The Family Sharing need to be updated and good Parental Controls added to SteamSuggestion

[iNQUAM]

Feel free to vote on the Reddit post with the same topic (IF you agree) to perhaps got it noticed by Valve: https://www.reddit.com/r/Steam/comments/5lz6mj/the_family_sharing_need_to_be_updated_and_good/?st=ixj0io32&sh=f286e0d7

I have used Steam since it was released around 13 years ago. I'm a software engineer and understand what goes into developing a platform like Steam. That is also why I scratch my head over the absence of some "no brainer"-features. Over the years I have paid for 500+ games on the platform and as long as you are the only person in the family playing games it works great. But when you get kids and want to invite them into the world of computer games things start to feel like a beta platform.

The Family Sharing option sounded like a great thing when it came. Digital distribution should not present a hurdle to simple things like letting our kids play our bought games that we didn't even have in the physical disc era. But since my kids were still so young I didn't get around to using it. Now they are older though and I decided to give that a try and also decided to buy a couple of Steam Links to allow for gaming by our TV's to play in a more social environment. Then it becomes obvious what a joke Family Sharing actually is. First, let me start with what would make perfect sense.

You share your library with your kids and they are able to play your games. Since you only have one copy of each game in your account you can not play the same game at the same time. So I would be able to play CS:GO, while my son plays my copy of Need for Speed and my daughter plays my copy of Stardew Valley. They could each, from their computers in their rooms choose to stream to one of the many Steam links I have in the house.

How does it actually work? ONE copy of any of my 500+ games in my library can be running at any one time for a single user. Is this the digital future? These are games I have all paid for. Along with multiple Steam Links meant to allow my kids (and myself) to game at any of our TV's. As a family, owning several Steam Links make almost NO SENSE with this limitation. The 100+ Xbox 360 game discs I have in the cupboard that was the way of the stone age offers much more flexibility and easily allows my kids to play any given game on any of the three Xbox 360 consoles that we have in the house.

Valve, what you should do... sorry, what you should have done a long time ago is

• Implement actual "child" accounts that are controlled by the parent account.
  
• Allow parents to setup which kind of actions a child account can do
  - Chat
  - Make friends
  - Play online
  - Use the store
  - Which games can be played
  - How many hours total they are allowed to play
  - How many hours they are allowed to play any given title
  
• Allow parents to "give" playtime to kids as a reward
  
• Allow the child accounts to access the games in my library I have given them access to and allow me to play games at the same time
  - One running copy of any game at the same time is fine. But allowing multiple copies so the kids can play together would be a nice gesture to show you know you screwed up before with Family Sharing. Developers should also have the option to allow X copies to run at the same time for allow families to play together if they like. For example the developers of Astroneer might allow for four people of the family to play to allow parents and kids to experience their game together.
  
• Allow parents to "own" multiple copies of a game so multiple children can use them at once to play together.
  
• Allow parents to convert child accounts to "real" accounts once the kids are old enough and to the pass along any games from the parents main library to the child account when this is done.

This would allow for similar usage that we have with our game consoles in the house and would allow the Steam Links in the house to actually be useful. Digitial distribution should allow for MORE flexibility compared to the old ways of discs. The way it is now it's a WORSE experience than what we used to have.

What we have now is a great distribution platform that in some aspects is a joke and features like great parental control that would be EASY to implement is still not here, 13 years after the launch.

[iNQUAM]

Tito Shivan eredeti hozzászólása:

iNQUAM eredeti hozzászólása:

The issue with making sure 200, or 2.000.000 people don't get access to your account at once, could be easily handled as explained time and time again.

Explain it, because i seem to have missed it.

Since access should not be open for everyone and you would have to grant access to individual account/computers you could easily keep track of this and limit it to a given number or to accounts you have provided proof of belonging to your family.
Adding these "limits" is something known solutions exist for. They could limit how many clients have access, how long that access lasts before it has to be renewed, that granted access can't be passed along to another party etc.
One thing Valve could really do to help secure this further is to tie accounts to individuals even better and use that information when granting access. Not to mention it would help them battle recurring cheaters ;)

[Start_Running]

iNQUAM eredeti hozzászólása:

Tito Shivan eredeti hozzászólása:

Explain it, because i seem to have missed it.

Since access should not be open for everyone and you would have to grant access to individual account/computers you could easily keep track of this and limit it to a given number or to accounts you have provided proof of belonging to your family.

And this would be?

Adding these "limits" is something known solutions exist for. They could limit how many clients have access, how long that access lasts before it has to be renewed, that granted access can't be passed along to another party etc.

THe level at which this would have to be done to be effective would be an incredible inconvenience to actual users.

One thing Valve could really do to help secure this further is to tie accounts to individuals even better and use that information when granting access. Not to mention it would help them battle recurring cheaters ;)

You mean like hashing the hardware devices on the system ala, windows, etc. That would sort of kill the idea of steam. THe biggest strength is that you can access and game from any computer you happen to be at. Tying the account tighter would mean they'd need to actually consider the machine as the individual.

[iNQUAM]

Start_Running eredeti hozzászólása:

And this would be?

If actual proof was to be used there exist digital ID's issued by for instance banks that can be used for this thing. It's highly used to identify yourself to different parties in Sweden and other countries. It's not used all over the world and different systems exist in other places. But where it exist it could be used for sure. Less reliable, but still helpful ways, could be to tie accounts to credit cards etc. Sure a 13-year old could not use this, but they are perhaps not the primary concern here anyway since they probably don't have kids to share their library with etc. Some features might have to be locked for "verified" users.

Just limiting the number of grants you could give out, how long they last and how often you could change them would be a trivial issue using existing technology.

Start_Running eredeti hozzászólása:

THe level at which this would have to be done to be effective would be an incredible inconvenience to actual users.

No, since it would not have to affect users not wanting to take advantage of them at all. So for them there would no change at all.

Start_Running eredeti hozzászólása:

You mean like hashing the hardware devices on the system ala, windows, etc. That would sort of kill the idea of steam. THe biggest strength is that you can access and game from any computer you happen to be at. Tying the account tighter would mean they'd need to actually consider the machine as the individual.

No, I don't think that the hardware should be your identifying factor. As mentioned above, digital identification or credit cards, is something I think would work better. Tying the account to a single machine would also limit the user experience. Since opening it up is exactly what I'm advocating it would make little sense. But some "arguments" and mentality put forward for why Valve "should not offer this" would fit nicely with thinking locking your account to a single PC is a GREAT idea. I however do not.

I want Steam to be as unrestrictive as it can be for legit users. Having some of these functionality locked behind "verifying" you identity (like some gambling and trading sites have for instance to minimize abuse) is something I could totally understand and respect.
I would have no issue providing what ever proof was needed to verify my identity. Having it as an optional step it would also make sure no user was forced and keep their current experience unchanged.

By extension good user identification/verification could allow for creation of things like "only queue against other verified users" in CSGO and a ban beeing permanent for that verified user. Sure he could still buy a new account, but he could never verify himself again and start playing in that pool of players. With time actually creating a pool of legit players where someone caught could not simply buy a new account and be back tomorrow. "Prime" was kind of a baby step in this direction. But the verification could be so much stronger.

All of this could be done and it's not like Valve would not have the capability of making it happen. But I don't think they will, but for other reasons than it beeing "hard".

[Tito Shivan]

iNQUAM eredeti hozzászólása:

Since access should not be open for everyone and you would have to grant access to individual account/computers you could easily keep track of this and limit it to a given number or to accounts you have provided proof of belonging to your family.

This is already how the actual system works. And people are already sharing their accounts across the globe.
Hence you'd only achieve to multiply the abuse.

iNQUAM eredeti hozzászólása:

By extension good user identification/verification could allow for creation of things like "only queue against other verified users" in CSGO and a ban beeing permanent for that verified user. Sure he could still buy a new account, but he could never verify himself again and start playing in that pool of players.

You can't reliability verify/identify users, only accounts.

[iNQUAM]

Tito Shivan eredeti hozzászólása:

This is already how the actual system works. And people are already sharing their accounts across the globe.
Hence you'd only achieve to multiply the abuse.

This could be refined and extended a lot to effectively kill off any feasibility of switching back and forth between people you share with all across the world. I could live with this feature beeing limited to "in-house" and only working while the pc's are on the same local area network. That would be a perfectly valid limitation of a "family sharing"-solution.

Sure you could use vpn to try and fake beeing on the sam local area network, but most public vpn's you can identify very easily. Also, since Steam is running locally it would not be very hard to identify the usage of vpn on a given client. That would remove a lot of people right away. Of course, some people would run the vpn client on their router or something like that.

A traceroute from the client might be able to tell you if a vpn is used then, since most of the vpn providers have static ip addresses for their exit gateways. It could just be using a list of known ip addresses to identify vpn's. Even when they don't have a list, a simple reverse dns lookup might tell them that the ip has a hostname which is obviously a vpn provider and not one assigned by a normal internet service provider.
This would remove another chunk of people.

You could check for clients claiming to be on the same network as multiple other clients (to share with more people) and by not every other client seeing every other client figure out that they actually are not on a single local area network. Indicating that the client is most likley using multiple vpn connections to connect to the other clients.
Even if a good, well hidden, vpn was used this would limit the usage to sharing between two clients or having every client connect to every other client using similarly well-hidden vpn's. The obstacles would start to build up and more people would give up at this point.
Combine this with checking a client for potential "strange changes" in a computer location caused by running steam without the vpn, causing you pc to look like it's in the US, the a few minutes after that Sweden and a few minutes later in the US again.
Keeping a group of computers from all over the world synced with vpn's and make sure this doesn't happen to a single one of them would start to be a bit of a pain :P

Even such a simple thing as a ping where one machine is constantly giving you 70ms+ and the other one <15ms that claim to be on the same network would be suspicious.

This could all be automated.

Now, all of this are actual technical ways of achieving added reliability of the service and minimize abuse. But that is not what a customer wishing for a feature should have to provide. Valve would do a much better job of this themselves.
And yes, you could still find edge cases where some people still make it work. But that goes for everything. We should stop every single service in the world if this is what we are after.
Stop releasing games since some people crack and pirate them, stop building cars because some people will drive too fast in them, stop making beer since some people will drink too much and fight. A 100% secure world is, I would argue, impossible to achieve.
What we can strive for is something that is secure enough compared to the convenience it provides.

Tito Shivan eredeti hozzászólása:

You can't reliability verify/identify users, only accounts.

Once again, if you are looking for 100% guarantee it will be hard. But the same goes for any form of id (unless possibly based on dna which was registered a birth). You can forge physical id's, drivers licenses etc. So no it's not 100%, but you can get close enough to make banks, trading services and public offices accept it.
For instance, the digital id's mentioned before that we have in Sweden would be quite secure. They are issued by your bank after you have provided proof of your identity and can be used top identify yourself to online services such as banks, trading services, the tax office etc.
The problem with it is that not all countries have a feature like this.

Something like what gambling/trading sites use to comply with kyc laws would be more applicable if used worldwide. It's considered "good enough" to prevent money laundering using gambling sites and so on and should probably be "good enough" for Steam.
Note though that if the above solution of limiting family sharing to the same physical local area network was used then the need for this kind of verification would be much smaller for the sharing function. For tying the account to an individual and enable individual bans it would still be feasible though. But since they make so much money on banning cs players and having them buy new accounts I would guess they would not like to fix that :P