222
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 01 May 2024
222 points (95.1% liked)
Gaming
2357 readers
198 users here now
The Lemmy.zip Gaming Community
For news, discussions and memes!
Community Rules
This community follows the Lemmy.zip Instance rules, with the inclusion of the following rule:
- No NSFW content
You can see Lemmy.zip's rules by going to our Code of Conduct.
What to Expect in Our Code of Conduct:
- Respectful Communication: We strive for positive, constructive dialogue and encourage all members to engage with one another in a courteous and understanding manner.
- Inclusivity: Embracing diversity is at the core of our community. We welcome members from all walks of life and expect interactions to be conducted without discrimination.
- Privacy: Your privacy is paramount. Please respect the privacy of others just as you expect yours to be treated. Personal information should never be shared without consent.
- Integrity: We believe in the integrity of speech and action. As such, honesty is expected, and deceptive practices are strictly prohibited.
- Collaboration: Whether you're here to learn, teach, or simply engage in discussion, collaboration is key. Support your fellow members and contribute positively to shared learning and growth.
If you enjoy reading legal stuff, you can check it all out at legal.lemmy.zip.
founded 1 year ago
MODERATORS
There should be laws against this everywhere (with other forms of data collection included). There's no way preventing cheating is more important than the fundamental rights to security and privacy.
There is, this could have the potential to collect PII and its %100 they're not storing this as encrypted data on their side. So it is %100 illegal to do, now if they're fined for it is a different story.
Even if encrypted this doesn't sound like something compatible with the GDPR.
It depends. There's 2 different methods that I don't think they're doing that would make it legal:
Explicitly tell the user what data the anti-cheat collects when you install it, and what other companies have access to it.
Anonymize the data. Crop the screenshots in storage media to just the game screen, and have a list of which games need what sections of the screen blurred to remove usernames.
The first is far more useful for them than the second, but it also undermines it's functionality as an anti-cheat because you're telling the cheat creators what to guard against.
Of course, the real answer here is stop doing user-side anti-cheat at all, do it server-side, and trust nothing the client says. That's more difficult than user-side, but it also has the benefit of working, while also respecting the user's privacy.
Which is why I'm almost certain it's not happening. So far the only source is a cheat forum. I wonder what their motivation is.
Even in corporate dystopia where they monitor you every 15 seconds screenshots are frowned upon. You never know what kind of sensitive data that can reveal.
There's no way Riot is doing it. The backlash would be immense, and they absolutely know it.
This agitprop stems from the makers of cheat software who are mad that the risk of using their hacks will go through the roof. Sure, you can still get around it. But now if you screw up it's a hardware ban.
They're gonna lose a lot of accounts that they sell at $10/pop.
I wouldn't mind talking more about security, but I'll save that for another comment.
I wouldn't be totally surprised if it was taking a screenshot and analyzing it locally or maybe somewhere on the network, but I agree it's really unlikely they're storing it.
This is what I'm thinking as well, what's the point of doing this? As you're going to take and go through every image with a human checking it out? Just seems pointless.
I'll take that bet. Even a standard S3 bucket is "encrypted".
Sure but I doubt they're sending these to aws storage, probably just sending them to their internal storage, and very few companies encrypt server data unless it's at rest....or they've got it on someone's laptop with bitlocker on it lol
The screenshots are awful, but your statement is pure speculation, and likely just wrong. It's pretty easy to encrypt images.
First it's not speculation, PII is protected information. As a company you cannot collect it without properly storing it, nor can you collect it without prior authorization. Second, the odds that they're encrypting the images is pretty damn low as they're not actively looking for PII and just cheating software.
I know PII is protected, and a company like Riot is audited. I'm sure something in their TOS says they can collect the information, as BS or unenforceable as it is.
They're probably multi-cloud, but I know they are a huge AWS customer because they have a giant booth at re:Invent every year. AWS has pretty easy ways to encrypt data and even detect if it has PII. They'd encrypt or redact the images because the potential of capturing HIPAA or PCI information is too great a risk.
If anything, trust that the company is profit driven and will avoid that risk. They're still garbage and kernel level anti-cheat sucks, but we shouldn't be spouting that unencrypted stuff as fact.
Until otherwise noted, I am going to take the cautious route on this one. I've worked with a lot of fortune 500 companies and they love to do shit the cheapest way possible.
Just last year I was at a security conf and they said the biggest threat to security right now is anticheat software, especially that owned by state actors. The venn diagram for people with anti cheat installed and people with admin priveliges and SSH keys for work installed is almost a circle.