[simias]

I suppose it would just be the matter of intercepting the network traffic going between the PC running steam and the internet and see what goes through the pipe?

Do you have a link to that reddit comment thread?

EDIT: here it is: http://www.reddit.com/r/GlobalOffensive/comments/1y0kc1/vac_...

The listing of decompiled code (in image form, for your pleasure) is here: http://i.imgur.com/z9dppCk.png

IMHO the fact that they seem to store the hashes in a lookup table hints that it's meant for local use, what's the point of doing that if you just want to upload it on the net? I guess they could do both though.

[yoha]

That's actually sensible, but if Steam encrypt their communications, you will just get random data.

You could still infer things from the timings, but again, it is not always practical.