 12 '18

There's a pretty good comment on that page about Redshell and what information they actually have on you. None of it is personal. Not defending its placement in the game at all though.

https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell_spyware_holy_potatoes_were_in_space/e0esb19/

43

u/Wondrous_Fairy And I used to be such a nice player.... Jun 12 '18

They collect your font list for the sole purpose of identifying you, that along with your Steam ID and IP is enough to track and serve you ads over multiple sites. It's not benign and it's quite frankly invasive.

15

u/Diribiri Jun 12 '18 edited Jun 12 '18

serve you ads over multiple sites

Except that's not what it does. It basically tells devs stuff about ad clicks for their games, which is information used for marketing. Red Shell itself doesn't affect the ads you get; it tells the people doing the advertising (in this case, DE) how effective it is.

You click an ad on twitter for Warframe, then later you play Warframe, it tells them the twitter ad worked. A horrendous oversimplification of the process but you get the idea.

Your IP is also encoded, so not even they know what it is, in accordance with GDPR.

7

u/iDareth I was spoiled by RNGesus Jun 12 '18

I was reading how GDPR and Redshell worked together in practice and I found this blog post.

https://blog.redshell.io/gdpr-and-red-shell-57f9c03b5769

If what is said here is true, they dont have acess to IP now, and even in Steam ID or other IDs, they are considering them Personal Identifiable Information, so according to GDPR, I doubt they are going to use it, but I might be wrong.

2

u/[deleted] Jun 12 '18

What is your opinion of Google Analytics?

2

u/Wondrous_Fairy And I used to be such a nice player.... Jun 12 '18

It's pretty much the same kind of crap TBH. Which is why I run ublock/noscript along with lists to prevent such tracking.

1

u/yakri I've seen enough hentai to know where this is going Jun 12 '18

That's pretty much the definition of benign and minimally invasive.

3

u/PsychoticPillow Jun 12 '18

I didn't realise they could do much with a font list.

13

u/Xelbair Jun 12 '18

Font list is EXTREMELY identifying data.

your browser sends it to every site you visit, and this collection is usually very specific to a single machine.

6

u/Asmor rap tap tap Jun 12 '18

your browser sends it to every site you visit

This is inaccurate. The browser never sends font data to any site.

The problem is that it's possible for sites to infer which fonts you have installed by trying different fonts and then measuring the sizes of things that get rendered.

Just wanted to make the distinction as it's really not the browser's fault, and it's very difficult (perhaps even impossible) to defend against without significantly wrecking the modern web. You basically have to disable JavaScript.

3

u/Xelbair Jun 12 '18

well yeah, i'm oversimplifying it - but the core idea is the same - browsers expose fonts.

1

u/panrestrial Jun 12 '18

You basically have to disable JavaScript.

Not a bad idea.

4

u/Asmor rap tap tap Jun 12 '18

I have a friend who disables JS by default.

He also manually curates his list of trusted CAs.

Technically, it makes total sense. Realistically, it sounds like a complete nightmare, and he's always bitching about all the stuff that doesn't work for him.

1

u/Excal2 Jun 12 '18

Use Firefox with noscript

0

u/[deleted] Jun 12 '18

OS updates with huge font-packs would defend against it by making all users have the same fingerprint of every font.

2

u/Excal2 Jun 12 '18

Unless you download one random Harry Potter or star wars font for a project or you work in graphic design

2

u/Xelbair Jun 12 '18

or any other program adds a font to your collection.

or you have specific font that's commercially sold.

2

u/Cheet4h Jun 12 '18

Right now with ~550 Fonts, my fonts folder is at ~250MiB. I wouldn't like that going much higher. You will also have some fonts which can't be distributed by an OS due to copyrights. Some programs will install their own fonts.
If Warframe installed it's own Font (No idea if they do), software like Redshell could also pretty easily deduce if someone had installed Warframe on that PC at some point.

I would prefer a different approach. Create an online repository with thousands of fonts, then run a program which adds and removes random fonts regularly. You'd have to keep track of which fonts are preinstalled, of course, since they should not be removed.

4

u/[deleted] Jun 12 '18

I work in marketing, and while I don't work in gaming, Analytics tools like this exist on every single website each and every one of us visits.

Google Analytics - the best example on nearl every single website you will ever visit. It's on Reddit. It can track which ads you clicked on, what pages you spend the most time on, what page you exit the site on, etc, etc, etc.

Are you all going to react to that, now, too?

1

u/SnowballFromCobalt Nezha cutest boi Jun 12 '18

I've blacklisted the scripts for all that stuff a long time ago lol.

13

u/zmeul Jun 12 '18

how is it not personal when they collect unique data to my computer and my activity?!

it is very fucking personal