Unknown background requests to Twitch

[h1z1]

Your system information

• System information from steam (Steam -> Help -> System Information) in a gist: System Info is not possible with current Steam. Crashes the client.

Using latest non beta - steam-runtime-beta-release_2017-10-05

• Have you checked for system updates?: Yes

Please describe your issue in as much detail as possible:

Observed CS:GO downloading stream previews from Twitch. Neither Twitch integration is enabled nor was any match being watched. Game was sitting at the start menu.

Client should not be accessing Twitch without consent. I don't believe Twitch even allows this since it's entirely hidden, almost viewboting.

Steps for reproducing this issue:

1. Install CS:GO
2. Run client with developer and console enabled
3. Do not join any game, lobby, or otherwise deviate from start menu
4. Observe background requests to twitch

[kisak-valve]

Most likely the CS:GO client polling to see if there is a live Major stream.

[h1z1]

Guessing this is a steam wide thing with Valve games? Found these for TF2:

/steam/steamapps/common/Team Fortress 2/tf/streams

Same scenario, never watched Twitch streams, never clicked on anything linking TF2 to Twitch. Never opted into anything identifying itself as Twitch integration. What the fuck? Between widevine silently calling home to Google and crap like this, do I seriously need to sandbox all valve games?

Sketchy Valve... very sketchy.

https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_b4nny-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_essentialstf-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_josephcarling-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_keckdangle-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_lifewithstrife-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_ly_5f_dee-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_misterslin-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_sandblast_5f__5f_-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_scoot_5f_boot-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_seinfeld-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_tedn00bgent-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_unicorn_5f_wizardtf2-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_unicornowl-320x180.jpg
https_3a__2f__2f_static-cdn.jtvnw.net_2f_previews-ttv_2f_live_5f_user_5f_yourtraumaqueen-320x180.jpg

[kiroma]

... Those are stream thumbnails.

[h1z1]

Indeed they are. Never said they weren't though. They were downloaded without any interaction with Twitch. Doesn't appear they even support the helix api, only kraken which will be removed this year.

[kiroma]

Both games, CS:GO and TF2 have tabs that allow you to see who is streaming the game at the time and displays the few top viewed streamers there. It would make sense to download some thumbnails so that you don't blindly go into a stream, wouldn't it? The thumbnail downloads are done without any authentication afaik, so the only way the information about the data being sent would be used is to know that "this IP address is online". I don't see why would we start bashing Valve over the head for promoting some streamers playing their games.

[h1z1]

Yes, both games have the ability to view online streamers from Twitch. They aren't promoting anyone however since the stream isn't being viewed nor is that list being shown.

I haven't had time yet to determine what else is leaked to Twitch beyond the application client-id which is required by their api. Twitch certainly uses cookies for everything for example, whether that is stored by steam is unknown.

I'm annoyed that despite not having twitch integration enabled, it is none the less doing this. Before you say it, I'm aware of what steam cloud is and have already blocked it. Stupid thing uses MS Azure and Google.

[kiroma]

I'm going to ask this unironically, has one of your family members been diagnosed with schizophrenia?

[h1z1]

... What?