Privacy violation in CEF crash reporter, possibly also GDPR-relevant

steamopen

ValveSoftware/steam-for-linux#6459 · opened 2019-08-18 by neagix · updated 2019-08-28 · 2 comments · github

Nneagix 2019-08-18 github

Your system information

Steam client version (build number or date): latest, 12 August 2019
Distribution: Ubuntu 16
Opted into Steam client beta?: No
Have you checked for system updates?: Yes

Please describe your issue in as much detail as possible:

The Steam client is constantly uploading crash reports. The issue here are not the crashes themselves, but the fact that user cannot disable this behaviour.

The file in ~/.local/share/Steam/ubuntu12_64/crash_reporter.cfg contains:

[Config]
# Product information.
ProductName=cefwebhelper
ProductVersion=[redacted]

# Required to enable crash dump upload.
ServerURL=http://crash.steampowered.com/submit

# Disable rate limiting so that all crashes are uploaded.
RateLimitEnabled=true
MaxUploadsPerDay=5

[CrashKeys]
Vendor=small
UserID=small
BuildID=small
SteamUniverse=small

If I disable the ServerURL, it gets overwritten after every reboot.

This means it is currently not possible to stop the Steam client from uploading the crash dump files, which do contain sensitive information.

Rryao 2019-08-23 github

What sensitive information is in a steam crash report that Valve does not already have?

Hh1z1 2019-08-28 github

Different titles have their own ugliness including Unity's analytics crapware. The crash dumps are not over SSL and do include quite a bit (they are meant to help developers after all).

For Steam at least:

ln -s /dev/null /tmp/dumps
echo "0.0.0.0 crash.steampowered.com" >> /etc/hosts

Remove as needed. And yes, /tmp/dumps is hard coded. The security implications are a whole other issue I reported a long time ago.

Nothing extracted yet.