Hacker News Reader

Comment by red_admiral | Hacker News Reader

Can someone confirm if I've understood this right?

When you view a red shell enabled ad, a script on the page (or perhaps the ad server itself, based on HTTP headers) computes a fingerprint of your browser (IP address, browser version, fonts installed, screen size etc.) and stores (ad_id, fingerprint) in a database somewhere.

When you install and run a red shell enabled game, it computes the fingerprint of your machine and sends (game_id, fingerprint) to the server, which stores this in another table.

By joining these tables on the fingerprint, you can get some info on which ads are correlated with which game purchases.

Apart from this, red shell does NOT modify your browser settings, inject code into all pages you visit, add a browser toolbar, constantly run in the background, MITM your TLS or anything else like that. [EDIT: not trying to defend red shell here, just checking whether I need do a full reinstall of my PC to get rid of this thing]

View on HN

Just to answer your question properly, I don't think you need to reinstall your PC to get rid of it. Most games are now removing it through an update.

There's a thread on Reddit that collates which games are still using Red Shell and which have removed it: https://www.reddit.com/r/Steam/comments/8pud8b/psa_red_shell...

I think you can just uninstall the ones that aren't planning to remove it yet.

Also, you can opt-out from RedShell's website. Although it doesn't seem straight forward to me: https://redshell.io/optout

It would be nice if malware and antivirus scanners could find/remove it too. I'm kind of miffed that the antivirus software I pay for let this stuff remain on my Windows partition for months even after the software was known to exist.

Removing it will probably break the game (it's a DLL loaded by the game executable, and I'm guessing most game devs don't bother to correctly handle its absence).

People were suggesting the home remedy of adding redshell sites that the software reports to to your hosts list.

Is there some Panopticlick-like program to test how trackable my PC can be? Other than what fonts are installed, what other ways are there to id a PC from an arbitrary program that can be also checked from the browser?

Pretty sure everything but VM clones are uniquely identifiable. Windows itself generates a ton of GUIDs at installation-time, things like graphics drivers also generate install-IDs and so on.

Why fonts? Or do they use fonts as an ID?

Because every browser except the latest from Apple will happily tell every website you visit exactly what fonts you have installed. And that list changes very slowly over time, if ever, you know kind of like those patterns of skin ridges on your fingers.

Fonts are part of the fingerprint, especially if you know the OS. You take the set of installed fonts and subtract the set of OS default fonts, and you are likely to arrive at a unique key.

Take my corporate domain for instance: you could identify any machine on my domain since we'd all have a custom typeface installed (used on our company letterhead.) You could further identify our marketing coordinator, because she has a lot of strange typefaces used for signage and promotions. You could probably further identify me as a web developer since I have a lot of WOFF2 packaged fonts installed.

Side question -- do/could type foundries find pirate companies by looking at IP addresses using paid fonts without a license? Hardest part would be linking paid licenses to IP addresses, making individual unpaid usage harder to nail down. But if a company with dozens or hundreds of users at a single IP address all had a particular font installed, that IP was linkable to the company, and company didn't have a license, wouldn't that be pretty damning evidence?

Typeface piracy is otherwise pretty difficult to detect isn't it? Is it part of normal enterprise asset tracking / inventory systems?

It's one factor in a set of variables, that when combined can pinpoint you uniquely. This helps them overcome anti-tracking mechanisms like disabling cookies and such. Basically, by implementing this kind of technology, they know you don't want to be tracked and are attempting to do so anyway.

See the mechanisms used for this browser test, particularly the link for 'fingerprinting' after running the test: https://panopticlick.eff.org

Are you implying this somehow makes it ok?

No - what part of my post are you interpreting like that? I'm happy to edit if I'm giving the wrong impression. I just want to know how worried I need to be about my own gaming PC at the moment.

"Apart from this, red shell does NOT modify your browser settings, inject code into all pages you visit, add a browser toolbar, constantly run in the background, MITM your TLS or anything else like that."

This is the part that made me think you were defending it. My apologies for misunderstanding.

> I just want to know how worried I need to be about my own gaming PC at the moment.

Not sure if you play on Linux at all, but a good way to start is to run Steam in firejail. It isolates that environment from the rest of the OS.

https://wiki.archlinux.org/index.php/Firejail

Be careful with firejail, it comes with its own security implications, and has bad a history of pretty nasty exploits: https://www.reddit.com/r/linux/comments/79mmzk/sandbox_your_...

Isn't this just beneficial for everyone? Why wouldn't it be okay?

It is detrimental to the privacy of the players. That makes it not okay.

So where do we draw the line? Is all analytics without permission not okay?

If you live in Europe, the answer seems to be "indeed, all analytics without permission are not okay". If you live in the US, it seems to be "whatever you can get away with".

Gamers seem to agree that this company should not get away with this. Wherever "we" have drawn the line, Red Shell has apparently crossed it.

Pretty sure spying on people who just want to play a video game without telling them or letting them opt out ahead of time is not only a bit immoral but also very much illegal, at least in Europe.

I doubt the form they have on their website where you have to know your id to opt out of the spying would hold up in court.

And that's probably why they gladly removed that piece of software - they would risk being fined in long term in Europe, I believe.

Opt-out as someone already noted, is available on red shell company site but I would try to block it in hosts instead of going on site where you can be again tracked. In a nearly ideal world, Firaxis would ask their customers if they agree for this e-life "improvement" of more accurate ads and whatnot else. In a perfect one, they wouldn't bother including Red Shell at all.

Red shell is gdpr compliant

How so? The opt-out is sketchy at best. Also, if I fire up Civ VI, I'm not at all aware of this practice. Neither of these suggest compliance; they suggest non-compliance.

If you read their site you would see that the information is not PI. It's just to match the two events.

I have three reasons

First, and the biggest, is you have to trust these scum. That they are doing only what they say they are and won't decide to do more in the future. Are they being audited? What are the notification capabilities and contracts when they decide to look more invasively?

Second, you have to trust their programming capability. Who knows what update / reporting capabilities it has, and how well secured it isn't (every time Project Zero looks at stuff like this they find holes. Every. Time.)

Third, the lack of transparency. If this is so awesome for me as a consumer, then these companies should prominently disclose it.

Scum? You're trusting hundreds of companies with your data everyday already. Redshell is regulated by EU as a data processor just like these other services.

Lack of transparency? Go check out redshell.io right now and see how they open up about everything they do pretty damn clearly.

Multiple devs who use redshell announced its integration in patch notes. What more do you want?

An explicit opt-in when said devs made the integration, and the game dev to not send tracking data be default.

Not expect every user to read all the patch notes go to a third party website and fill out an opt out form, and then pray the third party to honour your request. This is slightly different from expecting a game dev to do so - tracking is not their sole business model after all

Actual, prominent notification, not something hidden in the patch notes.

Facebook is regulated as a EU data processor too. And look what that's done (very little so far.)

If it was beneficial, the company would be trying to give us their data so that the company could benefit. They certainly wouldn't just be taking everyone's data and providing benefits to customers not paying for that benefit.

Could you rephrase that? This software allows companies to give measurable ROI to for example community events or streams. With this they can actually prove that by sponsoring a steamer they get X amount of game installs. Everyone wins from that.

Reply on news.ycombinator.com