These days, it’s fairly easy for someone without computer skills to start a livestream. With something like OBS Studio on your computer, the simplest way to start is to click through the wizard, login to the streaming site of your choice, and just click ‘Go Live’.
But with this, it means that anyone can start it without thinking. If it was a personal recording and you make a mistake, it’s easy to remove – no one else saw it yet, after all. But when you’re live, you have to be proactive, and think about what you’re doing, saying, hearing, and what you’re displaying on screen.
In this article, I’d like to go over about a dozen different information security risks that you can run into while live: all of it to do with having something unintentionally appear. Everything you stream takes place on your PC, after all, and there’s a lot of personal information on it.
It’s also all stuff I had to learn the hard way, most of which was through making these mistakes myself. No matter how unlikely they sound, these are all things that can and do happen, and can become inevitable after doing hundreds of livestreams.
Some of these items may sound fairly benign, and that is likely true – however, it all still falls under the umbrella of something on your screen being captured and streamed by accident, which are still things you don’t want to show to your audience, even though it’s not directly harmful.
Table of Contents
General Procedure
The items in this section are mostly solvable by developing good practice and awareness.
Starting a Stream by Accident, or Not Streaming at All
Let’s get this out of the way first, because it sounds a little ridiculous, even to me. Yes, it’s possible to start streaming prematurely if you have OBS Studio open, and you’re not paying attention.
The consequences of this can go as far as your imagination can take you. Just think of anything that can happen with a hot microphone, or what you’re doing to prepare. Private conversations, videos, music being played, or the act of setting up your camera and logging into your accounts. The last thing anyone wants to do is show any of that.
How it happens
The buttons for ‘Go Live’ and ‘Start Recording’ are literally right next to each other. A bit of absent-mindedness could result in your hand slipping, and by default there’s no blaring warning telling you that you clicked the wrong thing. The same red dot appears, and the text log will say ‘streaming’ or ‘recording, but maybe this isn’t enough for you.
‡ Because of this, the opposite situation can also happen: When you intend to stream, you click ‘Record’ instead, and you don’t realise that you were never broadcasting at all.
Another rare possibility is that you hit your keyboard by accident. Windows software that is made properly is designed to be usable without a mouse – You can navigate OBS Studio like a video game menu, using the arrow keys, Alt, and Tab to highlight different buttons, and pressing Spacebar or Enter to select. While it seems to have been fixed by now, the default button highlight on OBS used to be ‘Go Live’, so simply bumping your Spacebar by accident could result in a livestream.
How to prevent it
The best and simplest way to prevent this from ever happening is to make the Live and Record buttons behave differently. In the General settings in OBS Studio, tick the box ‘ Show confirmation dialog when starting streams’. All this does is make a popup box appear when you press ‘Go Live’, which you also need to press.
If you leave the option off for the Record button, this is more than enough of a difference for you to prevent this type of mistake.
Forgetting to Turn Off a Stream
I’ve seen and heard stories about this happening way more frequently than the first. You leave everything on the ‘Goodbye’ slide, and you forget to turn off your microphone. The same risks ensue.
How it happens
After a long and tiring stream, the last thing you probably want to do is sit at your computer for a second longer. You’re in a rush to the bathroom or some emergency, or your hand slips on the ‘End Stream’ button in the same way as the previous item, but with the opposite effect. Regardless of reason, your rush at a habit just makes you… forget.
How to prevent it
If you don’t have a ‘Goodbye’ or ‘End of Stream’ slide in the first place, make one. This completely eliminates the visual risk, and only leaves the audio risk.
There are a few different ways to prevent this, and the obvious one is to just be more strict in your shutdown process. Don’t just end the stream and trust that’s enough, but close OBS Studio entirely. Make a checklist to know all the software and settings you need to turn on when you start, and off when you’re done. Mute your mic, close your Vtuber software, close OBS, turn off the stream page in your Youtube Dashboard…
Well, that’s one way to do it, but I expect you to be tired all the same, so I automated my own setup with some code.
Since I can program, I ended up writing a small Lua script to make OBS automatically shut down if I stayed on the ‘Goodbye’ slide for too long. OBS Studio supports both plugins and scripts that you can make to tweak and enhance things, and I took the Lua route. You can find the script on my Github.
If that option feels a little scary to you, you can also add a fully featured plugin called ‘Advanced Scene Switcher‘ that will let you automate whatever you can think of with a ton of dropdown menus – the procedure is essentially the same, where you add an If/Then/Else statement to check your active Scene and how long it’s been on.
Personally, since I had a targeted purpose, I opted to write a 5KB text file instead of install a 200MB plugin, but to each their own. My version attaches itself to a Text Source to also generate a countdown timer on the ‘Goodbye’ screen.
Broken Hotkeys
Let’s say that you are actually prepared for certain situations. For example, it’s a good idea to add a hotkey to OBS that mutes your microphone, so you can press it quickly when you have a coughing fit, need to walk away, or you’re interrupted by someone.
Assigning hotkeys to switch Scenes or toggle Sources can also be useful in a pinch. You don’t need to alt-tab over to OBS, and there are lots of uses for it beyond just hiding something you don’t want to show everyone.
So why do the buttons not work sometimes?
How it happens
By default, hotkeys typically only work if a program’s window is currently selected, but OBS Studio should have global hotkeys enabled by default. (If it’s not, look for the window focused hotkey option in the advanced settings.) So, this is not the reason why OBS hotkeys don’t work sometimes.
Instead, what’s probably happening is that the game (or window) you currently have focused is blocking global hotkeys. As far as I know, there are two possible reasons for this:
The first cause is that the game itself is fairly old, and might be unintentionally blocking it. This tends to go hand-in-hand with games that predate the prevalance of borderless-fullscreen, and may lock both your mouse and your keyboard. However, this isn’t universal and the only way to know for sure is to test your keys.
The second possibility is that the game is intentionally blocking it. This usually applies to online games where it’s probably not the game itself, but the anti-cheat software that is preventing any kind of hotkey or macro software from functioning. AutoHotKey also suffers from targeted blocking, so it’s not just OBS hotkeys that will be disabled while the game is in focus, but anything using global hotkeys. This can also include chat software like Discord.
There are also several different anti-cheat programs out there, so this too is not universal. Some are smart enough to allow OBS now, but you still need to test it.
GameGuard and Phantasy Star Online 2 is one such example of a game that blocks your hotkeys.
How to prevent it
You can’t. The way to circumvent it is simple yet annoying, in that the only thing you can do is unfocus the game, and then press your hotkey. The easiest way to do this is to press the ‘Windows’ key on your keyboard first, which brings the Start Menu into focus. Then, press the ‘Windows’ key again to unfocus the Start Menu and refocus the game.
You can also just click back into the game, but do be mindful if you didn’t pause or move your mouse to the corner: it probably wasn’t designed to assume an input disconnection, so you might accidentally fire your gun or make the ingame mouse cursor click on something unintended.
Notifications and Pings
There are a lot of programs with notifications now. I don’t think I need to deeply explain how this can disrupt your stream; not only do text popups appear on your screen, but there are also sounds to contend with.
These notifications can come from a lot of places, so there’s no single way to consider them: There are Windows notifications, notifications from your chat program like Discord, as well as notifications and text popups in your game, if you’re playing online.
How to prevent it
Notification popups are pretty common now on computers, so be sure to check and disable them where needed. Some programs like Discord were built in the streamer era and are aware of this, so it will autodetect OBS and temporarily disable all notifications. Windows 10 also has a ‘focus’ mode that will turn off notifications if a game or something else is running in full screen, or you can turn it on manually. This wasn’t targeting at streaming per-se, but has the same effect.
In other cases, there may be a ‘streamer mode’ you might be able to activate. On singleplayer games, this only changes the background music to a royalty-free playlist. On online games, this will essentially disable all chat features and turn on all the options to auto-deny trades, party requests, and whatnot.
However, this isn’t perfect. Using Phantasy Star Online 2 as an example again, that game’s Streamer Mode doesn’t disable hovering player names, which you may not want to see. It’s important to always explore the options menu in this case.
Online Games
These are most relevant to online multiplayer games, and mostly involves specific menus and parts of the UI. Once you’re aware of the dangerous zones, the general solution is ‘Don’t open it’. Switch your scene to something without the game when you need to open that menu, or inspect it beforehand to know whether it’s safe.
Ingame Chat and Photobombing
This is somewhat related to the above entry on notifications, but requires a different solution. Even if you can disable notifications, chat is a fundamental communication feature in online games and ignoring it may not be an option.
However, malicious actors do still exist, and it doesn’t need to be targeted at streamers. Flooding chat with nonsense or advertisements is a tried and true method of disruption that also prevents regular players from communicating for the sake of the game itself.
If it’s someone attempting to stream snipe or yell out ‘Hi Mum, I’m on TV!’, then… well, even though it’s targeted, it doesn’t change the problem.
Like it or not, however, since you are broadcasting this, you are responsible for controlling what they say – or rather, you are responsible for controlling what they say from appearing on your stream.
How to prevent it
Claiming that you are responsible for what they say sounds obviously unreasonable, but you are still indeed responsible for allowing it to appear on your stream. Putting something over the part of the screen where text chat appears is how you prevent this from happening, and there are several things you can put there.
The most obvious one unfortunately requires you to pick a plugin you like, which is a blur filter. There isn’t a native one in OBS as of writing this.
Other options include putting an image of an exact size or it such as an ad of your own, a coloured box, or your own facecam or Vtuber feed, cropped to exactly cover the chat region.
Since chat boxes don’t have a consistent location from game to game, this is something you’ll need to customise each time you change games.
Your Friendlist
The mere act of opening your friendlist in a game can have risks beyond showing everyone on your stream who’s actually on it. There are generally three potential problems I am aware of, including that first risk:
- Showing who’s on it can have some general knock-on effects, since it lists potential vectors for harassment and whatnot. If people can’t get to you, then they’ll get to your friends, and you can’t expect your friends to be equally vigilant as you in infosec.
- If your friendlist is public, then it’s just something to expect, and a calculated risk. Not everyone can live with completely private social profiles, but as a content creator you have more public attention on you. Depending on your circumstances, it may worth considering a stream-exclusive account.
- Your personal friendlist window can have more information than just listing your friends, which is the only thing your public profile’s friendlist would display. This can include tags or nicknames you may attach to your friends in the friendlist, which will show up.
- Just don’t write anything with the potential to be controversial.
Starcraft II
- This is specifically for Blizzard games and Starcraft II: Your friendlist will contain your real name under your username, and all of your friends will have their real names attached. This is part of Blizzard’s Real ID friendlist system and their interpretation of Korean law, which Blizzard voluntarily implemented.
- Just don’t open your friendlist or any chat messages. There is no way around this.
- Turning off the display of Real ID in the settings will not hide your real name because you are opening your personal ingame friendlist. That setting only applies to your public profile and how other players view you.
- Using a fake name in your Real ID to prevent this may be a TOS violation and may get you banned, or at least unable to retrieve your account and make purchases, since you can’t identify yourself to Blizzard.
Options and Account Info
Standalone games will have your account information in a specific menu in the ingame options. Be aware of where this is and avoid opening that menu on stream.
This page will usually list things like your account name, email, and perhaps an ID number for your game, and much like the account information page for anything else, there’s no guarantee that there will be a consideration to censor the email or ID number. I remember Fortnite being an example of this, though I haven’t touched that game in quite a while.
Login Screen
Another related area is the login screen. Some accounts ask for a username to login, and some ask for an email, but both are things that no one needs to see. If you’re playing a standalone game and are disconnected, you may be booted back to the login screen and the game itself will show your username or email, since ticking the box to remember your login name is pretty common.
This generally applies to any online game that does not use a Launcher to isolate the login process, and you type your info directly into the game. This includes a lot of old MMORPGs, as well as Warframe.
These days, a lot of standalone MMOs have been integrated into Steam, using your Steam account as an autologin credential. If you play your games that way instead of making an independent account, you won’t see this problem at all.
If you are streaming your desktop, you should also be aware of these hotspots in game clients like Steam and Uplay. Your Account Name is what you use to login and is not something people need to know, which is different from a Display Name. Both can appear together if you click on the login/logout menu in the top-right corner of the client window.
OBS Studio’s Capture
The entries in this section mainly have to do with the way you choose to capture the program in question and put it in OBS, and issues with each one.
There are three specific methods, from best to worst: Game Capture, Window Capture, and Desktop Capture.
To make it as non-technical sounding as I can, each option makes OBS Studio latch onto the graphics engine of Windows at different levels of distance from the raw silicon chip, taking out the video feed for you to stream. Each option has different flaws, with the most obvious being lag and framerate.
- Game Capture is the closest and ideal choice, as it takes the image directly from the graphics card – however, it only works for games, or programs that use a game engine (ie. Vtuber software).
- Window Capture takes the image directly from the Windows graphics engine, and is for anything that’s not a game, such as your web browser.
- Desktop Capture is the most laggy and dangerous option, as it takes the final image sent to your monitor.
(This is not a fully accurate description, but is hopefully enough to understand the differences.)
OBS Autodetect / Hotkey Detect
Both Game Capture and Window Capture can be configured in multiple ways to try to find the game you want to record: You can set a precise program name to search for among the currently open windows, or you can set it to try to autodetect and latch onto a window. There are a few ways to try to make it work automatically, such as trying to take the window that’s currently in fullscreen, or putting a window in focus and then using a hotkey to tell OBS, ‘Capture this window please.’
Regardless of the method, the risk to highlight here is that OBS does not know when a window closes. If it does happen, OBS Studio will run a search and look for the next match, and automatically switch over to showing that window, instead. This is useful for when there is no match at all, and you restart your game – but the flaw comes in if you’re running two extremely similar programs, or a single program with multiple windows.
Vtubers, Unity, & Game Capture
In Game Capture, OBS will probably capture the next thing that’s running through the graphics card, or the same game engine. A lot of games are made in Unity now, and Vtuber software is also made in Unity, so if your game closes, it will automatically switch over to a double of your Vtuber program.
The biggest risk here is a bit specific, in that OBS might end up picking the window containing your camera feed, which means you’ll be indirectly streaming your camera.
There are two ways to avoid this:
- Turn off the camera display if your program has a setting for it, showing only the face detection symbols.
- If using a hotkey to autodetect your game, you can also add a hotkey to cancel the capture.
.exe name & Window Capture
In Window Capture, setting it to search based on the appplication’s .exe file name can result in a lot of false positives or captures, if the program in question has a lot of windows. This is because all of the windows will have the same .exe filename, so it will just jump to the next window when it closes.
Popup prompts and popup windows you trigger to appear will also count as separate windows and are accidental stream risks – This could be an editing program with lots of prompts, or an emulator that runs by creating a separate video window.
However, the most frequent thing to capture is probably your web browser.
The main risk here is that you may be running a second browser window to monitor your stream and moderate it, so if your stream is themed around a web browser activity, having it close or crash will result in it jumping to the window with all your stream settings.
For these issues, there are also two different ways to avoid mistakes:
- Try to avoid using the .exe setting in Window Capture if you can, and instead set it to capture based on the window’s title name. This can be a better identifying marker in general, but you obviously need to set it more often if you reset the window.
- For your web browser specifically, the most unbeatable method is actually using multiple web browsers. You can, for example, use Chrome for your stream and Opera for your stream monitoring. This completely prevents any crossover risk. There is also Firefox, Edge, Vivaldi, etc.
Using Game Capture
There are generally no major issues with using Game Capture on OBS, since this is actually the best choice to use. It even bypasses the capture of the Steam Overlay, meaning you can leave it on with notification popups and notes, and your stream will still see a clean game.
The main issue that can occur is when you are trying to select a game to capture, which is listed as a separate entry above.
Using Window Capture
Some games are not compatible with Game Capture no matter how much you tinker with the settings, which means you will need to fall back to Window Capture.
The main security risk here is that it captures everything that appears in the window as you see it, including your overlays. So, you do need to take the risks for notifications and friendlists into consideration, while you can often ignore it for Game Capture.
Hotkeys & Old Games
There is also the question of why Game Capture doesn’t work:
- The game may be quite old and/or doesn’t run through the graphics card as expected.
- Anti-cheat may be interfering with Game Capture.
If this sounds familiar, it’s because these are the same qualifiers for the ‘Broken Hotkeys’ entry. If you need to fall back to Window Capture, this could be an indicator that the hotkeys are also not going to work.
It’s also worth noting that for older games, it’s possible for only some parts of the game to not capture correctly, such as FMVs. While this isn’t a security issue, it’s easy to not notice if you’re partways through a game and not monitoring OBS Studio’s output.
Using Desktop Capture
It’s best to try to avoid using this as much as possible, but it’s also the lowest hassle option if you are doing some sort of work stream, where you change windows often.
However, you still might end up capturing a few games on Desktop Capture.
Destiny 2 & BattlEye
I can count the number of games I’m aware of on one hand, but some games can’t be captured at all, for the same two reasons: Either a game is so old that it doesn’t render correctly, or anti-cheat is interfering.
Star Wars: Knights of the Old Republic is one such game where the FMVs can’t be captured by OBS at all, unless you capture your Desktop. This is a pretty specific example, however, and the game otherwise works fine without interference.
What’s more likely to happen to more people is playing a game with the BattlEye anti-cheat software, such as Destiny 2. Despite being a relatively modern game, Destiny 2 cannot be captured by OBS Studio at all, requiring you to use Desktop Capture. (It’s possible that BattlEye has finally added an exception for OBS Studio in recent years, but I’m leaving this note here anyway. Each game may have a different version of even the same anti-cheat.)
Naturally, this probably also blocks hotkeys – but the fact that you are using Desktop Capture this time means you need to be very mindful of yourself when you tab out or close the game.
General Desktop Risks
Minimise everything and look at your desktop. Pretty much anything there can be a potential display risk. It’s as simple as whatever shortcuts and files you put there being something that will show up if you minimise your intended stream target, or if it crashes. However, there are also several other things:
- Your Start Menu, taskbar, and anything in them is also an area where you can show things unintentionally, since you’re going to open it up at some point. Anything you install will show up at the top marked as recent, and the Weather tile will show your location.
- For programs in your taskbar, right clicking on the program will also show recently opened items.
- The File Explorer is also a risk zone, particularly the left column that shows all your favourites, drives, and recent items.
- When opening a new program, sometimes the new window appears on the wrong monitor.
- The name of your own Windows profile is also something that’s easy to overlook.
- It’s quite possible that your desktop wallpaper is not copyright friendly.
Ideas to Reduce Desktop Risk
Having a second monitor can be incredibly valuable here. You can offload all of your sensitive windows and shortcuts to the other window, to keep your main monitor as clean as possible.
For everything else listed above:
- For recently opened items, this is a setting in the Start Menu options in Windows 10. Look for ‘Start settings’ in the Start Menu search, or the ‘Start’ tab itself under ‘Personalization’, which you can open by right clicking on the desktop. Disable ‘Show recently opened items in Jump Lists on Start or the taskbar…‘. You can also disable the display for recently installed programs here.
- It’s best to keep your Explorer windows on the other screen, but opening a new Explorer window will show up in the same place where you closed the last one, or near the most recent open one. To ensure your file windows stay on the other monitor, simply make sure the final Explorer window that’s closed is on the other screen. This also applies to any other program.
- The name of your Windows profile is also easy to fix, or you could make a new user profile entirely, if you prefer.
- For your wallpaper, go for something royalty-free – Linux wallpapers and Creative Commons photos are good sources. Otherwise, go for something you made yourself. Your wallpaper is a prime opportunity to have something self-branded, which is what I do.
Closing
A good number of these risk zones won’t expose serious information, but it’s still not information that has any reason to be shared and shown on a livestream. For many of them, it’s also about simply being aware of these risk zones, instead of actually needing to do something about it proactively. In addition, for many cases, the simplest solution is: Just don’t touch that menu while you’re live.
However, I will once again reiterate that after doing hundreds of livestreams for several years, it can become an inevitability for something to slip by. Something in the recent files list that’s private or inappropriate, a folder you don’t want to hint at, settings menus, file lists. Names, leaving something on, or your panic buttons and hotkeys not working.
When it does happen and you only realise it after the fact, maybe you’ll feel some relief that nothing happened, or maybe you’ll have a lot of worry thinking about who might have seen that.
There are so, so many games out there and every interface is a little different, and you can’t catch everything as it happens in the moment.
The Greatest Take Away
Because of that, I think the biggest thing to take away is how to react when it happens live, during your stream: You don’t.
When you’re streaming, you’re talking. You’re commentating on everything as it happens, and it takes a lot of mental effort to filter yourself, and it doesn’t always work. If an accident happens, it’s natural to keep babbling and highlight a mistake just occurred, but doing so while live will encourage people to immediately clip it, look at it, and save it, making the situation worse.
That was really one of my greatest mistakes while livestreaming, and certain people know more things about me than I ever wanted.
You can’t really do anything about that except try to move things along as quickly as possible, and taking focus away from the subject. This can apply to any mistake you make in life, really.
As a streamer though and as an online identity, the nuclear option would be to change my name and disappear, but I have no desire to discard my identity as Eiri Sanada. So, regrettably, I need to live with all the mistakes I’ve built up along the way, and work with where it leads me.
Overall, there are many, many little things I’ve listed here, and maybe some seems obvious, but nevertheless I had to learn the consequences of taking those things for granted, the hard way. Hopefully, this can reduce someone else’s regrets.
Eiri Sanada 