Strong, randomly generated passwords keep being cracked

[Ryno]

Since 2017, I've gotten emails of attempts to login to my account with correct username and password every couple months from countries including Taiwan, Vietnam, Colombia, Russia, and France. No attempt has ever successfully gotten in because I have Steam Guard set up, but this is still worrying. Every time this happens, I change my email and Steam account to a new password using a password manager (LastPass) and I've even changed my LastPass password several times. Each time I deauthorize all logged-in devices, and I run routine and thorough malware and virus scans on all my devices, which have never had a detected keylogger.

The reason this is very odd is that my passwords are all very strong (30 characters, mixed case with special characters, and totally randomly generated). I highly doubt that these passwords are being broken by brute force, or through compromises to my other accounts (my LastPass and email access logs are clean). So what's the deal? How do my passwords keep getting broken?

[Muppet among Puppets]

Is the name in the emails text your login name?

[Phantasm]

Well, they say if you want to avoid having to crack someone's passwords - having direct access to their machine would work.

You might have a keylogger m8 - I'd nuke and pave. Swap your keyboard too if you're really concerned

[Muppet among Puppets]

Originalmente postado por Phantasm:

Well, they say if you want to avoid having to crack someone's passwords - having direct access to their machine would work.

You might have a keylogger m8 - I'd nuke and pave. Swap your keyboard too if you're really concerned

That would mean they were smart enough to place a keylogger on the computer, but then like apes try to pull the orange again and again, while the code diameter is too small to get the hand with orange through it?
And also taking the risk to notify the user of them doing it?

[Ryno]

Originalmente postado por Muppet among Puppets:

Is the name in the emails text your login name?

Yes, it's my login name (different than my display name).

Originalmente postado por Phantasm:

Well, they say if you want to avoid having to crack someone's passwords - having direct access to their machine would work.

You might have a keylogger m8 - I'd nuke and pave. Swap your keyboard too if you're really concerned

It's not this. I scan my machines weekly and monitor resource usage for red flags. Also if this were the case, there would be lower hanging fruit to exploit from this level of system access. If they had that kind of system access, they would be using my credit card number and bank account information, not just trying to log into my Steam account, and getting shut out by 2fa.

[Muppet among Puppets]

Originalmente postado por Ryno:

Originalmente postado por Muppet among Puppets:

Is the name in the emails text your login name?

Yes, it's my login name (different than my display name).

To the letter, and its not part of the email address?

[Ryno]

Originalmente postado por Muppet among Puppets:

Originalmente postado por Ryno:

Yes, it's my login name (different than my display name).

To the letter, and its not part of the email address?

Yes. It's not particularly long. If I could do so, I would make a longer and more secure username, but unfortunately you can only change your display name.

[Muppet among Puppets]

Originalmente postado por Ryno:

Originalmente postado por Muppet among Puppets:

To the letter, and its not part of the email address?

Yes. It's not particularly long. If I could do so, I would make a longer and more secure username, but unfortunately you can only change your display name.

If the hello "name" is unique to your login name,
it means
a) someone actually got the connection between a random username and email AND password
or
b) has those connections and its a fake email though (email change could prove that)

But by the looks, someone at least got the connection of address and login name

[Ryno]

Originalmente postado por Muppet among Puppets:

Originalmente postado por Ryno:

Yes. It's not particularly long. If I could do so, I would make a longer and more secure username, but unfortunately you can only change your display name.

If the hello "name" is unique to your login name,
it means
a) someone actually got the connection between a random username and email AND password
or
b) has those connections and its a fake email though (email change could prove that)

But by the looks, someone at least got the connection of address and login name

After changing my steam profile URL, the name mentioned in all of the emails changed to the new URL. Not sure what that implies. But the emails are legitimately from Steam Support.

[Muppet among Puppets]

Never heard of that.
But it would hint to that the emails are fake.

If the old ones were also based on the url.
Real emails would require the password to get to the "here is the code to login".
And only if you dont use app.
Or it was obviously a fake all the time

[Dr.Shadowds 🐉]

Originalmente postado por Ryno:

Originalmente postado por Muppet among Puppets:

If the hello "name" is unique to your login name,
it means
a) someone actually got the connection between a random username and email AND password
or
b) has those connections and its a fake email though (email change could prove that)

But by the looks, someone at least got the connection of address and login name

After changing my steam profile URL, the name mentioned in all of the emails changed to the new URL. Not sure what that implies. But the emails are legitimately from Steam Support.

New URL? You don't get new URL by changing your display name, and when you get email from Steam, it stays as your login name, not your display name.

It would say dear "login name", not dear "display name" that how it been.

If you think someone on your account follow these 5 steps right away.
1. Scan for malware https://www.malwarebytes.com/
2. Deauthorize all other devices https://store.steampowered.com/twofactor/manage
3. Change passwords from a clean computer
4. Generate new backup codes for your Mobile App https://store.steampowered.com/twofactor/manage
5. Revoke the API key https://steamcommunity.com/dev/apikey - This field should be blank



Here are the most common reason people get accounts hijack for any service really are as followed.
- Sharing account infomation with others. <--- Very common with impersonators, pretending to be Steam admin / support.
- Logging in on phishing sites. <--- Very common with skin gambling sites.
- Downloading / Installing Virus / Keylogger on your system.
- Using public devices that has keyloggers, such as cyber cafe, school computers, and etc...
- Storing your login credentials on a unsecured service that others has access to view.
- Using same login credentials for all your things, or using same login credentials on another service that had a data leak. Yes it does matter because even if it not related to Steam, if using same login credentials, hijackers will try to use those credentials to see what services you use with those credentials. https://haveibeenpwned.com/

https://youtu.be/9TRR6lHviQc

The type of story scammers say to you.

- "Hey vote for my team", and they link you a phishing site link, and try get you to login.

- "Hey I can't add you, please add me", and they try to start their scam with you.

- If you're friend with someone that got their account hijacked, you get scam message like, "I report you", "you been banned", and whatever to try scare you, and they tell you to trade your items to them, or if you have a login to phishing site may have a API key on account that redirect trades, they ask you to give them money, or etc...

- If you already got your account compromise by them, they change your display name to banned, or whatever, your display picture as well, they may delete your friends, and try to spend your wallet funds if you have any, also trade all your items, but if they see if you have mobile authenticator attached, they play their scam to get you to confirm the trade to get your items off your account to their account quicker if they're able to trick you into confirming the trade.


I show you few examples.
https://steamcommunity.com/sharedfiles/filedetails/?id=2329645315

https://youtu.be/JuWHCBeZrqI
https://www.youtube.com/watch?v=kook1DlxDAw
https://www.youtube.com/watch?v=0DDnV-MHSaY
https://www.youtube.com/watch?v=WfTXxLraokE

https://steamcommunity.com/discussions/forum/1/4956744526904317093/#c4956744526904653890

[Washell]

Originalmente postado por Ryno:

After changing my steam profile URL, the name mentioned in all of the emails changed to the new URL. Not sure what that implies. But the emails are legitimately from Steam Support.

If they were coming from support, changing the URL wouldn't affect that. So they're 100% sure not coming from support, they're just spoofing the sender address.

[Ryno]

Originalmente postado por Washell:

Originalmente postado por Ryno:

After changing my steam profile URL, the name mentioned in all of the emails changed to the new URL. Not sure what that implies. But the emails are legitimately from Steam Support.

If they were coming from support, changing the URL wouldn't affect that. So they're 100% sure not coming from support, they're just spoofing the sender address.

The URL is the Steam ID, and the email pulls the Steam ID, which is distinct from the "account name" which cannot be changed, and the display name which like the URL can. You can log in with the Steam ID/URL or the account name, but not the display name. The email isn't spoofed, all of the links lead to real Steam URLs, and I also confirmed with Steam Support that the emails are legitimate.

Originalmente postado por Dr.Shadowds 🐉:

snip

I have taken all the listed steps to secure my account, scanned my systems for malware, and have no been phished or clicked any chat links.

[Iceira]

Is network traffic Secure and what about Camera or other as you already point out keylogger, all this is part of traffic into ISP with no other middleman ( no vpn )

im ref at a Switch or other things can be part of this before it reach ISP, talk with own ISP

[Ryno]

Originalmente postado por |<- Iceira ->|:

Is network traffic Secure and what about Camera or other as you already point out keylogger, all this is part of traffic into ISP with no other middleman ( no vpn )

Yes, my system doesn't have an webcam (I use copy-paste for my passwords anyway, so camera wouldn't capture my inputs), no keylogger that any malware detector can find, and I am not using a VPN.

[Dr.Shadowds 🐉]

Originalmente postado por Ryno:

Originalmente postado por Washell:

If they were coming from support, changing the URL wouldn't affect that. So they're 100% sure not coming from support, they're just spoofing the sender address.

The URL is the Steam ID, and the email pulls the Steam ID, which is distinct from the "account name" which cannot be changed, and the display name which like the URL can. You can log in with the Steam ID/URL or the account name, but not the display name. The email isn't spoofed, all of the links lead to real Steam URLs, and I also confirmed with Steam Support that the emails are legitimate.

There two types of profile URL's, but neither of them are affected by changing your display name, you can change your display anytime, as much as you want, and won't affect your profile URL, also your display name is not used for URL at all.

https://steamcommunity.com/profiles/ "Your steam id number never changes"
https://steamcommunity.com/id/ "custom url you make, and can be changed"

Notice when you view your profile you see your custom URL not matching with your display name, that because they have nothing to do with each other, custom URL is on it own thing you can change at anytime, but only one person can have said unique custom URL at a time, display name has no restirctions so you can have millions of people using same display name, but everyone has their own unique profile URL, and it does not change because you change display name.

You see two sections, Display name, and two bars blow you see custom URL they have nothing to do with each other.
https://steamcommunity.com/my/edit/info

Originalmente postado por Ryno:

Originalmente postado por Dr.Shadowds 🐉:

snip

I have taken all the listed steps to secure my account, scanned my systems for malware, and have no been phished or clicked any chat links.

Then you're all set, ensure to review my post above for learning more about internet safety.