The new GOG galaxy 2 need my steam account log in

[simolkaw]

i got a invite of the beta (GOG galaxy 2.0) and when i'm using it they tell you to log in to your steam account by write your user and password not with sign in through STEAM
https://i.imgur.com/xglosHz.png

(the goal is Connect GOG GALAXY 2.0 with multiple platforms and unite all your games and friends scattered across them in one app.)

for myself i'm will not do that (i will never write my log in to a third party app whatever is) i don't need to
(only if there a way without write your login info)

I just ask this question for knowledge

Edit: is it safe to share login info with that third party web ?
MAYBE they can save the login info on their data !! or share it with other party !! or maybe some can get them from there

[Brian9824]

Ok you'd have to ask them about it. If they aren't using the sign in thru steam there is nothing steam can do to make them use it.

[かぐや]

Right click that page and "copy page url" if possible. If it gets steamcommunity.com to clipboard, it's safe. GOG is trusted anyways, they don't steal your Steam account.

[Washell]

引用自 simolkaw：

I just ask this question for knowledge

What question?

[Ogami]

Yeah ,this was clear even before the BETA.
They always said you need to login into GOG Galaxy with your full Steam credentials, this is the only way they can get your Steam games to work ( download/install) over GOG Galaxy.
The whole point of Galaxy is that its a multi client for all your games.
So of course you need to login for real into all those clients over Galaxy to use that function.

[simolkaw]

引用自 Washell：

引用自 simolkaw：

I just ask this question for knowledge

What question?

is it safe to share login info with that third party web ? as they can save the login info on their data or share it with other party, or maybe some can get them from there

[simolkaw]

引用自 Ogami：

Yeah ,this was clear even before the BETA.
They always said you need to login into GOG Galaxy with your full Steam credentials, this is the only way they can get your Steam games to work ( download/install) over GOG Galaxy.
The whole point of Galaxy is that its a multi client for all your games.
So of course you need to login for real into all those clients over Galaxy to use that function.

before i was never write my login info on it
they was need that sign in through STEAM only without write any steam login info, this the first time they told me to write my info, not press on the green sign in botton on (sign in through STEAM)

[シェービングフォーム]

I think it would be safer to keep one account per service and not share them on one platform.

In my case, keeping my unique gog and steam account separate and not share between.

And while we're at it, don't have the same password on all of your online accounts.

[simolkaw]

引用自 Raklödder：

I think it would be safer to keep one account per service and not share them on one platform.

In my case, keeping my unique gog and steam account separate and not share between.

And while we're at it, don't have the same password on all of your online accounts.

i agree
exactly the same what i do.

[Satoru]

Just to clarify here is how OpenID works on steam

1) You click the link
2) You are redirected to a Steam website to authenticate
3) You authenticate to Steam directly, the 3rd party webstie DOES NOT see your account name or password in any way
4) If you are successful steam sends the 3rd party site eh following information

Your 64-bit steam ID (in your case its 76561198044551706)

5) Thats it. That's all they get. They know literally nothing about your account other than "Ok I definitley know this user owns the profile with the SteamID of <x>"
6) There's functionally no security issue with this as nothing that isn't 100% already public by just looking at your profile page is ever exposed to the 3rd party site.

in fact if you look at GOG Galaxy and GOG connect, they both have a very specific requirement

Your profile has to be public for the system to work

Thus even if you log in via OpenID, and GOG has your SteamID, they can't do anything useful with it if your profile is private. Because they can only see literally what every other steam user already sees on your account.



I suppose for completeness, the OpenID on Steam allows developers, and developers who haev games on steam only, one additional extremely specific abiility

To send you a game directly to your account

Amplitude used this in their recent community promotion so users could select a single sega megadrie game as a bonus. The game being sent directly to a steam account means scammers coudln't spam a bunch of alt accounts and then sell keys for free on scam websites.

[skippysonics]

I know this is a bit old, but I just got the latest Galaxy update and it does NOT seem to be using the Steam OpenID API. This is asking for name and password then the two-factor authentication pops up and I don't remember seeing that when I've signed in to websites using that feature. Maybe it's cause it's using it's own built in browser so I'm not "logged into" Steam, but I'm not seeing any HTTPS notifications so all this could be transferred in the clear. Not comfortable with this at all and the beta never asked for this before (though the Steam connection always crashed for me anyway so I haven't been using it anyway).

[The HopelessGamer™]

GOG is a highly trusted platform. There is no way they will be stealing your information. Those developers are the most consumer friendly developers in the world.

[Supafly]

引用自 skippysonics：

I***snip*

That's because it isn't a web browser. It's a client. 2 different things. Galaxy 2.0 has been in testing for months. If it was dodgy someone or somewhere would have made it known by now.

Gog itself has been a well trusted PC platform for years too.

[skippysonics]

I don't care if it's a "safe" platform. It didn't used to require my steam credentials plus it's against Steam TOS to share your password to begin with. I used the old version of Galaxy and I was using the beta for a while before it just started requiring this unacceptable password login. There is NO need for them to have this information since it's all available through the legitimate Steam API. Hopefully Steam will do something to stop this before someone gets totally screwed.

[Supafly]

引用自 skippysonics：

before it just started requiring this unacceptable password login. There is NO need for them to have this information

It isn't required. You don#t NEED to enter it to use Galaxy 2.0. You only need it if you want to access you Steam or other gaming platforms from within Galaxy 2.0 it's your choice. It's an option. Steam won't do anything because Gog are not doing anything wrong.

[Dr.Shadowds 🐉]

引用自 skippysonics：

I don't care if it's a "safe" platform. It didn't used to require my steam credentials plus it's against Steam TOS to share your password to begin with. I used the old version of Galaxy and I was using the beta for a while before it just started requiring this unacceptable password login. There is NO need for them to have this information since it's all available through the legitimate Steam API. Hopefully Steam will do something to stop this before someone gets totally screwed.

I been on GoG 2.0 for half a year now, and they have been asking you to login for Origin, Steam, and etc, only IF you want to sync your Library with the other platform / store front to display your games, and whatever open public profile details such as score, what you unlock, and etc. IF you do not want to do this, do not do it, and carry on with your life, you can make the suggestion to GoG forum, asking them to find better ways to do it, but really I doubt they change this, but add more platform / store fronts to the syncing in the settings. I haven't seen them done a real update for almost half a year on the GoG 2.0, other than just making it public, and no longer closed beta.