An anonymous blog claims that the Steam client continues to broadcast your log-on and log-off times, even if you set your status as “Invisible” or “Offline.” According to the Xmrcat blog, “Setting yourself to ‘Offline’ is basically a UI illusion. You might appear offline to the world, but the backend Connection Manager (CM) continues broadcasting your live activity to the socket. This leak bypasses everything, even ‘Private Profile’ settings. It essentially hands your friends a real-time log of exactly when you sleep and wake up, making your privacy settings effectively useless.”
According to the report, the Steam client apparently broadcasts raw Unix timestamps to all the friends you added on the platform every time your status changes, even if you turned on your privacy settings to hide your information. The only difference with going “Invisible” or “Offline” is that the client on your friends’ PCs and devices will put your profile under the “Offline” list, so they cannot see you, but the client still knows when you last logged in or out.
This might not be an issue for the average user, but those who know their way around programming and development could potentially extract the information from Steam’s backend. It’s possible to intercept the ClientPersonaStaste protobuf message payload, which will potentially reveal your sleep cycle or gaming habits, allowing someone else to track your behavior without your knowledge.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
