Epic Store copies Steam information from users unsolicited
The Epic Games Store copies files from Steam immediately after installation. This includes which games the user has played, how long they have played the games and which Steam friends they have. Epic Games founder Tim Sweeney says this is being adjusted.
That’s according to a reddit post. According to reddit user Relik, the digital store copies the localconfig.vdf file from Steam right after installing the Epic Store. Localconfig.vdf includes the user’s friends. That file also contains the name histories of the friends. Which games the player has played and how long certain games have been played are also taken over. This includes games that have not yet been released but have already been purchased by consumers. A user on the Resetera forum confirms the claims.
Vice President Daniel Vogel confirms on Reddit that the Store is making an encrypted copy of the localconfig file. This information is used, according to Vogel, to be able to import friends from Steam to the Epic Store. Only when the user indicates that they want to import those friends, the file is sent to Epic’s servers. ‘And then only the hashed IDs of your friends,’ Vogel emphasizes. However, Relik claims that, according to Microsoft’s Process Monitor, at least the copy of the localconfig file is not uploaded when users want to import their Steam friends.
Meanwhile, Epic Games founder Tim Sweeney has acknowledged that copying the localconfig file without permission is not okay. “The current implementation is a remnant of our rush to implement social features in the early days of Fortnite. Since this issue has surfaced, we will be adjusting it.”
The developer does not say when the procedure will be adjusted. Users indicate that a Steam API could have been used to link friends. However, Epic Games wants to use as few third-party APIs as possible and has therefore devised the current method, Sweeney reports.
The discoveries surfaced through a reddit post from user notte_m_portent. He used Process Monitor to track what the Epic Store does and what files it opens. According to his findings, Epic checks all user processes, opens root certificate files and looks for cookies, among other things. Reddit posters indicate that these may be anti-cheat measures. According to Vogel, checking root certificate and cookie files is normal behavior for the Chromium browser technology that the digital store runs on. The running processes are checked by the system to make sure that a game to be updated is not already being played.