Steam made Phishing Friendly - Login font ad "Remember Me" changing.

[battlezoby]

Ok... first of all, has anyone else gotten an enlarged "Login" box for Steam? Bigger box, bigger font? If not... maybe I did just get my account password stolen....

If you have, that shouldn't have happened without warning. If you don't know what the Login box will look like, how are we supposed to noticed fake ones?

Worse yet, the way I gained some confidence was to try it on someone else's machine to see that I got the same thing...

But in both case, the "Remember me" box default to checked! That was even more suspicious... as Steam should know we both turned it off, but as a phisher wouldn't.

Yea, it's a smaller "no excuse for it" than many of Steam's bad moves, but none-the-less another one in my opinion.

[Muppet among Puppets]

Email was a device authentication.
Once done, you login normal.

You did not need the code ever again on that device-install.

[RiO]

Messaggio originale di Pigeon, formerly noble:

i did not notice the Remember Me till it's too late -_- is that for offline mode?

No; it means Steam will remember your user name; your password; and apparently if you use email guard - also your 2FA token.

It's basically the same huge security hole on a multi-user system as auto-login at startup is, except you have to manually launch Steam.


Also; because Steam purposely violates the Windows account permissions model and segregated per-profile data storage -- because apparently some idiot in Valve's employ at one point thought that was a convenient way of doing things, I guess? -- in theory any Windows user account launching Steam might just be able to automatically login with your persisted credentials as well.

Messaggio originale di Muppet among Puppets:

Email was a device authentication.
Once done, you login normal.

You did not need the code ever again on that device-install.

I've heard it differently. Namely: it had a sliding window expiration of one month.
If you keep signing in daily, the window would refresh each time and it would never expire.

Messaggio originale di Muppet among Puppets:

Messaggio originale di RiO:

If this is correct it means every login passed the 24hr barrier you'll be required to dig into your email for a new 2FA token if you're not using Valve's app.

What? Email was a one time thing.
Are you sure this is the new thing?

Read the beta forums. Yes. It was a thing. Unsure if carried over to stable release.
Guess everyone is going to find out in ... about 24 hours from now.



----

Anyway, I just got the update myself. Sure enough; first thing it did is ask for and send a new Steamguard code to e-mail.


Oh yeah!
If you don't have to deal with this non-sense because you're using the Steamguard mobile app?

I'd advise you to take good care of your phone. Don't drop it or do anything with it that would e.g. necessitate a factory reset.

Remember your recovery codes you were asked to keep safe in case of such an emergency?

Valve kind of screwed the pooch and the 2FA code entry only accepts 5 character codes now; whereas the recovery codes are 7 characters. Oopsie-woopsie!

(Fun fact: this was reported within the first few days of the beta in August. Afaik they never fixed it before go-live.)

[Pigeon Pecking Keyboard]

How do I undo this Remember Me option? I can't locate the settings. Let me try and see whether they will ask me to reauthenticate after 24 hours.

Is it me, or the log-in does take longer than the old way to load up the client?

[RiO]

Messaggio originale di Pigeon, formerly noble:

How do I undo this Remember Me option? I can't locate the settings. Let me try and see whether they will ask me to reauthenticate after 24 hours.

You can manually log out of the Steam client:
Steam -> Change account; or
Profile icon -> Log out of account.

Messaggio originale di Pigeon, formerly noble:

Is it me, or the log-in does take longer than the old way to load up the client?

Hint: the way to (temporarily) disable the new login is to pass -noreactlogin as a startup parameter. It's using React. i.e. the new login window is not a native application anymore. It's a Chromium webview.

Oh yeah; this also means everyone who was using -nobrowser to launch a lightweight version of Steam that didn't suck up potential gigabytes of RAM whenever CEF threw a fit again, is now out of luck. No way to do that anymore. You need the browser components to be able to sign in.

[wesnef]

Messaggio originale di Pigeon, formerly noble:

Is it me, or the log-in does take longer than the old way to load up the client?

Yeah, it seemed a heck of a lot slower to me. Maybe animating the Steam logo is taking up all the cycles! /s

edit: yeah, logging in with the old system (using the "-noreactlogin" thing mentioned in the other thread) it loaded a lot faster


And yeah, 'remember me' being re-checked is obnoxious for those of us with multiple accounts on our PCs.

[RiO]

Messaggio originale di wesnef:

Messaggio originale di Pigeon, formerly noble:

Is it me, or the log-in does take longer than the old way to load up the client?

Yeah, it seemed a heck of a lot slower to me.

It doesn't just load slower. After you've logged in, but before the main client window renders, it literally spawns a second blank copy of itself in the signed-out state. It's only there for a few seconds, while the main client is booting up, but it's actually interactive and all and theoretically allows for a doubled up sign-in.

Whoever built this thing is a rank-A amateur.
And whoever thought this was in a state suitable for general release should be fired for gross incompetence.



Another fun thing to remember:
There's a plethora of people who run into problems with the Chromium web-views that Steam renders, not functioning properly. This ranges from small rendering glitches; to exorbitant RAM use; to outright not rendering anything and leaving web-views completely broken.

It can happen out-of-the-blue due to an incompatibility introduced with e.g. a Chromium update or a video-driver update. Generally because CEF is a mess; but also Valve is not the best at integrating it properly. (They're 20 major versions behind btw. and the current Chromium version they use is known for a critical security bug that allows sessions to be stolen via a cross-origin policy bypass; hooray!)

Usually, the fix for those rendering problems is to disable hardware-assisted web-view rendering in the client settings. Well... that kind of requires you to be signed in to the client to do. Which ... is a bit ... of a problem, when the sign-in window itself uses a web-view -- and thus would also be broken.

Steam also installs with that option enabled by default btw.
So if you install it fresh on a PC which just so happens to have these issues; you can't ever sign in to get it to work. Cue sarcastic slow-clap.

[Muppet among Puppets]

I tested it. I have the feeling they broke steam login.
It asked for email code. If it does that every day and also logs out automatically, steam is an annoyance.

The update notes..... "ui, new look and feel"....... yeah, it does not
feel
right anymore.

What is that?

[wesnef]

Messaggio originale di Muppet among Puppets:

What is that?

Progess!(tm)

[RiO]

Messaggio originale di wesnef:

Messaggio originale di Muppet among Puppets:

What is that?

Progess!(tm)

*) Progress feature 'r-after-g' to be finished and shipped separately at a time to be determined later.

[Muppet among Puppets]

Messaggio originale di wesnef:

Messaggio originale di Muppet among Puppets:

What is that?

Progess!(tm)

Reminds me on the new library "progress". Not only do you have the ability to sort your stuff, now you have to.
This is now, you can use a qr code that makes login easier..... but you have to use it, or you get annoyed.

[RiO]

Messaggio originale di Muppet among Puppets:

Reminds me on the new library "progress". Not only do you have the ability to sort your stuff, now you have to.
This is now, you can use a qr code that makes login easier..... but you have to use it, or you get annoyed.

Pretty much, yes.
It's like Valve's development team took the old adage "you can't make an omelet without breaking a few eggs" and extended it to: "oh well, then it'll be okay to slaughter the chickens as well right? And maybe burn down the hen house? I mean, who needs that?"

[Muppet among Puppets]

Messaggio originale di RiO:

Messaggio originale di Muppet among Puppets:

Reminds me on the new library "progress". Not only do you have the ability to sort your stuff, now you have to.
This is now, you can use a qr code that makes login easier..... but you have to use it, or you get annoyed.

Pretty much, yes.
It's like Valve's development team took the old adage "you can't make an omelet without breaking a few eggs" and extended it to: "oh well, then it'll be okay to slaughter the chickens as well right? And maybe burn down the hen house? I mean, who needs that?"

Or the new: "Dont you have a phone?"

[Zefar]

People still type in their password every time they want to login to Steam?
Really? How is that not the most annoying thing in the world for you?

This is also a good time for any keyloggers on your system to take the password.
I'm pretty sure keyloggers are able to tell Steam has been started and then it could probably tell what the account name is even if it's pre typed. Then it'll see your password and now it got both.

But you know, with Steamguard on your mobile makes this keylogger pretty useless.

I have had auto login for as long as the feature existed on Steam and keyloggers will just not be able to get my password. I even have it on on auto login on my mobile.

But I'm sure you'll say "I don't have keyloggers on my PC" to which I'll reply with, how is this an issue then?

Messaggio originale di RiO:

No; it means Steam will remember your user name; your password; and apparently if you use email guard - also your 2FA token.

It's basically the same huge security hole on a multi-user system as auto-login at startup is, except you have to manually launch Steam.

Okay, can you give a legit scenario where a Multi user system would be a threat to your Steam account while using Auto login.

Because I have doubts one family members are going to try to steal the account and if they do it'd be pretty easy to get back. You know, Steam Support.
What possible other scenarios would there be for Autologin being an issue?

I don't take the scenario "Putting autologin on a Public PC" as a valid scenario too.

[Liquid Inc]

Messaggio originale di Zefar:

People still type in their password every time they want to login to Steam?
Really? How is that not the most annoying thing in the world for you?

Getting the PC to remember your password is like putting the front door key to your house under the flower pot outside the door...

Messaggio originale di Zefar:

This is also a good time for any keyloggers on your system to take the password.
I'm pretty sure keyloggers are able to tell Steam has been started and then it could probably tell what the account name is even if it's pre typed. Then it'll see your password and now it got both.

Don't even need a keylogger to have your pass and username. Hell you wont even know they have it...
Better to type it and realise your mistake, than do nothing and still lose it.
Id take the first scenario over the latter. First you actually know when it happens, in contrast to yours...

Messaggio originale di Zefar:

But you know, with Steamguard on your mobile makes this keylogger pretty useless.

I have had auto login for as long as the feature existed on Steam and keyloggers will just not be able to get my password. I even have it on on auto login on my mobile.

But I'm sure you'll say "I don't have keyloggers on my PC" to which I'll reply with, how is this an issue then?

you actually trust your phone with your login credentials? honestly surprised you haven't lost everything already.. well, maybe you already have. See you won't know about it, as they can steal your passes whenever they want.
For me they'd only be able to take them when i enter them. That is much more secure than trusting a mobile phone, which 99% of them don't even have antivirus on them, with the lock and key to your entire life...

Hey you don't even need a keylogger to lose everything. Even a regular photo can contain malware. They tag the malware code through the image these days and it runs when the photo is shown on your screen, can even be in an advert.

They'll get your passwords while your scrolling on youtube. Those who type it won't lose it until they actually type it....

Messaggio originale di Zefar:

Okay, can you give a legit scenario where a Multi user system would be a threat to your Steam account while using Auto login.

Because I have doubts one family members are going to try to steal the account and if they do it'd be pretty easy to get back. You know, Steam Support.
What possible other scenarios would there be for Autologin being an issue?

I don't take the scenario "Putting autologin on a Public PC" as a valid scenario too.

Shared accommodation? it's a reality for some. Doesn't always have to be family members.

And you suggest steam support as some sort of magic wand? Are you seriously suggesting that it's steam responsibility to restore what you lost? (which they won't, and they have that in the T&C's)
Autologin is a serious security flaw..

[Muppet among Puppets]

Messaggio originale di Zefar:

What possible other scenarios would there be for Autologin being an issue?

Cats, dogs, brothers, sisters, kids, friends........ and vac