> Their logic: You have to be friends with the user to receive this packet. Therefore, a "trust relationship" exists.
That logic is acceptable. You could also DM an offline friend a tracking pixel to reconstruct their activity, a lot of this endpoint security is entirely up to the user.
I'm not saying any tracking is great, but a couple of things here. I cant remember when if ever I logged out os steam and this is just shared with friends right? Not sure if this is a nothing burger or not.
People should always consider the "abusive friend" scenario with regards to privacy.
Even marriages can be extremely abusive...
The assumption that people on your friend's lists, Steam or anywhere (even just people in the same household) should be able to see your personal information, such as computer use, is a bananas assumption. It is an assumption that I'm pleased to say has failed privacy reviews at at least one company larger than Steam.
People should also remember that scaling means very small percentages are still very big numbers. 0.01% of active steam users is still several thousand people. Which may seem small but it is probably 10x more people than you're friends with and more than every person you know. We get so used to seeing big numbers that we think they're small.
Seems like a reasonable report to me. Offline mode intentionally hides you from friends in the UI, so you would assume it would keep you hidden.
I have a number of friends who, for various social reasons, keep their Steam status as "Offline" so their friends don't know they're still logging in. If "Offline" can be bypassed, it ruins the point
The first thing I have to point out is that this entire article is clearly LLM-generated from start to finish.
The second thing I have to point out is that bug bounty programs are inundated with garbage from people who don't know anything about programming and just blindly trust whatever the LLM says. We even have the 'author' reproducing this blind reinforcement in the article: "Tested Jan 2026. Confirmed working."
The third thing I have to point out is that the response from Valve is not actually shown. We, the reader, are treated to an LLM-generated paraphrasal of something they may or may not have actually said.
Is it possible this issue is real and that Valve responded the way they did? Perhaps, but the article alone leaves me extremely skeptical based on past experiences with LLM-generated bug bounty reports.
> Setting yourself to "Offline" is basically a UI illusion.
I always assume this is such in every case. Every "I'm offline" or "hide me" or "don't save this" or "delete this forever!" UI element is a facade until proven otherwise. "Temporary" chats with LLMs are also permanent and are likely eventually public via massive data leak in future year 20XX.
17 comments
[ 3.2 ms ] story [ 35.2 ms ] threadThat logic is acceptable. You could also DM an offline friend a tracking pixel to reconstruct their activity, a lot of this endpoint security is entirely up to the user.
Even marriages can be extremely abusive...
The assumption that people on your friend's lists, Steam or anywhere (even just people in the same household) should be able to see your personal information, such as computer use, is a bananas assumption. It is an assumption that I'm pleased to say has failed privacy reviews at at least one company larger than Steam.
I have a number of friends who, for various social reasons, keep their Steam status as "Offline" so their friends don't know they're still logging in. If "Offline" can be bypassed, it ruins the point
The second thing I have to point out is that bug bounty programs are inundated with garbage from people who don't know anything about programming and just blindly trust whatever the LLM says. We even have the 'author' reproducing this blind reinforcement in the article: "Tested Jan 2026. Confirmed working."
The third thing I have to point out is that the response from Valve is not actually shown. We, the reader, are treated to an LLM-generated paraphrasal of something they may or may not have actually said.
Is it possible this issue is real and that Valve responded the way they did? Perhaps, but the article alone leaves me extremely skeptical based on past experiences with LLM-generated bug bounty reports.
Yes, if the target gets on their PC every day after they wake up.
I always assume this is such in every case. Every "I'm offline" or "hide me" or "don't save this" or "delete this forever!" UI element is a facade until proven otherwise. "Temporary" chats with LLMs are also permanent and are likely eventually public via massive data leak in future year 20XX.
If this is an issue to your friends on a gaming platform, you may want to relax more.