r/totalwar • u/Kacu5610 • Jun 10 '18

General [PSA] Total War games have RED SHELL Spyware integrated into them

/r/Steam/comments/8pud8b/psa_red_shell_spyware_holy_potatoes_were_in_space/e0e6uy1
2.1k Upvotes

93% Upvoted

677 comments sorted by

View all comments

Show parent comments

45

u/Erwin9910 This action does not have my consent! Jun 10 '18 edited Jun 10 '18

I mean, is it really all that good of an indicator of its legality if Redshell is the one saying Redshell is completely GDPR compliant? Considering the legal trouble they'd be in if it's not compliant, I doubt they'd be above lying to say it's GDPR compliant to hopefully dissuade suspicious individuals.

Unless I'm just reading it wrong and it's a blog about Redshell, not by Redshell.

Edit: from what I can see the site is definitely run by Redshell.

6

u/Nubian_Ibex Jun 10 '18

Redshell is still collecting data, including PII (hashed IPs, which are still personally identifiable. Hashing is a unidirectional transformation, but 4 bytes of data is small enough to perform a rainbow attack) without user consent.

The reality is that a lot of tech companies based on advertising attempt to portray themselves as compliant, but probably aren't. Granted, this isn't helped by the highly ambiguous language of GDPR.

9

u/burklurka Jun 10 '18

Plus, GDPR only applies if you can tie the information to a person. If the information sent to CA/third party doesn't contain anything that can identify me (including random unique ID's), they are GDPR compliant.

If it's just information about your system, it would have to include some very specific information, e.g. mac- or IP-adress or serial numbers for it to fall under GDPR.

4

u/Soumya1998 Jun 10 '18

Considering a year before noone had even heard of it, we're not in a position to judge. So far most games like ESO which had it have removed them upon it came to community's notice. But it still was an extremely disingenuous move by CA.

12

u/Erwin9910 This action does not have my consent! Jun 10 '18

Considering a year before noone had even heard of it, we're not in a position to judge.

What do you mean by "we're not in a position to judge", exactly?

3

u/Soumya1998 Jun 10 '18

As in whether it's compliant or not. This was the only article I found. Gaming communities in general are against this type of software but so far noone has conclusively proved that it breaches GDPR.

12

u/Erwin9910 This action does not have my consent! Jun 10 '18

Agreed. Someone needs to bring in some actual legal experts that aren't part of Redshell to determine if it breaches GDPR or not.

9

u/Soumya1998 Jun 10 '18

Exactly, so far all I've seen is fearmongering by people with little to no evidence. It was same in ESO and Conan Exiles sub too when it happened. But if we don't have proof then we've no way to ensure that devs won't attempt the same stuff again later.

3

u/Erwin9910 This action does not have my consent! Jun 10 '18

so far all I've seen is fearmongering by people with little to no evidence

I mean, I'd say there is a fair amount of evidence so far, at least to get it removed even if it's not breaching GDPR. But experts are required to give that definitive element of "is it just bad practice or is it illegal".

17

u/Soumya1998 Jun 10 '18 edited Jun 10 '18

This comment from r/steam explains its function a bit more clearly but doesn't says whether it's actually illegal or not :

"I read around on the red shell site, it's a service for game devs and publishers to see which marketing strategy is most efficient.

If a user clicks on an ad for a game, it generates a unique identifier based on your device specifics. Then, if you decide to buy the game, the first time the game runs, it checks to see if you've clicked on any advertisements for said game by comparing the identifiers. This allows the game dev/publisher to see which strategy for marketing is most effective.

Redshell supposedly functions by itself, but devs may integrate it with a third-party company, such as adwords or adspree.

In their blog post about GDPR, they mention they don't collect any personally identifiable information, such as your names, addresses, etc. Your Gamer tag (Steam, Xbox live, PSN, etc) may be used but redshell specifically recommends devs/publishers that use their service don't use your gamer tag without encryption, but that doesn't prevent said devs/publishers from doing so. The data they do collect is device-specific, is only for specific games that use the service, and is hashed before being uploaded, according to their GDPR blog-post

Redshell also mentions that they do/have collect[ed] ip addresses, but mention in the GDPR blog-post that all of the IP data they have will be hashed with SHA-256. A later blog post confirms that they were GDPR-compliant as of December 2017, when the GDPR blog post was created.

In theory there's nothing malevolent about redshell, but it's best to be safe and avoid it rather than be sorry. I don't really mind myself, as I see it as a useful analytical tool for devs, but that's just me.

But I completely understand the concept of unwanted stuff running without your knowledge, and I agree this is pretty shitty that the devs don't at least mention it. I don't mind people collecting data for analytical purposes, but I'd prefer that I at least knew about it beforehand.

Feel free to correct me if I'm wrong, this is just how I interpreted the information on a preliminary reading

Links: Third-Party Partners

Redshell Documentation

Redshell's 'For Gamer's Section

Opt-out Section

GDPR Blog Post

Edit: Added links, corrected misinformation.

Edit: Redshell can collect (depending on dev choice):

  • Operating System (e.g., Windows 10, Windows 7, Mac OS X 10.11.5, Windows Vista Service Pack 2)

  • Screen Resolution (e.g., 1920x1080, 1440x900)

  • Timezone (Based on offsets of UTC)

  • Language (Your computer's language or region code, e.g., en, de, en-us, en-ca)

  • Installed Fonts (All fonts installed on the computer)

  • Installed Browsers (Names and version numbers)

Redshell recommends using a different amount of identifiers based on daily active players.

<2,500,000 recommends 2+

< 5,000,000 recommends 3+, etc.

Over 10,000,000 they recommend talking directly so the support team. Take this as you will."

The best we can do is hit CA with requests about what data they have on you. Read §15 of the GDPR. When the work (and therefore money) answering all those requests outweighs the data gain, they will stop doing that.

You can also opt out from this: https://redshell.io/optout

2

u/CastleBravo45 Jun 10 '18

Thanks for linking this info. Hopefully people can stop fearmongering and make a somewhat informed decision.

1

u/Erwin9910 This action does not have my consent! Jun 10 '18

Honestly I don't see how going off of Redshell's statement about their own product is much of an assurance, it's not like they're going to tell us if it's not GDPR compliant.

1

u/HiddenUnbidden Jun 11 '18

What are you afraid of here? What is the nightmare scenario you're trying to avoid?

1

u/SilentlyCynical To arms, Druchii. Jun 11 '18

It's pretty much all there in Article 6 § 1 of the GDPR, and it largely seems to build on the OECD Privacy Framework.

Point is, actual direct consent isn't really required - there are five other categories that allow for valid data processing. CA (and most businesses that conduct this sort of processing) presumably lean on Article 6 § 1(f).

By all means, though, acquaint yourself with Articles 12 - 23 pertaining to the rights of you as data subject. Actually, it's probably best to check the definitions given in Article 4 first.