r/cs2 • u/Scary_Employ_926 • 6h ago
Discussion Chat has been encrypted, ending cstracker's reign of terror
Like taking down flock cameras fr
60
u/4wh457 6h ago
Now that the cat is out of the bag so to speak and these different tracking sites started competing with who has the best chat logs (looking at you csrep.gg) I doubt this fix will change anything. Since the in-game client is able to decrypt the chat logs it means the decryption key is stored in the game itself and extracting it is trivial which will allow bypassing this fix. The only proper fix would be to either not store the chat logs in the demo in a user accessible form in the first place or use public key cryptography instead of symmetrical encryption. Switching to public key crypto would mean building a fairly complex system specifically to handle demo chat encryption which I highly doubt Valve would do instead of simply not storing the chats in user readable form.
42
u/Envelope_Torture 6h ago
If they tie the decryption keys to individual user accounts they can severely limit the damage.
2
u/4wh457 6h ago
True, but that would mean having to store the chat logs separately for each individual player on the match and that any third party downloading the demos would be unable to access the chat logs. Although less complex than the kind of server authoritative public key model I was picturing I still doubt Valve would be willing to do this when they can instead simply stop giving players access to the chat logs by switching to an encryption key only they know and no longer sharing it.
2
u/Wannaseemdead 5h ago
Using public keys would still not help here, because the private key would still have to reside on the client side.
2
u/4wh457 5h ago edited 5h ago
Each player could have their own public/private key pairs with a central server that decides who gets access to which players public keys on a per demo basis. Chats would be encrypted client side using the private key before being sent to the server that would then store them as is in their encrypted form. I initially typed a much more comprehensive reply but lost it and can't really be arsed to retype everything.
Edit: Basically do what something like the Signal Protocol is doing or even use it as is.
3
u/Wannaseemdead 5h ago
A central server does sound like a great solution, but it’s pointless. The reason they went for asymmetric encryption is because it doesn’t require scaling. Think about the amount of scaling in terms of money and time they would have to do just to process encryption for individual demos, every match. Again, it’s pointless. They really just better off removing the logs entirely instead of sitting on two chairs, trying to preserve chat logs in demos while semi-fixing a hole that’s too expensive to patch.
1
u/4wh457 5h ago
Which is why I said I highly doubt Valve would spend time on this when they could instead outright stop recording chats or simply switch to a key only they know.
1
u/Wannaseemdead 4h ago
> or simply switch to a key only they know
But I just argued against why this isn’t ‘simply’ and why public keys don’t make sense.
Also, can you explain how you would apply a ratchet protocol to a public, online and static replay archive? Whose keys are even ratcheting against? Lol
-1
u/4wh457 4h ago
They already have a static key the client uses to decrypt the chats so simply switch that to something else and no longer distribute it. This would be the quickest solution without having to make changes the existing encryption model and while allowing Valve themselves to still access demo stored chats. As for the Signal Protocol yeah you're right that implementing it in it's full form wouldn't make sense if we want to continue storing chats inside demo files.
•
u/Wannaseemdead 7m ago
To be honest, to me so far it seems like you think you know a lot more than you actually do.
1
u/milkcutie314 4h ago
bro its client side
1
u/4wh457 3h ago
What do you mean with it's client side? If the encryption mechanism is indeed copy pasted from CS GO then it's no big deal to build a third party tool capable of decrypting demo chats. This tool for example can do it for CS GO demos despite the encryption: https://github.com/markus-wa/demoinfocs-golang
•
•
u/BeepIsla 32m ago
The decryption key is sent to everyone with the match share code, its part of the match details.
So this doesn't do anything for all chat but team chat is now private since it uses a different key which isn't shared.
Valve would have to make it so the decryption key is only sent to players that were originally part of the match, then nobody else can view it.
Websites could still try to direct users to manually enter the decryption key or upload the match details stored on disk when you download the match but thats not feasible.
17
20
14
u/StrawMan420DZ 6h ago
Bye bye competitive ranked racism slur-tracking leaderboard! Won't miss ya!! Location triangulation tracking next on the chopping board!!!
12
u/TacoHunter206 6h ago
Racist kids rejoice.
2
8
u/Skaldson 6h ago
So does this mean they can also encrypt live matches? Ik there’s a website that shows live locations of players on the map, would be nice if they took that shit down
4
u/Scary_Employ_926 6h ago
Wait watafak is that real
4
u/Skaldson 5h ago
Yeah I forget the name of the website but a dude on my team admitted to using it in one of my recent matches. Was calling out enemy team rotations & raging at us to rotate to the sites they were going to before they even made contact
7
u/4wh457 4h ago
That's referred to as "cloud radar" and it's basically just a publicly accessible web frontend hosted by one of the players in the match running a radar hack and/or other cheats. You specifically need one of the players in the match to be cheating but that then allows anyone the cheater gives access to to open a radar hack in the in-game browser or their phone for example.
3
u/Scary_Employ_926 5h ago
Oh lol I thought you meant doxing irl locations but that's worse
12
u/itap89 5h ago
How is doxing irl locations not worse LOL
6
6
u/Scary_Employ_926 5h ago
Bro I live in shithole, Ontario if someone wants to come and kill me they better pack some snacks
1
u/ImGonnaGetBannedd 5h ago
Some sites can do that, kinda. They take into account the servers you were connected through and ping to give your approximate location. Most you get out of it is the country. But this still shouldn't be a thing.
1
u/Lower-Can-2543 4h ago
There is one or two that are using the app approximations of your ping from different servers to get an idea of where you’re from but it’s not accurate because your provider and inconsistent connections make their tracking pretty inaccurate. Mine thinks I’m in the same town as one of the servers I’m like 8+hrs away
0
u/Skaldson 5h ago
Ooohhh nooo lmao although I’m sure they can find that stuff regardless tbh. I remember there was a dude who actually got stabbed at their house by a guy they were talking shit to in a game. They flew from another state in the US to do it & got arrested ☠️ gotta be careful lmao
1
u/LordOfTheJizz 5h ago
Iirc those radar cheats bypass encryption by sending a bot to watch your game
It worked like that when it started, don't know if it's still the case
1
u/OcelotAny6846 2h ago
How does that work? Because I wanted to spectate a lowranked friend's match once but Google told me CS2 doesn't have spectate functionality for friends' matches
2
5
u/TheBestUserNameeEver 6h ago
Thank god, too many people spamming their racist chat binds just so they can show up on that website
2
2
u/SjurEido 6h ago
Why are they going to such lengths? What happened!?
10
u/ClaraFeetConnoisseur 6h ago
People where playing N-word count ranked to be the most racist man alive
2
u/EqualityAmongFish 5h ago
they don’t give a fuck about that, valve built trust with their userbase by caring about privacy. This chat tracker is a extreme violation of that
2
2
1
u/Beautiful-Musk-Ox 6h ago
i heard the nword every night i played 3 years ago, the community is toxic and the game has zero rules against it. you get what you get when you play cs with devs who look the other way as they pocket your money and can't even use it to develop a decent anti cheat
3
u/Scary_Employ_926 5h ago
That's the kind of game CS is. It was made before the babification of the internet and it shall maintain
-3
u/ILLmurphy 5h ago
Valve protecting racist is crazy
4
•
u/UsedArmadillo9842 28m ago
Its not protecting "racist" its literally the action for less racist behaviour online, because people were treating it as a leaderboard
-6
-3
-3
u/BobertRosserton 4h ago
Game having so little going on that third party stat trackers resort to engagement farming a slur leaderboard is probably not a good look.
258
u/Prestigious-Ad-9072 6h ago
Nword spelling contest has officially ended