AMD Accidentally Leaks 1.7 Million DiRT 3 Keys

An anonymous reader writes "The free game with every graphics card deal has finally backfired for AMD and Codemasters. Due to a lack of .htaccess, 1.7 million keys for a free copy of DiRT 3 on Steam have been leaked. No word from AMD or Codemasters yet, but I'm sure Valve will block all the codes on Steam soon. One question that remains: if you used one of the codes, will Steam ban your account? There could be a few very unhappy gamers later today if that happens." The exact number of keys is in question — reports range from 250,000 to 3 million — but AMD confirmed that a leak did occur.

Comments

What about legit keys?

[djsmiley]

What about people with legal keys..... I hope I don't miss out on using this.

I'll likely give the key away as I'm a Linux user and don't care about the Dirt game either, but it'll be a shame if everyone misses out now because of this?

Steam policy on account bans

[headLITE]

https://support.steampowered.com/kb_article.php?ref=5406-WFZC-5519

There is a Zero-Tolerance policy for any violations of the Steam Subscriber Agreement and Online Code of Conduct. All accounts in a user's possession for any of the following activities will be suspended:
Piracy or Hacking

This includes using an unauthorized ("hacked") Steam client to access Steam, attempting to register fake CD Keys or attempting to register a CD Key which has been published on the internet.

Re:Steam policy on account bans

[Stellian]

...attempting to register a CD Key which has been published on the internet.

The question is, did the leaked keyset also contained legitimate keys that were distributed with games ? Maybe a mix of:
- keys yet unused
- keys printed on CDs not yet sold
- keys that already in the hands of customers

If that's the case, not only Valve can't penalize those accounts - they need to actually support online game play as advertised, at the very least for keys in the last category, if they can sort them out.

I don't care if it's free, and I don't care if the publisher leaked my key: the bundling of a free game skewed my buying decision and I have the right to play it.

Re:Steam policy on account bans

[Anonymous Coward]

The leak was full of legitimate keys, and also included the IDs that were sold with the hardware.

The text files were simple rows of Dirt 3 Keys, Hardware IDs, and database identifiers.
If you wanted, it was simple enough to copy a hardware ID instead of a Dirt 3 key, paste that ID into the amd4u promotion, and receive the appropriate Dirt 3 key in your inbox from AMD themselves.

If someone did that, there'd be absolutely no way of distinguishing them from a legitimate customer that owned the product, since the hardware ID acted as the proof of purchase. Of course most people didn't register and just copied the Dirt 3 keys directly, so it's possible for AMD and Valve to see what Dirt 3 keys were activated on Steam without their corresponding hardware IDs being registered on amd4u.com. That's probably revoke about 90% of the illegitimate licences.

The promotion had been running for awhile, so if they just ban all of the keys then some innocent accounts will be hit in the crossfire. At the moment it seems like they are just revoking the licences instead of banning accounts (at least for the users who profess to being tricked into entering the key without knowing where it came from).

Also, the exact number of keys was 2 million, eight text files with 250,000 keys per file.

Re:Steam policy on account bans

[Anonymous Coward]

Why should people have to pay for others mistakes? Why should people have to take those "5 minutes out of their day to scan something", in order to correct a situation they weren't involved with? It's insane to think the customers have to "foot the bill", so to speak, to clean up after AMD's fuck up.

Re:Steam policy on account bans

[mr_lizard13]

Indeed you are right sir. The game was included in the purchase price, regardless of it being marketed as 'free'.

Re:Steam policy on account bans

[Xest]

Hmm, definetely not buying anything from Steam ever again. I've never done anything illegal with it nor do I intend to but the idea that they can arbitrarily steal back from you what you have purchased from them is sickening.

Re:Steam policy on account bans

[TheRaven64]

I'd be amazed if it's legal for them to block access to content you've legitimately paid for.

It's perfectly legal. You are not buying anything from Steam. You do not own anything that you pay for on Steam. You are paying for a revokable license, at the sole discretion of Valve. If you confuse this with an actual purchase, then that's your problem.

Re:Steam policy on account bans

[DrXym]

You open a support ticket, show proof of purchase and a picture of the media/CD key or whatever they require, and they reallocate the proper CD key back to your account. No biggie.

No biggie? Legit customers would be treated by default as pirates unless they supplied proof of purchase, and until they did that could risk everything from their account being locked to being perma banned.

A correct and more sensible option would be for AMD to supply Steam with a list of email addresses of users who registered. Probably 90% of those are using the same email address on Steam and can be eliminated. Then you audit the hardware of the remainder through Steam (and it's already capable of this) and see who is running AMD hardware that the promotion applied to eliminate them too. Then you look for the date that the exploit got into the wild (probably obvious from a graph of # registrations per day) and you eliminate all of them before that date. Finally you're probably looking at a small % of legit owners to track down. You might then mailshot every game owner and tell them the game will be disabled in 10 days unless they run it on the proper hardware and then you eliminate people who do that. Finally you mailshot again and warn them to contact customer service with proof of purchase within 30 days or risk a perma ban.

Is it a major screwup by AMD? Yes. But Valve and AMD should make all reasonable efforts to not inconvenience legit users. Only as a last resort should a ban or account freeze should be necessary.

Re:Steam policy on account bans

[trum4n]

Welcome to DRM. It is the ONLY reason i pirate.

Re:Steam policy on account bans

[AmiMoJo]

That's what the EULA says, but consumer protection laws override that. In the UK the Sale of Goods Act requires that goods sold be "as described" and "fit for purpose", i.e. if it says free Dirt 3 game on the box you must get a free working copy of Dirt 3 or your money back.

Contracts can never override your statutory rights, even if you had read and signed it before purchase.

Re:Steam policy on account bans

[Joce640k]

Why should people have to take those "5 minutes out of their day to scan something"

Because they're adults?

Re:Steam policy on account bans

[delinear]

Exactly, in that case you've trusted yourself entirely to a technology that's proven to fall down at the human level in the past. What's that saying about a fool and his money? I mean, for that matter, what would have happened if the disk was destroyed in a fire in his home before he'd had chance to register it to his account? The insurance probably wouldn't cover it without some proof that the purchase actually took place. It's not fair that customers have to take such steps when the technology should be there to protect them, but that doesn't mean it's not prudent to do so.

Re:Steam policy on account bans

[Anonymus]

And as adults they are beholden to fixing AMD's fuck up?

Re:Steam policy on account bans

[WNight]

And your prickish attitude is why I crack everything I buy. It's bad enough shelling out $60 for a buggy product, but to jump through a bunch of hoops to have some monkey tell me it's defective by design is unbearable.

I bought a Blizzard game (WC2 era) and it wouldn't run because I had a CD burner. I emailed Blizzard and asked for a workaround - they suggested I buy a new CD drive (then $80 or more). I suggested a crack, they told me it'd be illegal, I told them knowingly selling a defective product was illegal... It stalled there.

Now I don't buy a game (a big title with DRM - Indie Bundle stuff is different) until working cracks are available. Especially as I like to replay games (years later, in emulators, under wine, etc) and DRM is ridiculously fragile.

Re:Steam policy on account bans

[WNight]

A correct and more sensible option would be [...] email addresses of users who registered [...] audit the hardware of the remainder through Steam (and it's already capable of this) [...] a small % of legit owners to track down [...] mailshot every game owner [...] game will be disabled in 10 days [...] proper hardware [...] mailshot again [...] proof of purchase within 30 days or risk a perma ban.

Oh yeah, that sounds like a simple, non-intrusive, and useful plan. What could go wrong?

At this point they're looking at a PR nightmare. One wrong permaban could keep this in gamer news for months, influencing a lot of purchases.

They should go the other way with it. Say that it's too bad some people have to try to spoil things, etc, but that it's important to not let that happen and as such release the game free to all Steam users who have any AMD GPU or CPU without any further checks. That way absolutely nobody would be wrongfully denied and their other Steam-using customers would get a freebie just for having an AMD product.

It should be easy to do. Most of a game's sales come in the first few months. Negotiating a larger giveaway after that spike in sales (if there is one) should be pretty cheap as the publisher is looking to bargain-bin it at that point anyway. It'd probably cost AMD less than other ad campaigns and seeing a company trying to make things right instead of pointing the finger would be a better ad - to me - than more bogus benchmarks.

Re:Steam policy on account bans

[nedlohs]

The EU is a country?

Man, things just keep changing...

WTF?

[Megane]

The reason access to all these keys has been granted is due to a lack of .htaccess on AMD’s site.

What's all this stupid talk about .htacess anyway? Those are the kind of files that should not be below a web server's DocumentRoot in the first place. The reason access to all these keys has been grated is because some moron put them in a live area of the web server where they didn't belong.

Re:'Zero tolerance policy' - i find this funny ...

[Co0Ps]

I got PERMANENTLY banned from the steam forums for simply stating that piracy exists and people pirate games. Apparently, if you close your ears, hold your hands to you ears and yell LALALALALALA all problems instantly disappear.

Re:'Zero tolerance policy' - i find this funny ...

[GameboyRMH]

Apparently, if you close your ears, hold your hands to you ears and yell LALALALALALA all problems instantly disappear.

I think this also explains how people who are normally anti-DRM see Steam as acceptable.