battlezoby 2022 年 10 月 6 日 下午 6:04
Steam made Phishing Friendly - Login font ad "Remember Me" changing.
Ok... first of all, has anyone else gotten an enlarged "Login" box for Steam? Bigger box, bigger font? If not... maybe I did just get my account password stolen....

If you have, that shouldn't have happened without warning. If you don't know what the Login box will look like, how are we supposed to noticed fake ones?

Worse yet, the way I gained some confidence was to try it on someone else's machine to see that I got the same thing...

But in both case, the "Remember me" box default to checked! That was even more suspicious... as Steam should know we both turned it off, but as a phisher wouldn't.

Yea, it's a smaller "no excuse for it" than many of Steam's bad moves, but none-the-less another one in my opinion.
最后由 battlezoby 编辑于; 2022 年 10 月 6 日 下午 6:04
< >
正在显示第 61 - 75 条,共 103 条留言
Muppet among Puppets 2022 年 10 月 7 日 下午 3:12 
引用自 RiO
If you enable secure boot such that the bootloader is signed and all the startup processes are verified, then you can in theory no longer replace the winlogon.exe process with a command prompt that logs you in as SYSTEM, if that's what you meant.
I had the one in mind with changing ease of access button with something that lets you choose a new password for admin.
And i can not find a note about it had been fixed

引用自 Zefar
So this isn't about Steam. Because you originally asked about Windows login.
It is about steam, if the question is, is it safe to be logged in when you are not there.
最后由 Muppet among Puppets 编辑于; 2022 年 10 月 7 日 下午 3:20
Brian9824 2022 年 10 月 7 日 下午 3:20 
The UI has absolutely nothing to do with Phishing.....
Crashed 2022 年 10 月 7 日 下午 5:09 
引用自 brian9824
The UI has absolutely nothing to do with Phishing.....
If anything it could be a countermeasure against certain types of phishing.
battlezoby 2022 年 10 月 7 日 下午 9:27 
Despite any security advantage the "QR code" might give when it's used, it's clearly just another way for hackers to break when IF AND WHEN the user prefers to supply the username and password upon logging in anyways. (Which I assume is needed whenever sharing an account on a machine/windows-profile with a household member and many other instances.)

Honestly, this is the first time I've ever even considered using seperate MS-windows user profiles for seperate users, but I'm not going to do it. I have a KVM which allows all my computers to be shared without even going into the same room as me, and logging in and out everytime we swap machine with each other would be total heck. Extreme cases, we swap machine back and forth every few minutes because one machines can deal with some websites while only the other machine(s) can deal with others.

Heck, in at least one game, I keep trying to use my faster machine 95+% of the time, but want to swap to the slower one for some]/b] timed maps because it's easier to keep up when the game is running more slowly. (Yes, I have to change my Steam login to the other machine, but at least I don't need to mess with anything else like logging in and out of MS-Windows.)
battlezoby 2022 年 10 月 7 日 下午 9:51 
Everything that assumes your phone is only in your hands ever, is bad security.
Not sure what you mean, but yea, owning a GPS tracking device to divulge your whereabouts (they're called "modern cellphones") is sign of some level of not being concerned with security(*).

Of course, "security" is probably the wrong word to use with respect your Steam games. Steam reserves the right to take away your access to all your Steam games for pretty much any reason at any time, so neither they or any of your in-game assets are likely to be "secure".

Said tracking devices can also do a "butt dial" (real or otherwise) to some recording exactly when you say something someone might want to use against you publicly.

* - Especially if you don't defeat the battery and other power sources whenever you don't need it.

P.s. This is more "on topic" than it may seem in that Steam encourages the use of such GPS self-tracking "butt-dialing" devices as your alternate means of "security".
最后由 battlezoby 编辑于; 2022 年 10 月 7 日 下午 10:02
Muppet among Puppets 2022 年 10 月 7 日 下午 10:35 
If a two factor thing works as intended,
you can have two or more instances of it installed. Because it doesnt matter.

I use several that can. And that is safe. Because allways something is missing to exploit that.


On the other hand,
How comes that steam guard can only be on one phone? Doesnt that indicate, that it is not 2fa? That it is assumed only one person ever has it in the hand, because otherwise, tough luck?

And now even qr code, the perfect one factor login.

"Dont you have a phone that is inseperable from you?"
JUICE 2022 年 10 月 7 日 下午 11:07 
My box still looks the same as always. Do you use beta or do you have a skin installed?
Crashed 2022 年 10 月 7 日 下午 11:14 
引用自 Amethyst
My box still looks the same as always. Do you use beta or do you have a skin installed?
Go to Steam->Check for Steam Client Updates...
You may not have yet downloaded the latest client update.
JUICE 2022 年 10 月 7 日 下午 11:20 
引用自 Crashed
引用自 Amethyst
My box still looks the same as always. Do you use beta or do you have a skin installed?
Go to Steam->Check for Steam Client Updates...
You may not have yet downloaded the latest client update.
Dear god.. Login error 4 times in a row before letting me sign in.
Crashed 2022 年 10 月 7 日 下午 11:25 
引用自 Amethyst
引用自 Crashed
Go to Steam->Check for Steam Client Updates...
You may not have yet downloaded the latest client update.
Dear god.. Login error 4 times in a row before letting me sign in.
If you don't have the QR code but have the new mobile app, back out of the login approval screen then go to the code screen.
Mr.Fr33man 2022 年 10 月 8 日 上午 12:40 
Wow now i have to remove the "remember me" checkbox every ♥♥♥♥♥♥♥ time AND on top it forgetts my account name every boot. Yes it got worse. Why are they doing that to us?
RiO 2022 年 10 月 8 日 上午 1:30 
引用自 battlezoby
Honestly, this is the first time I've ever even considered using seperate MS-windows user profiles for seperate users
That wouldn't have helped you either way.

The Steam Client doesn't obey the basic tenets of Windows' folder permission model and profile-based data segregation. Valve is still living in the 90s when it was common practice to just dump everything into the application installation folder, permissions and multi-user segregation be damned.

Any Windows user account capable of starting Steam will log in as the last global Steam user to have logged in with "Remember me" checked and auto-login enabled.

(Also; never try to have multiple Windows user accounts concurrently start Steam. It's going to end poorly and may corrupt internally managed data to a point where you have to wipe the whole thing and restart from scratch to get all the ducks back in a row.)



引用自 Mr.Fr33man
Wow now i have to remove the "remember me" checkbox every ♥♥♥♥♥♥♥ time AND on top it forgetts my account name every boot. Yes it got worse. Why are they doing that to us?
They're slowly beating you into submission and forcing you to comply and install the mobile app.

See; if you use the mobile app, you get a one-touch login with a QR code and you don't have to enter anything.
If you don't want to use the mobile app and rather avoid being tied to Steam's eco-system 24/7 (which is the real reason Valve wants you to use it) - then you get pain. As much as needed to alter your opinion on the matter.
最后由 RiO 编辑于; 2022 年 10 月 8 日 上午 4:18
Muppet among Puppets 2022 年 10 月 8 日 上午 1:45 
引用自 RiO
They're slowly beating you into submission and forcing you to comply and install the mobile app.

See; if you use the mobile app, you get a one-touch login with a QR code and you don't have to enter anything.
And when your phone gets stolen in the wrong neighborhood, where you get asked for stuff like the pin code,
it will be your fault, steam is safe and comfortable...... but you should not have lived in the real world. Otherwise a one click login would not have been a problem.
RiO 2022 年 10 月 8 日 上午 4:26 
引用自 RiO
They're slowly beating you into submission and forcing you to comply and install the mobile app.

See; if you use the mobile app, you get a one-touch login with a QR code and you don't have to enter anything.
And when your phone gets stolen in the wrong neighborhood, where you get asked for stuff like the pin code,
it will be your fault, steam is safe and comfortable...... but you should not have lived in the real world. Otherwise a one click login would not have been a problem.

I somehow doubt the first interest in the mind of whoever steals your phone will be to empty your Steam account; but yeah, this kind of thing is why one-touch logins are bad. And why using a single central device you essentially always have on your person as the 'one ring to rule them all' and manage access to all your identities; belongings; subscriptions; investments; and savings - basically to your entire life, is pants-on-head stupid.

A device like that belongs behind lock & key in your home. And should be used sparingly and with purpose only; so as to minimize the odds of damage due to circumstance.
(Accidentally drop phone or sit on phone; phone gets crunched; lose access to all accounts until you dig out your recovery codes to log in and pair another 2FA device. etc.)
最后由 RiO 编辑于; 2022 年 10 月 8 日 上午 4:31
wesnef 2022 年 10 月 8 日 上午 6:48 
引用自 RiO
They're slowly beating you into submission and forcing you to comply and install the mobile app.

Which, of course, only works if you have a smartphone.

Between this, and things like Overwatch 2 needing you to give a mobile number, and similar things. . . it seems like they're trying to say "in order to game, you're required to have a smartphone"
(ditto with all the companies that are slowly moving from paper coupons to "just install our app for information gathering great deals!")


edit: and how does the steam app work for people with multiple accounts?
最后由 wesnef 编辑于; 2022 年 10 月 8 日 上午 6:49
< >
正在显示第 61 - 75 条,共 103 条留言
每页显示数: 1530 50

发帖日期: 2022 年 10 月 6 日 下午 6:04
回复数: 103