I find steam guard 2fa enabling process not so secure

[6005122851162932]

I want to enable steam 2fa.

This is how it's done in 99% of cases in all other 2fa-requiring programs and webpages:
1) get 2fa code without the need to install something else somewhere else.
2) enter 2fa code into auth.app. Usually it's Google Authenticator, but there are a lot of other open source apps which can generate 2fa codes, because it's always the same 2fa algorithm proven by years and millions of users.
3) password is still safe, I didn't had to enter it elsewhere. Plus I have 2fa security on top. All good.

But this is what I have to go through in Steam. I haven't even done it yet, it's just a result of research so far.
1) download one more unnecessary mobile app (steam app)
2) enter login and password on one more device (mobile), which lowers security. Mobile phones are full of spyware installed from store, except maybe Apple with their strict developer checks. But then you get Apple's always watching keylogger so it's still not great.
3) finally activate 2fa in steam mobile app
4) I literally don't need steam mobile app for anything except enabling 2fa. So, spend eternity to find some rare open source project which can generate steam 2fa codes, because usual auth apps will not work because steam's 2fa is different from global standard.
5) I don't want to keep mobile app logged in into my account. I just need it to enable 2fa and then logout from the steam app and uninstall it forever. And generate 2fa codes in some good trusted app tested and trusted by millions of people. I don't want my entire account security to be tied to mobile phone which can be easily lost or stolen.
5) so, add steam's 2fa code into other app, uninstall steam mobile app
6) change password, because it's probably compromised after typing it into mobile

I just want to secure my account by enabling 2fa, and generate codes on another secure trusted device. Why do I have to actually compromise account security if I want to do that?
Why is there no option is Steam PC version to activate global standard 2fa and to use any other trusted 2fa app to generate codes?

[Steven Seagull]

LOL, if the new Steam phone app works like this then I won't even try it.
Good point though that they provide the APK without Google Play.
Does it still need your phone number? Because if I forget to renew my plan the service provider will block the number and basically you lose it.

I recommend to use the e-mail method, and for your e-mail account you can have normal and secure 2FA.

[Judgmental Amaterasu]

The Steam mobile app is more than a 2fa. Also like do you think Steam has some small unknown user base? Literally millions already use the mobile app.

[Steven Seagull]

Judgmental Amaterasu a écrit :

The Steam mobile app is more than a 2fa. Also like do you think Steam has some small unknown user base? Literally millions already use the mobile app.

The 2FA and the Steam app should be 2 different apps. If you enter your Steam password on your mobile and the 2FA app is also there, then it is not 2FA anymore.

[Zefar]

Steven Seagull a écrit :

Judgmental Amaterasu a écrit :

The Steam mobile app is more than a 2fa. Also like do you think Steam has some small unknown user base? Literally millions already use the mobile app.

The 2FA and the Steam app should be 2 different apps. If you enter your Steam password on your mobile and the 2FA app is also there, then it is not 2FA anymore.

I haven't heard of a single case of a user being hijacked on Steam because of maleware on their phone. Not ONCE have I heard that.

Even though people like you love to claim it's super easy to get infected and lose all of the information.

This is a none issue really.

[Steven Seagull]

Zefar a écrit :

Steven Seagull a écrit :

The 2FA and the Steam app should be 2 different apps. If you enter your Steam password on your mobile and the 2FA app is also there, then it is not 2FA anymore.

I haven't heard of a single case of a user being hijacked on Steam because of maleware on their phone. Not ONCE have I heard that.

Even though people like you love to claim it's super easy to get infected and lose all of the information.

This is a none issue really.

I never heard anyone got AIDS. Maybe it doesn't exist.

edit: if one of the app's goal is to increase security, then it isn't. Then don't call if 2FA, because it isn't 2FA. It is nonsense. It is like writing your PIN on your credit card.

[6005122851162932]

Maybe I was a bit unclear...

The 2FA and the Steam app should be 2 different apps. If you enter your Steam password on your mobile and the 2FA app is also there, then it is not 2FA anymore.

Yes this.

Basically, in normal application, login with 2FA requires access to 2 devices. Typing password on PC. And then getting code from some 2fa app on mobile. Or even better if you can get like a hardware 2fa code generators that some banks use. Hackers and stealers need to get both devices to get full access to account.

Like, I can type my password on web login page when sitting in some shady internet cafe, maybe accidentally even autosave it there. And then confirm it with 2fa code generated on mobile. So even if internet cafe's pc is full of viruses and keylogeres, I still don't lose my account because it's secured by second device (mobile with 2fa code generator).

With the steam, 2fa codes and login and password all is stored on single mobile device. Step backward in security.

My next problem is that all programs which can generate steam-compatible 2fa keys are for pc. not mobile. I have to type password and generate 2fa keys on the same device, not separate devices. And that's bad too. Many pain, I will stay with email auth.

[Zefar]

Steven Seagull a écrit :

I never heard anyone got AIDS. Maybe it doesn't exist.

Except there are a million recorded cases of it. Bad analogy to use really.

I've been on this community since the start of it and I was part of the Volunteer Moderator team. During my time I never once saw someone make a topic about their phone being stolen and used to hijack their account.

Steven Seagull a écrit :

edit: if one of the app's goal is to increase security, then it isn't. Then don't call if 2FA, because it isn't 2FA. It is nonsense. It is like writing your PIN on your credit card.

For a criminal to take your Steam account he would need to do this.

1: Get access to your account name and password. Easier said than done.

2: Steal your phone. Then crack into it by getting past the pin code or the pattern painting. Which btw you have 3 chances to get right.

3: Then finally login to the account to change information.

It will not happen. Autologin on the Steam app does not equal to having the pin on your creditcard. Because he would still need to get into the phone itself.


You will have a far easier time convincing some gullible victim that you're a Valve employee on Discord and scamming a user than actually stealing someones phone to take their Steam account. Mainly because I keep reading about topics from people who have fallen for it. Far too many times might I add.

[Zefar]

«¿(ähF¶ÒL5ù«ZÇ7ôÃ|v)¯ a écrit :

Maybe I was a bit unclear...

The 2FA and the Steam app should be 2 different apps. If you enter your Steam password on your mobile and the 2FA app is also there, then it is not 2FA anymore.

Yes this.

Basically, in normal application, login with 2FA requires access to 2 devices. Typing password on PC. And then getting code from some 2fa app on mobile. Or even better if you can get like a hardware 2fa code generators that some banks use. Hackers and stealers need to get both devices to get full access to account.

The Google authentication just needs you to start it and confirm if it was you.

No password. No protection. Just start the app and use it to confirm it was you.

It has the exact same protection as the Steam 2fa. That being the Mobilephone it's put on. Hackers would need to steal this phone.

[Steven Seagull]

Zefar a écrit :

No password. No protection. Just start the app and use it to confirm it was you.

Wrong. You have to unlock your phone via PIN or fingerprint or whatever.

[Zefar]

Eiswolfin a écrit :

Zefar, I literally had my phone ripped from hands by a thief while I was using it. Guess what is not needed when a phone is ripped from one's hands while in use? Yup, don't need anything to unlock the screen.

Valve's new system is less secure than what they had previously with the old version. There was no need for that change.

The App does not give you full access. The thief also won't have your password.
It has actually limited control on what he can do.

Steven Seagull a écrit :

Zefar a écrit :

No password. No protection. Just start the app and use it to confirm it was you.

Wrong. You have to unlock your phone via PIN or fingerprint or whatever.

The same protection the SteamApp has. But you're ignoring that are you not?

[Steven Seagull]

Zefar a écrit :

For a criminal to take your Steam account he would need to do this.

1: Get access to your account name and password. Easier said than done.

2: Steal your phone. Then crack into it by getting past the pin code or the pattern painting. Which btw you have 3 chances to get right.

3: Then finally login to the account to change information.

Wrong. The criminal only has to do one thing: send you an SMS. Yes, it can be enough to just send an SMS to a phone and then you can see everything what is on the phone and do everything what the phone owner can do, but in stealth mode so it isn't even visible to the user. Search for the Pegasus malware for example. It is just one malware from the past.
Or you just have to open a webpage and with CPU vulnerabilites like Spectre v2 they can read everything from your phone. These are things happened already in the past, but in the future these can happen again. Just search for the term zero click RCE (remote code execution).

Even if these are rare it doesn't change the fact that Steam's 2FA is broken and not secure.

[Steven Seagull]

Zefar a écrit :

Eiswolfin a écrit :

Zefar, I literally had my phone ripped from hands by a thief while I was using it. Guess what is not needed when a phone is ripped from one's hands while in use? Yup, don't need anything to unlock the screen.

Valve's new system is less secure than what they had previously with the old version. There was no need for that change.

The App does not give you full access. The thief also won't have your password.
It has actually limited control on what he can do.

Steven Seagull a écrit :

Wrong. You have to unlock your phone via PIN or fingerprint or whatever.

The same protection the SteamApp has. But you're ignoring that are you not?

I'm ignoring it, because it doesn't have anything to do with 2FA. In case of proper 2FA you don't have both secrets on one device. That's the point of 2FA what you still cannot understand.

Here are 3 scenarios where properly implemented 2FA protects you:
Scenario #1:
You have your password typed onto a PC and you have your 2FA app on your phone. On your phone you never enter your password. The PC gets infected with a trojan and the hackers will know your Steam password. The hackers won't be able to log into your Steam account from THEIR PC because you won't approve the login attempt from your phone.
Scenario #2:
You have your password typed onto a PC and you have your 2FA app on your phone (same as before). You lose your phone and someone guessed your PIN or faked your fingerprint or used a vulnerability to crack the phone's encryption (such vulnerabilities existed before). The bad guy cannot do anything with your Steam account, because all he has is some numbers changing every 30 seconds. He doesn't have your password.
Scenario #3:
You have your password typed onto a PC and you have your 2FA app on your phone (same as before). You open a random cat GIF website on your phone which roots your phone and steals all your data. The attackers still won't know your Steam password.

Currently this would happen with Steam mobile app:
Scenario #1:
You will be protected.
Scenario #2:
The attackers will know your Steam password and can authenticate themselves with the 2FA app and they can take over your account.
Scenario #3:
The attackers will know your Steam password and can authenticate themselves with the 2FA app and they can take over your account.

[Zefar]

Steven Seagull a écrit :

Wrong. The criminal only has to do one thing: send you an SMS. Yes, it can be enough to just send an SMS to a phone and then you can see everything what is on the phone and do everything what the phone owner can do, but in stealth mode so it isn't even visible to the user. Search for the Pegasus malware for example. It is just one malware from the past.
Or you just have to open a webpage and with CPU vulnerabilites like Spectre v2 they can read everything from your phone. These are things happened already in the past, but in the future these can happen again. Just search for the term zero click RCE (remote code execution).

Even if these are rare it doesn't change the fact that Steam's 2FA is broken and not secure.

Read up on it and it seems to be used a certain group of people only. Android and Apple are patching the exploits as they find them.

So this is not going to happen to anyone who has a Steam account.

Steams 2FA is not broken or insecure. The old code it generate and you can still generate that code, it's easier to steal with such maleware than scanning a QR code with the phones camera.
They should get rid of the code entirely because gullible people on Discord keep giving it away to others. It'd be much harder to scam the scammers QR code.

[Steven Seagull]

Zefar a écrit :

The App does not give you full access. The thief also won't have your password.
It has actually limited control on what he can do.

In the new Steam mobile app, you never ever have to type in your Steam password?

[Steven Seagull]

Zefar a écrit :

Steven Seagull a écrit :

Wrong. The criminal only has to do one thing: send you an SMS. Yes, it can be enough to just send an SMS to a phone and then you can see everything what is on the phone and do everything what the phone owner can do, but in stealth mode so it isn't even visible to the user. Search for the Pegasus malware for example. It is just one malware from the past.
Or you just have to open a webpage and with CPU vulnerabilites like Spectre v2 they can read everything from your phone. These are things happened already in the past, but in the future these can happen again. Just search for the term zero click RCE (remote code execution).

Even if these are rare it doesn't change the fact that Steam's 2FA is broken and not secure.

Read up on it and it seems to be used a certain group of people only. Android and Apple are patching the exploits as they find them.

So this is not going to happen to anyone who has a Steam account.

Steams 2FA is not broken or insecure. The old code it generate and you can still generate that code, it's easier to steal with such maleware than scanning a QR code with the phones camera.
They should get rid of the code entirely because gullible people on Discord keep giving it away to others. It'd be much harder to scam the scammers QR code.

Still it would be safer if the phone app wouldn't ask for your password.
Pegasus is a cyberweapon and it costs a lot, and when I say a lot, it means millions of dollars.
You can get infected with a trojan by just downloading a free flashlight app. The bad thing is that you can never be sure that you are safe. What you still ignore is the purpose of 2FA and that the Steam app doesn't fulfill this purpose.