ValveHardware Survey: Hash of MAC-Address. WHY

[RedPill]

Dear Steam, I was just about to participate in the hardware survey. Looked trough the info i was about to send, until the last line when you guys wanted the hash of my freakin MAC-ADDRESS! With all respect, WHY? Like, seriously, give me a legit reason WHY YOU WOULD NEED THIS?

A MAC-ADDRESS is unique to each network interface. Never changes. So you hash it for privacy I assume? But that hash will be just as unique as the address itself? And only if you knew my address in advance you could match it?

I would have loved to participate, but this is really odd. C'mon guys.

[logicbuster]

completely false

[RedPill]

Originally posted by logicbuster:

completely false

Can you be any less speciffic?

[RedPill]

Here a screenie in case you doubt this:
https://pasteboard.co/ngWVDdwnJSRN.png

[Sazzouu]

What exactly are you upset about? The Hash part or the MAC-Address at all?

Also...

Originally posted by RedPill:

But that hash will be just as unique as the address itself?

... hashing does not necessarily yield unique values. That completely depends on the implementation.

My assumption here is that they hash it to handle it better on a database end that some weird 00:80:41:ae:fd:7e type of address but an easy to handle byte stream.

[Mad Scientist]

There's nothing odd about hashing more sensitive information, nor are such things displayed on the actual Hardware Survey page. Just because it can read everything it lists, doesn't mean it's all collected, take a look here:
https://store.steampowered.com/hwsurvey

[RedPill]

Hashes are by definition unique. (and this was clearly SHA256) If not, thats called a collision and defeats the purpose...

I think I made myself really clear, that I ask WHY they would want that information. What can they derive from that? What sense does it make to take this speciffic piece of information. That's all I'm asking.

[my new friend]

People should use the search.
https://steamcommunity.com/discussions/forum/0/2284960483101575946/
https://steamcommunity.com/discussions/forum/10/2284960483106055452/
https://steamcommunity.com/discussions/forum/0/2577697615745449298/

[RedPill]

Originally posted by Mr. Gentlebot:

There's nothing odd about hashing more sensitive information, nor are such things displayed on the actual Hardware Survey page. Just because it can read everything it lists, doesn't mean it's all collected, take a look here:
https://store.steampowered.com/hwsurvey

It literally said, all the below information will be sent to valve. So they have it. If they show it publicy is a different story.

[rawWwRrr]

If something about the survey concerns you, don't partake in it.

[RedPill]

Originally posted by rawWwRrr:

If something about the survey concerns you, don't partake in it.

I guess I will delete this thread and write them an email. Maybe they can tell me why this piece of information is dear to them.

[Mad Scientist]

Originally posted by RedPill:

Originally posted by Mr. Gentlebot:

There's nothing odd about hashing more sensitive information, nor are such things displayed on the actual Hardware Survey page. Just because it can read everything it lists, doesn't mean it's all collected, take a look here:
https://store.steampowered.com/hwsurvey

If they show it publicy is a different story.

https://store.steampowered.com/hwsurvey

Notice MAC Addresses are not listed.
Participation is voluntary, and you can even alter such things or mask them anyway, so it's not exactly important.

Originally posted by rawWwRrr:

If something about the survey concerns you, don't partake in it.

Originally posted by RedPill:

Originally posted by rawWwRrr:

If something about the survey concerns you, don't partake in it.

I guess I will delete this thread and write them an email. Maybe they can tell me why this piece of information is dear to them.

It isn't. Though if you were to think about it, that kind of information could possibly help confirm another piece of information about the user if attempting to have them access their account, if they lose control of it.

[RedPill]

Given there are so many questions about this already clearly shows that this is something many people wonder about.

I am well aware that it's my choice to participate. I would have liked to, to give the world a more representative statistic about users' hardware, I'm fine with that. But I don't get WHY, I can't put enough emphasis on this part, WHYYYY they would want that. That's literally the only thing I am asking here.

You guys are just inventing some "plausible" reasons; easier for the database, ...to restore a lost account?.........

Lemme try: Maybe they just want a unique identifier for this 'anonymous' survey. Anybody sees a certain irony here?

[Aachen]

Sending mail to someone from Valve probably won’t gain you any deeper insight.

[nullable]

Originally posted by RedPill:

Dear Steam, I was just about to participate in the hardware survey. Looked trough the info i was about to send, until the last line when you guys wanted the hash of my freakin MAC-ADDRESS! With all respect, WHY? Like, seriously, give me a legit reason WHY YOU WOULD NEED THIS?

A MAC-ADDRESS is unique to each network interface. Never changes. So you hash it for privacy I assume? But that hash will be just as unique as the address itself? And only if you knew my address in advance you could match it?

I would have loved to participate, but this is really odd. C'mon guys.

Well I'm not sure what you think the problem with encrypting data is and the possibility that that encryption may yield unique results.

I think you're operating under some uninformed assumptions about how valuable and secret a MAC Address is, and that's enabling you to raise concerns and suspicion that aren't very well informed.

https://security.stackexchange.com/questions/67893/is-it-dangerous-to-post-my-mac-address-publicly reading this doesn't exactly shock me. And it doesn't matter since your MAC address is being encrypted by Valve. And it's simply not very valuable information, not valuable enough where decrypting the hash is worth the effort.

Also millions and millions of people use Steam, do you think there might be a few security experts in the bunch? Where are the articles warning of the dire risks of Valve's MAC Address hash? But you have some ill-defined concerns, so there must be an issue? C'mon man.

[Brian9824]

Most likely as you already said its just a unique identifier so you can't fill out the survey multiple times, again if you don't trust them with the info don't do it.

Most likely they won't explain why especially as valve doesn't have an email they answer. If they were doing anything shady they wouldn't even tell you they collect it after all.