Seeing Other People's Steam Accounts: The Christmas Caching Catastrophe
HTML-код
- Опубликовано: 25 дек 2015
- On Christmas Day, someone at Steam changed a setting and brought down their whole games platform. I wasn't expecting to do a video this Christmas, but when enough people tweet me, it turns out I can be convinced...
(I should note: while Steam have officially confirmed "a caching problem", I've got no privileged information about the specifics. It's possible (but unlikely, I think) this was a misconfiguration at Akamai, or a bizarre server bug that happened to exactly match a much more likely caching misconfiguration error!)
"You can't sell someone a game they already own"
EA: hold my business model
Bathesda**
@@redmondhenry398 Bethesda*
Activision can be added to that list too. If I buy CoD I shouldn't have to buy a damn battle pass to get GUNS IN COD THAT I SHOULD ALREADY HAVE.
I wouldn't complain so much if they did like a challenge to unlock it. I don't wanna pay 60 dollars for stuff that's already in the game
Reminds me of the time that Need for Speed had an in-game button that directed you to the Playstation storepage to buy the game you are currently playing and therefore already own
If a good game is released by a company I don't like then I simply just pirate it.
I may or may not have panicked and angrily emailed a German man demanding my account back. sorry German dude.
+krich451 Well, now he at least knows who saw that page full of recommendations for kinky Japanese games ;)
+Jimmy De'Souza Most likely he did. Most gamers are
Jimmy De'Souza In germany it's usually english for all and then another language. Usually French, Spanish or italian.
Not everyone speaks it well of course, but a vast majority does at least understand basics.
+liquidminds Not in the former GDR part of Germany. Most people over there didn't have English in school.
And though most people of my age had it at school, many of my peers at university struggle with it.
+sk0g CSGO Productions We used to learn 2 starting in 2nd grade but then they cut it to fit budgets. Now we learn 2 starting in 6th or 9th
Loved how you started and ended with "Chinney Reckon". Thank you for explaining this whole debacle.
+The One He's been commenting that on every post.....
+dued27 So, it's the Northern English version of "Cool story, bro?"
Yes. For something that was doubtless done in a hurry, it's a very well constructed video.
The man's a storyteller
Cornelius Gustafason thx for using “debacle” its been a long time since i’ve seen that word.
Hey Tom! Thanks for the video explaining the issue. I was actually one of the guys at the MCR Creator day, great panel!
Yo PST boi!
Yo its punkdunk
out of all people in a tom scott comments you wouldnt be one id think id see
Chinny Reckon
No one cares
"There's no point in trying to sell someone a game they already own"
*Todd Howard chuckles in the distance*
@@jmoger When GTA VI is released.
Todd: ' *hey* '
so all FIFA games in a nutshell
@@darkgrundi9543 yep
3:02
That was the moment I realized that the word "server" comes from "serve"....
Nice
Same. For shame
Here I am in 2020 and because of this comment I just found out...
@@de_anubis me too :/
How. I know it's a joke but how.
I guess you could call this problem..........................
A cache 22
That one hurt.
I felt that in my heart
nice Cappo... ;)
great-minds and all that..
Do you own a cappuccino?
Whhheeeeeezzzzzeeeeeeeeeeeeeeeeeeeeeeee
People claiming that "someone" bought a load of shitty games on their accounts aren't necessarily lying, the might be just stupid. I had the brilliant Idea of adding some shitty games to someone else's wishlist and as I saw today, they endet up on mine. So if somebody tried to screw a random user by buying al lot of games for them, they might just have bought them for themselves and with their own money. Some might call this karma...
This makes perfect sense actually. Because it was just a cache, that means you saw the wrong page, but you were still logged into your real account. So when you go to the settings, buying something, adding something to the wishlist. All those requests you make are pushed to your own account; not the account shown in error.
It's like putting a sticker with a different number onto your credit card, then going to the store and buying with it thinking you're taking money from someone else's card.
@@Liggliluff That's a good analogy
steam is always trying to sell me games I already own
Download tf2
buy Skyrim
When you own over 2000 games its hard to fill your feed with "good" new titles you don't already own.
Guessing you only own hentai games.
Maybe some visual novels
GuardrailHitter why would they only own hentai games and visual novels??? Are you dumb or something?
“It’s Christmas, and I’m home with my family”
How very 2015 of you
Rood
you didnt visit your family for Christmas in 2020? sounds like a you problem tbh
Don’t mind me, just… *crying*
Nice flex
Ayo, dont jinx it for this year
Well, I have to admit: the second thing I thought of when learning of this Steam bug - right after "oh God does that mean that everybody can see my - oh wait no I'm not logged in, let's not log in" - was "I wonder if Tom Scott's gonna make a video about this".
Love your stuff, as always!
seeing you here is a trip, great work on the bug fables ost!
All the claims that people had stuff bought on their accounts are complete BS. As you said, the pages were just returning errors if you tried to change anything and credit card numbers were not leaked in full, just the last two digits. It was a pretty massive screw up, but thankfully it wasn't nearly as bad as it could have been.
+DasVERMiT It's more than enough information to trick some moron in a call centre into resetting your accounts and giving access to people who shouldn't have it.
No it's not... How would you even know where the random user had other accounts? You wouldn't. Then you don't have their name or their address. You only have 2 digits of a credit card, not 4 which is pretty much the bare minimum everyone takes. Don't be silly.
+DasVERMiT You can get into an E-mail account pretty easily without the password.
+Freecell82 This is not the year 1998. There's no call centre that actually accepts that limited information.
If you had your paypal account linked with steam, your Pay Pal email would have been displayed under your billing information
seeing a snapshot of the steam homepage in late 2015 was an absolute treat thank you tom
Hey Tom, no chance you'd see this, but do you play video games, or does coding just take up your day?
Neither! I haven't played video games in years (Portal 2 was the last one, I think, and that's five years old now). Coding's some of my day, but lately RUclips's been taking up more and more time!
+Tom Scott shame
+Nostro200 I would also be interested in something like this, how they work, etc.
+Nostro200 it's nowhere near programming related (like saying that stealing money is related to the company that makes pennies) but it's still interesting
+Nostro200 Honestly you're not going to be able to make your own cracks without a lot of work. Most cracks made today are made by groups of fairly skilled programmers, and more recent software is becoming increasingly difficult (or even impossible) to feasibly crack.
6:38 It's sad that one of the requirements has to be "not a terrible human being"...
Sauciety
@@ToxicBastard we live in a susiety
Gotta love the "yes I already asked Nerd3"
edit: oh look, 1200 likes after 4 years for some reason
Michael S.
I would think the “happy with their face on camera” bit doesn’t really fit Nerd3, but then again I don’t actively follow him.
@@vidblogger12 Literally just about every one of the 450 videos on his second channel overtly show his face...
@@adamhoskin5903 they don't but ok
Nice profile pic
@@Vextrove horrible profile pic
3kiksphillip! It looks like you two would get on together perfectly
This video was great. Everything explained so neatly and tying the end to the beginning was absolutely lovely. I'm gonna just have to marathon all your videos now.
I think the only thing missing was the phrase "idempotent". Requests that are eligible for caching are generally ones that are idempotent; that is, the data you get back generally won't change regardless of what state you're currently in. Overall, good video, and Happy Holidays.
I'm surprised that Steam only had 10K games in 2015 and has 30K games now. I thought it was in the millions.
it not easy to make games
It costs 100$ to publish a game.
@@martinator9480 The *what*
@@AAAAAAA-nh7jv or 100 euro, but AFAIK steam deals in dollars (5$ to verify your steam account)
@@martinator9480 steam deals in whatever your local currency is if they support it, euro, rubels, pesos, dollars, etc.
I love how these videos on the one hand make me feel like a total idiot (I don't know anything about computers or the internet), but on the other hand manages to make me understand what is going on after a while.
I love watching these videos. Even today, they're very useful. I'm a programmer myself, and watching these videos are great ways to make sure I don't make the same silly and devastating mistakes. I've made a few of these dumb mistakes before, and this channel (and others like it) are very entertaining and educational too.
Personally, I use caches for static data. My websites are nearly always dynamically loaded. So if I was running steam, the basic boilerplate website would be sent to your browser (cached), and your browser would start running some JavaScript. This JavaScript would start loading in all the dynamic content. So, it might call the server asking for the top 100 games, and this data would be cached since top 100 won't change often. If it asked for recommended games, this data would be cached, but cached for that user only. By having all my pages split into static and dynamic content, I can cache a lot of the website. Like the page to buy a game, I can cache nearly all of the website, the image, the description, the price, all that. I just won't cache the portion that says if the game is purchased or not.
Great video, fantastic explanation. I really appreciate the effort you put in to these videos Tom. Have a great new year.
Love that you not only explain it but make a well written explanation not just a thrown together one
I really like this channel, I really appreciate the way you go about everything with out the screaming, shouting, swearing, hating, I just really appreciate that.
"yes I already asked nerdcubed he's busy" still makes me smile to see that.
OH i get the joke
Chinny Reckon!!!! Brilliant Tom. Had forgotten all about that. Have a great Christmas!!
Thumbs up for working so hard and getting a video up even during the holiday weekend.
Not a terrible human being in or near London? That's a tall order friend, a tall order!
I'm just kidding, I loved the time I spent working in London :P
London is great in small doses but after living in and later leaving London it is good to meet friends but the endless blocks made me miss home where I could walk 3 minutes to miles of open fields and woods or a quick drive to family owned land to drive heavy machinery. The tibe is fast and easy but after an event when someone yelled bomb I was nervous. The people are nice when you get to meet them or in an emergency but on average are unfriendly, in the countys you nod and greet strangers, London is too busy for that.
@@DrLennieSmall although as someone who lives in the middle of Devon, not bring able to do anything without driving somewhere can get a bit tiresome
I have no idea who are you are Tom, and I'm not big into your subject matter above gaming quiet a bit myself but you have the nicest delivery of any human being I have ever seen. Listening to you is like liquid velvet for my ears. Merry Belated Christmas and Happy New Year! Much love from Southampton
+Henry Ley I take that back I love all your content!!
Probably the best and simplest explanation of a computer/server issue I have ever heard. Kudos.
Good video. Have a merry Christmas and a happy New Year!
How does such a young man, have such a wise and mature voice? I'm 25 and still sound like a kid.
Goddamn this guys voice is so soothing.
Watching this for four minutes, I started to think about the Altinn failure a few years back, and sure enough, you didn't fail to mention it!
You're quick!
My steam store page was in Russian yesterday, but I didn't think much of it. Interesting stuff...
There was a time where any user could ask for a password change with the secret questions, even a wrong answer would let you ask for a password change. (thought the video would be about that :D)
So... I know of a RUclipsr that matches the requirements (not sure about where he lives though; his accent sounds British, anyway), but I don't personally know him...
His channel is called A+Start, I hope I'm not completely wrong about him being British.
son of a glitch!
+Spider Hunter12 Yup.
Tweeted him about it. God damn the 140 character limit is annoying.
Welp, he said he doesn't live anywhere near London anymore. Too bad.
+InfinityCraft oh
Just when you forget about the start of the video, he brings it back at the end. Great video.
I was waiting the whole time for this video.. :P
Disney+ managed to go one better. A nice big breach that meant that someone else logs into your account, changes the names of your family members, and starts adding their favourite content to your lists.
"I already asked nerdcubed, he's busy." I'm laughing so hard
I totally remember chinny reckon. And Jackanory. I also wish I had enough of a following to be useful for your collaboration mentioned at the end. Great video - another sub gained.
I love that you specified "Not a terrible human being" at the end there.
i see ferreros in the background
lucky bastard
It ain't Christmas without 'em!
WanderingRandomer
or easter
or my birthday
The Atomic Cherry in germany u get a x20 box for +-1€
Theres a tidepod on the tree
Flex
6:18 might be worth mentioning that the cached data includes a csrf token which is used to authorize the post request. Without it, any website can tell steam that you want to buy a game using your cookie and thus it was possible until they invalidated the sessionids that someone could have bought games with your account.
Always at least "good" videos. Most times they are great.
2 videos in 1, thanks for the heads up about Steam.
Bonus on the Chiny Wonder part (I think that's what you said, I have a cold I'm getting over). Here in the U.S., back in the 80s, we used Sike. That's how most spelled it. Sometimes I saw it spelled (years later in books) as Psych, or Syke. Which, you can understand where it came from. As in, "Are you trying to mess with my mind and psych me out?" We just said "sike". Usually, drawn out, with an elongated "si" & a very hard "k".
Wow, I would love a Tom Scott + Nerd³ video in the future! XD
Try Lewis Brindley from the Yogscast, he or someone else there might be what you're looking for. They have a business email on their website :)
+Happy Heavy They're based in Bristol, aren't they? That's quite a way's away from London.
+Happy Heavy I might be wrong here (I haven't watched the Yogscast for years) but isn't YogTowers in Bristol?
+bacon Yes but that's only 2-3 hours drive from London - closer than you're gonna get with most other youtubers.
+MrBadgerMoustache Easy train ride! I think Hybridpanda from Yogs would be a good fit as well.
+chumprock Definitely, Panda would be great.
Hey Scott! Nice video, very well explained. I even understood over half the words!
I'm no bigshot RUclipsr but I live in Essex (about an hour outside London) and I'm a gaming RUclipsr/streamer. I believe I would match your criteria and would love to discuss maybe doing a collab with you! I hit you up on Twitter too,
Cheers mate, Merry Christmas.
+foxdropLoL - Be a Better League Player ah foxdrop, what a surprise
Somebody I've never heard of, never thought I'd see you here! What a surprise.
I can vouch for this guy. Have been a fan for over a year!
+foxdropLoL - Be a Better League Player YES, I advice working with Foxdrop! He is both intelligent and funny!... as well as pretty skilled at the ol' video games ;) ;)
*no bigshot youtuber
I think you have maybe around 50k
Actually has around 440k
-_-
Wow this is a really great explanation, thank you so much!
Tom, this was my real Christmas gift this year l. surprise video from you. :)
"It is Christmas, I'm home with my family."
Not this year.
This is why you use Steam Gift Cards.
John Johnson yes
Gift cards... where you take money that's accepted anywhere, and make it so you can only use it in one place. Yes, genius! ...
Do you even know what steam is?
Trollioioioioiol
Yes I do. I was noting how the hacking is dangerous, and as such, you should purchase Steam Gift Cards/
Yeah, but that doesn't change the fact a hack like this could happen. No chance of such problems with cards. Security upon security. You make a good point.
a RUclipsr that fits that description is surely ashens. he's brill, and I lovely bloke.
Recently discovered you... Great videos ;) keep it up
Does anyone know if Tom ended up making that vid with a streamer?
i guess not
I remember this. I was so confused , because I wanted to add some money to buy something and each time I clicked my vallet someone elses name showed up and their money. I never got to buy whatever it was I wanted that day :(
Monsieur, with these Rocher you're really spoiling us
thank you so much for doing this! it's really helpful
+3kliksphilip ?
For the collaboration
ok youtube, you dont have to show me this video again. it was 5 years ago, ok?
I like your Christmas costume! It goes just with the festive colours.
Tom Scott I like your videos. Wide variety and interesting
I was thinking nerd 3 when reading the list 😂
+Blunk Inator People need to beg Dan for a colab with Tom. It would be amazing.
+Blunk Inator
Dan Nerd3 or Larry Bundy are great options.
+Blunk Inator Same
What about Dad³? ... Oh "*smart* and *not sweary/shouty*" well I guess I answered my own question :)
Serious answers though:
TotalBiscuit (EDIT: Didn't know he moved)
TheMightyJingles
Hat Films (EDIT: Yes they can be "sweary")
EDIT:
FrankieonPC (Not sure where he lives, and he won't show his face)
2kliksphilip/3kliksphilip (Again not sure where he lives)
+Tom Baldwin hat films????? NOT sweary shouty
+Tom Baldwin Wait, what? Since when did Hat Films stop swearing?
+themimsyborogove42 they're smart guys, they know when to shut up
+Tom Baldwin TotalBiscuit doesn't live in Britland, though!
RandomPanda0 That would explain his rather late steaming times.
Paul aka "Squirrel" meets all of these requirements and has an IT background. Love your vids, keep it up.
This was so informative thank you so much!
TotalBiscuit, The Cynical Brit - 2M+ Subscribers
Good Guy with a subjective, thoughtful approach to game reviews and lets plays.
+William Hendick Lives in the U.S.
+William Hendick I dont think he matches the things Tom wrote ^^ he is pretty much the most shouty/sweary Person on this Planet but ye he does awesome subjective and Thoughtful game reviews and game shows on Twitch :)
this was three years and now in my recommended exactly three years later on Christmas 2018 good job yt🤦♂️
I learned a lot about how the internet works in this video. Thanks!
4 years ago. Time flies even when you aren't having fun.
What about Enter Elysium, I think he lives near london and is pretty cool.
+Nelson Isaacs yeah EE is a great streamer
+Nelson Isaacs I thought this. He'd be happy to be in a video and he's not a dumbass. He is, however, semi incommunicado right now. Don't know how long for, mainly because I can't be arsed to find out.
I second that notion.
+Firstname Lastname What makes you say that?
I support this
You asked Nerdcubed? BUT HE LIVES IN CANADA
+Peter Marsh (breadloaf64) Does he? He was in advent calendar videos with Ashens this year.
+NukeDuck He took the bus everyday from Canada to get to Ashens' place.
It was just a joke of his. If you watch his videos from the past year or so, it's very clear he's still in the UK, and probably still in the London area. Just in his own apartment now.
+Peter Marsh (breadloaf64) Your first mistake was believing him when he said he moved :P
Poor Wot :( all alone
I'd like to recommend TotalBiscuit. He's a very intelligent game journalist who would probably be ideal for anything you are planning. Big fan for a long time, keep up the funny and informative videos! Really enjoy the Citation Needed series too!
Sad what happened to him
The Mighty Jingles matches all of the requirements you set for a RUclipsr. He does lots of fun stuff! :)
3kliksphillip
Ahagan99 why did you out his name
Ahagan99 2kliks is better
Sorry but kilsphillp is better than both
sorry but freekliksphilip is just objectively better
volvo pls fix
So, my Steam account was not online during this shitstorm, would that mean my info is pretty much safe? I changed my password (via the steam client), so I know it is secure in that regard.
+Sawed Off Laser Indeed, if you weren't online when all this was going on (like me :D), your account info was never requested (unless you've got a much bigger problem!), and thus never cached, and thus not even potentially viewed by anyone else.
+Sawed Off Laser
Should be, yeah.
+Sawed Off Laser as long as you didn't view any store pages logged into your account during this time you are safe.
+Sawed Off Laser Even if you were online during the happening your info would still be pretty much safe.
The only problem would have been getting a bit more spam on your main email address
+GwresYnKernow
If it cached 1 request every minute for less than an hour (let's say 50 minutes), then only 50 people's personal details were leaked. If it was 100 servers then 5,000 people. There could have been five hundred thousand requests in that hour so the odds of it being you in that time frame is maybe 1:1000
Hi Tom! I know that you probably won't see this, but I love your videos and I want to say thank you for spending your time making them.
You know it's a UK Christmas when you've got the ferrero rocher out
Ha, glad I read the whole thing because Nerd Cubed would be the best person to go with in my opinion. It's unfortunate that he's busy.
Have you asked +ThatMumboJumbo yet? :)
this, and someone else suggested xisuma.
+HiveInsiderComments Xisuma doesn't want his face on camera though. ;)
DarkFoxDK
I know. ;) (that is, now I do, when I posted that I didn't.)
+Bence Bárdosi Sent him this on Twitter :)
hmm
The two youtubers/streamers I personally really like are The Mighty Jingles and Quickybaby. I do not know their excact living area except that it is in Britian. Nor do I know their shedule. However they do qualify for the rest of the criteria. They are very famous within the World of Tanks community to the extent of being guest commentators for the World of Tanks Grand Finals in Poland. They are gentleman. And some of the most decent poeple I know. The biggest example is the charity event quickybaby organized which raised over 22 thousend pounds. Jingles also helped with this. I think they are amazing, but that is just a personal opinion.
Next to that thanks for taaking the extra time of on christmas for this video
after watching this and then watching the rest of the bug and exploit vids, you really should do a segment on current and past ones.
I would suggest Josh (RageGamingVideos) as you have already asked Nerd³ :D
INPS 2020
Anche peggio, basta aggiornare la pagina per vedere l'anagrafica di qualcun altro...
Thanks TotalBiscuit for signal boosting this great, succint and understandable explanation that is very useful for less computer savvy people!
+Random Person Nope.
They werent hacked. DoS is as much of a hack as harsh words are bombs...
They were overloaded and their caching service was badly implemented. This video exactly explains what happened next.
+Random Person Dude, do you even know what DoS attack is? Apparently not, so just stop.
+Random Person Well you manage to be complete idiot in just few seconds so I will leave you at that :D
Sad looking at this now
Tom, with those ferrero rocher you're really spoiling us
I was going to say Nerd3, dammit.
"You can't sell someone a game they already own"
EA: *Truth is... It was rigged from the start.*
Can't wait for the collaboration.
Thanks. I learned a lot from this video. Very well explained.
Total biscuit! (aka cynical brit)
+BrotherBloat I don't think he lives in london anymore
+BrotherBloat In or near London
+themimsyborogove42 He lives in North Carolina. Not exactly local. :p
+Daniel Chiverton He lives in the US nowadays
+themimsyborogove42 Hes in North Carolina nowadays.
I live in Christchurch and I game stream is that close enough? I have about 3 viewers Kappa
ik keep upvoting this content, video after video. Can't help it. It's that good
I watch this every year now, its a minor tradition.
come on people of 2020, lets talk about google services this december
80% percent on aoe2 is a fantastic deal though..
What a beautiful pronunciation! Subscribed!
Wow I always wondered why you'd occasionally get your store page in another language during a sale.
This makes a lot of sense.