They're Coming After Steam Now...

Summary of Main Points

• Steam “age verification” via doxing-by-identity: The presenter argues that recent age-gating policies—specifically in Australia—function less like real age verification and more like doxing, because buying or accessing age-restricted (M-rated) items may require providing highly identifying information.

• Australia’s Steam requirement for a credit card: He states that in Australia, Steam requires users to submit a credit card to verify they are 18+ for purchasing certain games (example mentioned: Cyberpunk 2077). He claims this is a real change and that some players previously used debit cards and were surprised by the new requirement.

• Workaround: buying Steam keys from third parties: He claims Australian users can bypass the storefront check by purchasing Steam keys from third-party retailers (examples cited: Humble Bundle, Green Man Gaming) and redeeming them to add games to their libraries.

• Broader trend: similar laws/requirements worldwide: The presenter argues this is not isolated. He claims that Canada, California, Texas, and other major jurisdictions are moving toward comparable identity/age verification rules, and predicts the trend will spread further to major storefronts (including those for games and other digital services).

• Personal privacy is the real issue: Beyond gaming, he connects these practices to a larger shift toward mandatory KYC/identity tying in everyday digital life—suggesting that once people accept it for one purpose (age gating), it becomes normalized for many others.

Cautionary example: identity/data leaks from “verification” systems

• Driver’s license leak concerns: He references prior discussion about leaked driver’s licenses (tens of millions), and claims that a verification-related site (mentioned: idscan.net) indicated some data access “without authorization,” followed by remediation.

• Revolut breach/compromised verification data: He then describes an alleged leak involving Revolut (KYC-related data), stating that information allegedly included:

  • Identity details (name, DOB, occupation)
  • Contact info (address, email, phone)
  • Verification documents (passport/driver’s license image)
  • Selfie/facial verification image (he emphasizes that identity docs were provided even if “biometric telemetry” wasn’t compromised)
  • Financial data and transaction history (including Bitcoin-related transaction history)

• Social engineering explanation: He claims the exposure was not a traditional “hack,” but rather impersonation using legitimate government-domain email to trick the recipient into submitting information.

KYC criticism

• He concedes KYC may have rationale for preventing certain criminals/terrorists, but argues that applying similar identity collection methods to low-stakes domains (like video game purchasing and OS/application access) is unnecessary and increases attack surface.

Operating systems and Microsoft/OS age gating

• He predicts that OS-level policies may increasingly funnel users into accounts that require identity data.
• He argues that Microsoft is likely moving toward account-based access that effectively ties OS usage to personal information.
• He discusses potential scope via regulations he references, framed around operating-system control/laws that may apply to major platforms while possibly exempting some open-source systems like Linux.

Future risk

• More hacks as valuable identities circulate: He warns that as verification/KYC data becomes more widely collected, more breaches will follow—especially as attackers can use stolen identities for fraud.
• Increased cyber aggression: He also suggests “agent AI swarms” could increase cyber aggression (as a general future concern mentioned by top AI companies).

How to “Fight Back” (his recommendations)

• Contact representatives to oppose such policies
• Prefer open-source operating systems (he mentions Linux)
• Use alternatives like GOG (he claims it currently avoids age verification for some purchases)
• Use offline methods where possible to avoid repeated revalidation
• Switch ecosystems to reduce exposure to identity collection requirements

Presenters / Contributors

• Mudahar (speaker/presenter)