Last week, users discovered that the Epic Games Store was copying a Steam file that contained their friends' user IDs and other data. It did this before prompting users to choose whether or not to import their Steam friends into the Epic launcher.
Epic explained that while the client did copy the file, nothing was sent to Epic unless the user opted in, at which point hashed friend IDs were uploaded. Epic CEO Tim Sweeney said that the early copying was a problem that would be fixed.
I spoke to Sweeney on Monday, and asked him if he had anything more to say about the issue.
"If you choose to import Steam friends in Fortnite right now—it's implemented on the launcher side—we load up your Steam file on your hard drive which is your file that you own, which contains your friends, and hashed IDs of your Steam friends are sent to Epic," he said. "A lot of other services import Steam friends using similar means. Some access the file, some use the Steam web APIs through the Steam SDK to do it. Data is only sent to Epic with user permission.
"And then there's a sloppy implementation which makes a copy of your file before prompting you whether to import your Steam friends, and that's something we're fixing and cleaning up. It's just a manifestation of building all our social features quickly and not enough forethought about how we ought to be doing it."
Valve made it sound like it doesn't think anyone should be accessing Steam files, though, saying that Steam's localconfig.vdf file "is private user data, stored on the user's home machine" and that it's "not intended to be used by other programs or uploaded to any 3rd party service." I asked Sweeney what he thought of Valve's statement.
"Well, Valve said that that data is data that belongs to the user," he said. "And Valve is completely right about that. That's the user's data. The user can do with it as they please. They own the data on their hard drive, and if they choose to import it into other programs it's their right. And I think that's the fundamental principle that's at stake."
Once fixed, the Epic launcher will presumably leave localconfig.vdf alone until a user agrees to import their Steam friends, at which point it will copy the file, hash the friend IDs, and upload them so the user can connect with any Steam friends who did the same. Though there will be no local copying before the opt-in, it doesn't sound like Epic plans to change that basic process.
At today's Unreal Engine keynote, Epic talked more about the online services it will be making available for free to all developers. One of its goals is to bring Fortnite and the Epic Store's friends list into more games, even if they launch on Steam, PS4, or elsewhere, creating a multi-platform social network. You can read more on that here.
