Posts: 222 +42
Recently we learned that the Epic Games launcher is ostensibly collecting user data by enumerating processes on a local machine, accessing DLLs and root certificates, and scraping Steam user data from the localconfig.vdf file, all without the express consent of users.
For their part, Epic responded in kind by saying that a lot of this was due to a clunky, rushed design in "the early days of Fortnite," and that it will be fixed. Additionally, Epic's VP of engineering, Daniel Vogel, and Epic's CEO, Tim Sweeney, attempted to further justify the behavior of the Epic Games launcher and assuage concerned users. However, in a statement to Bleeping Computer, Valve's Doug Lombardi didn't seem to buy it.
We are looking into what information the Epic launcher collects from Steam.
The Steam Client locally saves data such as the list of games you own, your friends list and saved login tokens (similar to information stored in web browser cookies). This is private user data, stored on the user's home machine and is not intended to be used by other programs or uploaded to any 3rd party service.
Interested users can find localconfig.vdf and other Steam configuration files in their Steam Client’s installation directory and open them in a text editor to see what data is contained in these files. They can also view all data related to their Steam account at: https://help.steampowered.com/en/accountdata.
However, Epic believes this to be open to refutation.
We've responded to in full here: https://www.reddit.com/r/PhoenixPoint/comments/b0rxdq/epic_game_store_spyware_tracking_and_you/eijlbge/
Specifically, on the Steam stuff, this is the relevant piece: "We only import your Steam friends with your explicit permission. The launcher makes an encrypted local copy of your localconfig.vdf Steam file. However information from this file is only sent to Epic if you choose to import your Steam friends, and then only hashed ids of your friends are sent and no other information from the file."
Valve would rather Epic not touch the localconfig.vdf file at all, and instead use the Steam API -- a move Epic has said they'd prefer not to make, because of their general hesitation regarding APIs and third party code. It will be interesting to see what further action Valve might take and if Epic is set to take some widespread heat or bad press from this.