"hostname" and other launch parameters leaked to youtube

[Darth]

ISSUE

Steam gives "hostname" and other properties to Youtube.

STEPS

- Embed a Youtube video in Steam Chat
- Click the video title at the top of the embed
- A youtube path opens in your browser. Quickly copy the link before it cleans up.
- Paste in notepad to read.

RESULTS

Steam isn't restricting the referrer, which means third party iframes (such as Youtube) can see the full Steam Client path which includes config details. Youtube is adding the referrer to an embeds_referring_euri parameter, which you can see with the above steps.

https://www.youtube.com/watch?v=xxxxxxxxxxx&embeds_referring_euri=https://steamloopback.host/index.html?IN_CLIENT=true&LOCAL_HOSTNAME=XXXXXX&USE_POPUPS=true&DEV_MODE=false&LANGUAGE=english&PL&embeds_referring_origin=https://steamloopback.host&source_ve_path=xxxxxxx&feature=emb_title

(Url decoded for readability. Client path underlined. I've edited out my hostname.)

This has been around for at least a few versions and is still present in 1685483787. The referrer will likely be available to other embeds like Vimeo and Sketchfab but I've only tested Youtube.

EXPECTED

Steam would prevent Youtube from reading these parameters by restricting referrer. This could be done by adding referrerpolicy="origin" to the iframe, or <meta name="referrer" content="origin" /> to cover all third-party resources.

In the above example "embeds_referring_euri" becomes just https://steamloopback.host when restricting referrer.


Admittedly this isn't super sensitive but Google doesn't need that extra data. Valve has recently said "Google's tracking solutions don't align well with our approach to customer privacy" about Google Analytics so the same would apply here.

[lightwo]

Good discovery, and another reason why I have kept embeds disabled for years.

[cSg|mc-Hotsauce]

Even with YT cookies off?

https://store.steampowered.com/account/cookiepreferences

[Darth]

Originally posted by cSg|mc-Hotsauce:

Even with YT cookies off?

With that setting disabled it shouldn't embed, and wouldn't experience the issue. In theory any chat links opening in the overlay might have access to the referer but I haven't tested that.

[Darth]

This bug is still present in version 1689034492
Steam Client Build Date: Tue, Jul 11 11:02 AM UTC -08:00
Steam Web Build Date: Tue, Jul 11 3:48 AM UTC -08:00

Is there any additional information I can provide?

[lightwo]

Steam client developers check this subforum as well as GitHub issue trackers for some of their software, but actually rely on a separate, internal issue tracker and rarely communicate.

You can probably not do a whole lot to speed up the process. After all, most issues get neglected, it's typically the issues with most activity (many comments from other users) that get addressed.

I guess that your best bet is to block YouTube entirely (0.0.0.0 www.youtube.com in hosts) for the time being, or to avoid using Steam client for browsing the Internet altogether. Sadly, because there's nobody but Valve employees actually deciding what's to be added or fixed, you'll have to deal with workarounds.

[Darth]

This bug is still present in version 1691444934

There's an easier way to test it, right-click a Youtube video and "Copy Debug Info", paste it into notepad.

[RiO]

Originally posted by lightwo:

You can probably not do a whole lot to speed up the process. After all, most issues get neglected, it's typically the issues with most activity (many comments from other users) that get addressed.

True. It's typically the issues that manage to raise the biggest public stink that get addressed. Squeakiest wheel gets the grease and all.

In that line of action, while it's a somewhat sad tactic - what might work for Valve and Steam is what also tends to work for pretty much any video-game publisher that isn't keen on negative press or word-of-mouth: airing your grievances across the major social media platforms.

[Darth]

This bug is still present in beta version 1700272093
Steam Client Build Date: Sat, Nov 18 10:03 AM UTC -08:00
Steam Web Build Date: Sat, Nov 18 12:32 PM UTC -08:00