is safe to share the steam api key with ark server manager?

[FAT32]

i was reading that you have to keep the steam api key confidential and don't give it to 3rd parties...

[edb.2003]

Depends on how much you trust the provider

[zerassar]

If you want server manager to be able to do anything with steam at all then it needs the key...

[FAT32]

hmm... thx guys ❤

[Mathius]

I've never noticed any problem with that, and I've had servers off and on since '21.

I will say that a youtuber said in order to get your server to show up in the in-game menu, he advised posting your server to arkservers.net and that was TERRIBLE advice.

My VNC got hit with a brute force attack and I can no longer use it outside the LAN because every time I try to start it up, I get hit with non stop connection attempts, so I had to remove the port forwarding.

I brought it up on the UltraVNC board and the admin said to just change my port for VNC, but one of my oldest friends who is lead programmer for a shipping company told me hackers could just do a port scan anyways.

I trust him more than the guy trying to get me to use his software.

Also, if this is your first server, I recommend you whitelist instead of using a password, unless you intend it to be public.

[Liralen]

We originally used a whitelist only, but frequently saw messages saying that people were trying to join. Obviously, those people saw our servers somewhere.

So we added a password too and the problem went away.

[zerassar]

Originally posted by Mathius:

I've never noticed any problem with that, and I've had servers off and on since '21.

I will say that a youtuber said in order to get your server to show up in the in-game menu, he advised posting your server to arkservers.net and that was TERRIBLE advice.

My VNC got hit with a brute force attack and I can no longer use it outside the LAN because every time I try to start it up, I get hit with non stop connection attempts, so I had to remove the port forwarding.

I brought it up on the UltraVNC board and the admin said to just change my port for VNC, but one of my oldest friends who is lead programmer for a shipping company told me hackers could just do a port scan anyways.

I trust him more than the guy trying to get me to use his software.

Also, if this is your first server, I recommend you whitelist instead of using a password, unless you intend it to be public.

Opening vnc across the internet in generally is a really really bad idea. Use a VPN into your network and then vnc from there.

Changing the default port just makes it less likely that random bots doing a cursory scan of default ports will take a stab at you. But a determined adversary will do a full port scan.

[🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊]

Originally posted by zerassar:

Opening vnc across the internet in generally is a really really bad idea. Use a VPN into your network and then vnc from there.

Changing the default port just makes it less likely that random bots doing a cursory scan of default ports will take a stab at you. But a determined adversary will do a full port scan.

No it's not. I do it all the time. The VNC protocol supports encryption. Once a secure (encrypted) VNC connection is established between client and server it is completely secure. Just as secure as any other connection on the internet that uses industry standard encryption methods. No VPN's are necessary to establish a secure VNC connection.

[zerassar]

Originally posted by 🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊:

Originally posted by zerassar:

Opening vnc across the internet in generally is a really really bad idea. Use a VPN into your network and then vnc from there.

Changing the default port just makes it less likely that random bots doing a cursory scan of default ports will take a stab at you. But a determined adversary will do a full port scan.

No it's not. I do it all the time. The VNC protocol supports encryption. Once a secure (encrypted) VNC connection is established between client and server it is completely secure. Just as secure as any other connection on the internet that uses industry standard encryption methods. No VPN's are necessary to establish a secure VPN connection.

I think you're missing my point. I was not referring to MITM style attacks intercepting traffic in transmission as you appear to be.

VNC does not have the authentication back end to naively support proper defence against brute force attacks or modern authentication standards such as OAUTH/SAML. You're also exposing and increasing your attack surface area to yet another application when you should be minimising it.

VNC traffic in transmission that is encrypted will not protect you from a brute force attack as mentioned in the comment I was responding to. And neither will the traffic being encrypted protect you from software faults and CVE's relating to the software itself and unauthorised execution of arbitrary code on the endpoint itself.

By placing all unnecessarily exposed endpoints behind the VPN you are reducing the attack surface and protecting applications that are ill-designed for a determined adversary.

I have to secure this type of stuff in the enterprise all the time. Just because you personally do it all the time and you've not had any issues does NOT mean its a smart thing to be doing. Your perception of "secure" seems to be really narrow and missing a whole chunk of the picture.

[zerassar]

Am not sure I was particular clear... So to clarify.
I am not talking about encrypted transmission traffic or using a VPN to protect the data stream in transit.

But what I'm really referring to is avoiding exposing ports to internal applications on your network where possible.
Setting up a VPN server on your home router or PC allows you to remotely connect to it over the VPN without exposing vulnerable applications ports to the public internet.

By only exposing the ports required for the VPN allows you to protect multiple other internal applications that are not really designed to be accessed directly over the internet. Most VPN's also allow for more secure authentication than simple username+password.

[🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊]

Originally posted by zerassar:

words

You're drastically overthinking all of this. It's a trivial simple thing: VNC has Encryption. Encrypted VNC is completely safe to use on the open internet.

[🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊]

Originally posted by zerassar:

Am not sure I was particular clear... So to clarify.
I am not talking about encrypted transmission traffic or using a VPN to protect the data stream in transit.

But what I'm really referring to is avoiding exposing ports to internal applications on your network where possible.
Setting up a VPN server on your home router or PC allows you to remotely connect to it over the VPN without exposing vulnerable applications ports to the public internet.

By only exposing the ports required for the VPN allows you to protect multiple other internal applications that are not really designed to be accessed directly over the internet. Most VPN's also allow for more secure authentication than simple username+password.

VNC is a industry-standard remote access protocol that millions of people and businesses use on a daily basis. Many servers have it open direct to the internet for remote access. There's nothing wrong with VNC. I have no idea what agenda you have or what you're trying to do here but posting completely false technical information on the steam forums will not work for you.

[zerassar]

Originally posted by 🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊:

Originally posted by zerassar:

words

You're drastically overthinking all of this. It's a trivial simple thing: VNC has Encryption. Encrypted VNC is completely safe to use on the open internet.

And again youre completely missing the point. But you do you I don't care to argue when you're so content to argue a completely different point to the one Im making

[zerassar]

Originally posted by 🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊:

Originally posted by zerassar:

Am not sure I was particular clear... So to clarify.
I am not talking about encrypted transmission traffic or using a VPN to protect the data stream in transit.

But what I'm really referring to is avoiding exposing ports to internal applications on your network where possible.
Setting up a VPN server on your home router or PC allows you to remotely connect to it over the VPN without exposing vulnerable applications ports to the public internet.

By only exposing the ports required for the VPN allows you to protect multiple other internal applications that are not really designed to be accessed directly over the internet. Most VPN's also allow for more secure authentication than simple username+password.

VNC is a industry-standard remote access protocol that millions of people and businesses use on a daily basis. Many servers have it open direct to the internet for remote access. There's nothing wrong with VNC. I have no idea what agenda you have or what you're trying to do here but posting completely false technical information on the steam forums will not work for you.

Again... Attack surface... and encryption in transit... ARE COMPLETELY DIFFERENT THINGS.
But you keep at your survivor bias and arguing a completely different point.

[🦊Λℚ𝓤ΛƑΛᗯҜᔕ🦊]

Originally posted by zerassar:

Again... Attack surface... and encryption in transit... ARE COMPLETELY DIFFERENT THINGS.
But you keep at your survivor bias and arguing a completely different point.

Originally posted by zerassar:

And again youre completely missing the point. But you do you I don't care to argue when you're so content to argue a completely different point to the one Im making

A short summary of what happened: You came in to this thread literally out of no where and suddenly decided that what the OP is using to remote access their server computer (VNC) shouldn't be used. You did not say WHY or give any reason just "VNC bad. Do not use." See here:

Originally posted by zerassar:

Opening vnc across the internet in generally is a really really bad idea.

---

Then when I completely debunked your statement as false information you decided to "double down" and make up all sorts of complete nonsense that has nothing to do with this thread, the conversation, VNC, or.. whatever it is that you're going on and on about to make yourself feel smart in public.

And now you're trying to attack me in public... 🤣🤣

I have no idea what your agenda is or what you think you're trying to do here but you certainly aren't succeeding at whatever it is. It looks like you're just trying to harass random people, hijack their threads, and start arguments for no actual reason.

[zerassar]

Bro you're totally twisting this. You claimed I had an agenda and spreading false information.... But I'm attacking you??? You then repetitively tried to link my statements to encryption which has nothing to do with what I was saying.


I did NOT say that vnc was bad. I said that opening it up for across the internet was a bad idea and it is. Not that using it on the internet! The point is the ports open on the end points are what's vulnerable. Not the traffic in transit that you keep referencing. vPNing into the servers network before using VNC would protect against the brute force attack and port scanning the OPs comment mentioned.

That you can't discerned the difference between those things suggests that youre a lay person. Which is ok but maybe don't accuse people of having an agenda just because you don't completely understand what they're saying. This could have been discussed without the accusations.

Attacking you? I didn't attack you. You stated you opened the ports and were fine. Which is a survivor bias. Just because you've been fine doesn't mean it's a great idea. I've had to cleanup countless environments where such decisions were made and resulted in a data breach.

If you want to actually talk it out I'm happy to. But if all you're going to do is accuse me of having an agenda and spreading false Information then Ill leave you to it.

Take care