Valve Anti-Cheat is not sending browsing history to the company, Newell says

Steam's anti-cheat solution, Valve Anti-Cheat (VAC), is not relaying users' browsing history back to Valve, co-founder Gabe Newell said via Reddit.

VAC helps identify when cheats are installed and bans users from playing on VAC-secured servers; games include Counter-Strike, Half-Life 2: Deathmatch, Team Fortress 2 and more. Concerns arose after a post appeared on Reddit claiming that VAC reads every DNS cache entry and reports it back to Valve's servers. According to Newell, cheat developers create DRM and anti-cheat codes to ensure payment.

"These cheats phone home to a DRM server that confirms that a cheater has actually paid to use the cheat," Newell wrote. "VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted.

"This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. Five-hundred and seventy cheaters are being banned as a result."

Newell added that this specific round was effective for 13 days — a "fairly typical" amount of time. Cheats on this "kernel-level" are costly to both create and detect, he continued.

"Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain," Newell wrote.

The co-founder added that on the social engineering side, it is to a cheat developer's advantage to spread mistrust in the system — in this case, Valve.

"VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky," Newell wrote. "For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light.

"Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy."