So then, what about mitigation? Well, reading through the Steamworks docs, it *seems* like setting a lobby to Friends only or Invite only would work. This is the only "authentication" that goes on, as the lobby isn't publicly listed *and* requires users to either be friends (or invited) to join.
+
