Hacker News Reader

Comment by _wkvo | Hacker News Reader

True, but a tracking pixel is an active attack that leaves a visible trail. This leak is passive surveillance; I can silently graph the sleep cycles of 200 friends without ever interacting with them. Trust shouldn't imply consent for invisible, automated logging.

View on HN

Do you really need an LLM to talk on HN? Genuinely, this research seems cool but its hard to trust your findings when there's clearly AI being used heavily in writing the article and in your comments here.

But your friends have accepted your request for friendship and your friends are not expecting you to spy on them correct?

It's about when your friends were last signed-in in their account. From my understanding:

    Invisible = Sign-in but do not broadcast the games you are playing (though your profile will show that you signed-in)

    Offline = Stay offline and do not sign-in

I mean the invisible status is supposed to hide all that, yeah. Why have a "show as offline" if it still shows activity like going online?

> Steam "Offline" status leaks exact login timestamps (Valve: Won't Fix)

On the profile of a friend you can see the last time they signed-in to their account:

https://preview.redd.it/can-anyone-beat-my-last-online-frien...

Before it was public, and now restricted (for a couple of years already) to friends only.

I guess this is why they won't change it, since it's a feature.

Incorrect. "Invisible" is a privacy control, not just a UI filter. While the official client freezes the text, the backend still broadcasts live last_logon and last_logoff Unix timestamps in the ClientPersonaState packet. This leaks exact real-time sleep/wake cycles via the socket, completely bypassing the privacy toggle.

But is it different from the "last signed-in" info that you see on the profile ? (genuinely asking)

Because from the fields in the protobuf I somewhat suspect it's the same, but I get your point of view as well

EDIT: If it's not, then my bad

Exactly. The 'Offline' feature exists specifically to set that boundary, and the backend completely ignores it.

How do you construct a sleep cycle out of login events? Does steam do one if the computer goes into standby etc?

Nope, going into standby is the same as logging off, since your client doesn't send keep alive packets anymore. (Not sure if macOS is an exception, because I think my MBP doesn't go into proper sleep if I keep Steam running)

MBP never goes into proper sleep.

I got one from work that I don't use much outside of travel and haven't changed in any way past initial setup. It stays connected to WiFi and continuously broadcasts various discovery packets for the past month and a half since I last opened it up.

I know that, I meant: Steam is preventing it from going into that sleep phase (it's still a sleep phase after all) and keeps the OS awake.

Reply on news.ycombinator.com