What good is PIN parental control if it can be easily bruteforced?

[Garthor]

It just came to my attention that there is a little tool that bruteforces the 10000 combinations of the steam PIN in a few minutes. My kid obviously beat me to it...

Seriously VALVE, what are you thinking, allowing these things to happen? I mean, a 4 digit pin in 2020? And apparently without any signifcant cooldown.

[SLAYER187]

ShelLuser の投稿を引用：

This is not a payment system we're talking about and well.. raising your kids is still something which the parents should do. Why put the burden on Steam here?

Also... maybe you should teach your children why you felt the need to put up that filter. If you carefully explain this stuff then there's a good chance they pick up on it and won't even bother trying to circumvent it. You know... doing some parenting and all that?

But I get it... these are the modern times where we blame everyone else for our own actions and shortcomings.

VERY WELL SAID ESPECIALLY THE END! (But I get it... these are the modern times where we blame everyone else for our own actions and shortcomings.)

[Satoru]

this is false. In fact after a mere 5 attempts you get a cooldown on entering the code where you get this message

"Too many incorrect attempts. Please wait a while before trying again."

The timeout on this is like at least 2-5 minutes, I'm trying it now and I keep getting the error

It would take months to 'brute force' it this way even with a 4 digit pin.

Your kid 'beat' you to it because they simply did it the other way. They accessed your email for the recovery code. Get the code, undo family mode, delete the email permanently. Presto

Alternatively, I can probably 'hack' your code simply by guessing. are you

1) Spaceballs level of incompetence? 1234
2) use a birthday?
3) use a relevant year?

I can probably guess your PIN just from that information alone

[76561198407601200]

Satoru の投稿を引用：

this is false. In fact after a mere 5 attempts you get a cooldown on entering the code where you get this message

"Too many incorrect attempts. Please wait a while before trying again."

The timeout on this is like at least 2-5 minutes, I'm trying it now and I keep getting the error

It would take months to 'brute force' it this way even with a 4 digit pin.

This ^
Boils down to better parenting.

[Fed]

Just have a chat with your kid and ask them to respect your decision and not bypass the parental lock. I won't shame you for bad parenting like certain other users (projecting much?), just help them try and understand why you put it there in the first place, and it probably shouldn't be an issue afterwards.

[nullable]

Garthor の投稿を引用：

It just came to my attention that there is a little tool that bruteforces the 10000 combinations of the steam PIN in a few minutes. My kid obviously beat me to it...

Seriously VALVE, what are you thinking, allowing these things to happen? I mean, a 4 digit pin in 2020? And apparently without any signifcant cooldown.

If your kids are bypassing parental controls, eventually you'll catch them right? And punish them accordingly. At some point parenting is your responsibility. Valve has limited obligation to help you enforce your will.

I know if it was like 25 years ago and I tried a stunt like that, well I probably wouldn't even see the PC for the rest of the summer. That's parental control...

[Crazy Tiger]

There is a cooldown.

But even if there wasn't and your kid actually used such a tool, why are you putting blame on Steam and not scolding your kid?

[Garthor]

Seriously guys, this looks like a troll-fest all over. Just some additional data to help people who are not here to troll get some context:

1) Half of the people in this thread have no idea what are they talking about. There is a tool that bypasses any cooldown by performing a bruteforcing on what I presume is an encrypted stored PIN. I have seen it in action, and I know where to download it. Obviously I am not going to disclose the details.

2) Parenting is all well and good when you live with the kid, which is not my case. He lives with his mother who is not able to distinguish a potato from a root account, so she delegates me the technical stuff from distance.

Having given this context, I am seriously surprised to see how many people here are defending valve... for what reason exactly? If Valve had included no feature for parental control I would have had no qualms, but I expect publicised features to work as expected, and not being vulnerable to 40-years-old attacks.

[Spawn of Totoro]

Garthor の投稿を引用：

Seriously guys, this looks like a troll-fest all over. Just some additional data to help people who are not here to troll get some context:

1) Half of the people in this thread have no idea what are they talking about. There is a tool that bypasses any cooldown by performing a bruteforcing on what I presume is an encrypted stored PIN. I have seen it in action, and I know where to download it. Obviously I am not going to disclose the details.

As such is stored server side and the cooldown is server side, I don't see how it could bypass the cooldown.

While you may not agree with them, I don't think calling people "trolls" will help.

[Garthor]

Crazy Tiger の投稿を引用：

But even if there wasn't and your kid actually used such a tool, why are you putting blame on Steam and not scolding your kid?

Who told you I am not doing that too? I locked the kid outside the account, but on the other hand, as a customer, I hold Valve liable for blatant defects in their adevertised product (and honestly, being vulnerable to a 40-years-old attack is rather blatant defect from my standpoint).

[Satoru]

Garthor の投稿を引用：

Seriously guys, this looks like a troll-fest all over. Just some additional data to help people who are not here to troll get some context:

1) Half of the people in this thread have no idea what are they talking about. There is a tool that bypasses any cooldown by performing a bruteforcing on what I presume is an encrypted stored PIN. I have seen it in action, and I know where to download it. Obviously I am not going to disclose the details.

You can't brute force the PIN in the client because again there's a cooldown. Which you claimed didn't exist. This is patently false. You cannot brute force the PIN online or in the client. Which anyone with literally 5 seconds can confirm.

If you're doing an offline bute force attack, then well what 'cooldown' are you expecting. Because what you're doing is an offline brute force attack, meaning there is no way to have a 'cooldown'. The PIN length wont matter either.

So you're whining about a brute force attack, with no cooldown, on an offline attack, where there cannot be a cooldown.

OOOOOOHHHKAAAAYYYYYYYYYYYYY

Having given this context, I am seriously surprised to see how many people here are defending valve... for what reason exactly? If Valve had included no feature for parental control I would have had no qualms, but I expect publicised features to work as expected, and not being vulnerable to 40-years-old attacks.

If you didnt' actually lie about what the actual problem was, people wouldn't be calling you out on your obvious nonsense. Especially since you somehow magically expect there to be a mystical "cooldown" on an OFFLINE ATTACK.

Did you take like an online security course while drunk one night and are just parroting off 'security sounding words'

[Garthor]

ShelLuser の投稿を引用：

As an IT'er myself I have to call bs on that.

IT 'er? Ok, perhaps I have some holes in my preparation. Please feel free to explain to me how a server side PIN can unlock a steam account in offline mode on a disconnected PC, if there is no possibility to check the PIN locally. Please do, I'm listening.

As for the rest, I am appalled to see how people here are actually prompting for more information on the subject, considering the amount of kids who must follow this forum.

But now that you mention it, I am actually conflicted. After all, security-by-obscurity is an obsolete paradigm, and it is well known that the best way to prompt a quick security fix is to expose the issue.

So let's ask the moderator, should I publish in this forum the links?

[cinedine]

Satoru の投稿を引用：

[

You can't brute force the PIN in the client because again there's a cooldown. Which you claimed didn't exist. This is patently false. You cannot brute force the PIN online or in the client. Which anyone with literally 5 seconds can confirm.

[...]

You can. As Garthor rightfully said the thing has to work while being offline. The hash is stored locally.

I mean, you can literally google the tool for it yourself and try it. It's even available on Github and not some Dark-Net super secret magic mojo.

Garthor の投稿を引用：

But now that you mention it, I am actually conflicted. After all, security-by-obscurity is an obsolete paradigm, and it is well known that the best way to prompt a quick security fix is to expose the issue.

There is nothing to fix though. The altternative is to not allow a parent controlled account in offline mode.

Parental controls are not meant as a set-and-forget solution. They are just a tool of many.

---

Lastly: "I am IT" must be the worst argument I have ever seen. Are you the guy who fixes a paperjam in the office printer or are you DevSecOps? "IT" means nothing. ... and not that being "a developer" is anything better. Not to mention that anyone on the internet is a specialist.

[Garthor]

cinedine の投稿を引用：

Satoru の投稿を引用：

[

You can't brute force the PIN in the client because again there's a cooldown. Which you claimed didn't exist. This is patently false. You cannot brute force the PIN online or in the client. Which anyone with literally 5 seconds can confirm.

[...]

You can. As Gathor rightfully said the thing has to work while being offline. The hash is stored locally.

I mean, you can literally google the tool for it yourself and try it. It's even available on Github and not some Dark-Net super secret magic mojo.

For god's sake, someone ACTUALLY checked before speaking... :) Now I feel moved... :)
Seriously, this message was supposed to warn parents that Valve has released an almost useless feature. Be aware of that.

cinedine の投稿を引用：

There is nothing to fix though. The altternative is to not allow a parent controlled account in offline mode.

Now, THIS looks like a sensible argument. But I could agree with the alternative you mentions, or even with having separate accounts. What I cannot agree is being told that there is a reliable feature, when in reality that feature is easily bypassable. As a minimum I believe that I should be made aware of the issue.

[Xautos]

Garthor の投稿を引用：

2) Parenting is all well and good when you live with the kid, which is not my case. He lives with his mother who is not able to distinguish a potato from a root account, so she delegates me the technical stuff from distance.

Having given this context, I am seriously surprised to see how many people here are defending valve... for what reason exactly? If Valve had included no feature for parental control I would have had no qualms, but I expect publicised features to work as expected, and not being vulnerable to 40-years-old attacks.

So you start off by saying your child beat you to it with a bruteforce program and then you state the child doesn't know any better.

Coming back your earlier point about presuming to know about bypassing cooldowns on encrypted pins, you don't know about either as you stated yourself, where the childs mother delegates the tech aspects to you.

in other words you are accepting the word of one person who could be spreading misinformation about something she herself doesn't know much about, and then you jump on a bandwagon about it when you and your child don't know the tech aspect yourself.

You mention others are trolling on your first point, but it seems like you are playing a game all of your own to yourself, never mind what anyone else has stated.

[Xautos]

cinedine の投稿を引用：

Satoru の投稿を引用：

[

You can't brute force the PIN in the client because again there's a cooldown. Which you claimed didn't exist. This is patently false. You cannot brute force the PIN online or in the client. Which anyone with literally 5 seconds can confirm.

[...]

You can. As Garthor rightfully said the thing has to work while being offline. The hash is stored locally.

I mean, you can literally google the tool for it yourself and try it. It's even available on Github and not some Dark-Net super secret magic mojo.

Saying it and proving are two different matters. that is the problem this thread faces. if there really is a security vulnerably? Valve needs to know about it and plug it.

that means the location of the program, how it works and what steps are taken to bruteforce. so spill the beans to spawn in a pm or on his profile so actions can be taken.