Steam account, password managers, copy-paste, unable to change password.

[ᴁ]

I'd like to document here my 4 hours struggle that I experienced today trying to help my friend to restore Steam account access. I persuaded him to use password manager as it was not the first time he forgot his credentials. And sure, Steam 'decided to make fun' of my attempts to demonstrate how easy it is while using password manager, as there emerged SEVERAL issues with steam password system.
Firstly, there are no clear rules what characters are allowed, what are required, nor about minimum or maximum length. This made troubleshooting attempts especially painful. I had to look at web page source code to find hidden parameter that states 64 character limit.
Secondly, steam web pages that handle password creation try to be smart by sanity checking your input on (keyboard) key release state. So if you were to copy-paste from password generator, this script could not catch this state, thus invalidating any input right even if it was correct. In order to trick it I had to copy-paste new password without last character and put it in manually with a key stroke.
Moreover, this super smart sanity check fails miserably in catching the fact that you use password longer than maximum 64 symbols. And it actually is unable to perform this check, because it is the browser that silently omits everything over the limit that was set by hidden parameter mention in the 1st issue. This I can understand from developers POV, it is a quirk. What I can not live with is that there was no guideline info handy on the page requesting new password input about limitations and character set. No warning, no special page any place other on steampowered.com, I was unable to find any well defined info what can be or can not be used in my password for steam specifically, only general rules of thumb and speculation.
That's it. Hopefully devs could use see a meaningful feedback in this rant, and other users could find it in search engines next time one encounters this madness.

[ᴁ]

Автор сообщения: Washell

It only matters if they manage to hack Valve and steal the database, in which case you'll get a mail telling you to change your password anyway.

If a properly designed database (which is the case with Valve, I'm sure) gets stolen, hacker ends up with hashes of passwords that are worthless to use directly, but everyone possesing this DB is now free to brutforce it as fast as possible, that's why you would get notification advising you to change password. And hacks are often noticed month after the fact, so GL with your puny password in that case. You think you got all figured out, but as I said I need no infosec education, at least not on Steam boards..

[Muppet among Puppets]

Автор сообщения: ᴁ

Автор сообщения: Washell

It only matters if they manage to hack Valve and steal the database, in which case you'll get a mail telling you to change your password anyway.

If a properly designed database (which is the case with Valve, I'm sure) gets stolen, hacker ends up with hashes of passwords that are worthless to use directly, but everyone possesing this DB is now free to brutforce it as fast as possible, that's why you would get notification advising you to change password. And hacks are often noticed month after the fact, so GL with your puny password in that case. You think you got all figured out, but as I said I need no infosec education, at least not on Steam boards..

The brute force is not that easy if the storing is done right and you didnt use a password that could be in a list.
And then there is steam guard. Thats its main purpose.

[nullable]

Автор сообщения: Zekiran

I just... y'know.

Print mine out.

I have many. They're still unique to me and me alone. If you're sitting at a computer where several other people might come across them, that's one thing. But if you've got your own computer, which no one has access to? Learn to remember your passwords.

Which sounds like you save them in an unencrypted text file if you're printing them out. On top of that if your argument is people should just learn to remember their passwords it does beg the question why you feel the need to write them down and print them out. It sounds like a contradiction there.

I mean if your system works fine for you that's great. I'm not sure anyone is going to believe that you think saving your passwords in an unencrypted text file is a good idea, but you really can't understand why someone would want to store that data in a password protected, encrypted, searchable database. It kinda just ends up sounding like you like the system you have and are willing to engage in whatever confirmation bias that leads you to the conclusion it's the best, good enough, or anything more is unnecessary overkill.

I mean I can't say for sure, but it does seem like however you want to describe your beliefs on the subject they're genuine because you seemed very comfortable to dismiss putting passwords in a password manager on the one hand. But do something similar, albeit less secure on the other.

Regardless I'm going to say that anything that has you avoid some of the worst things users do with passwords is good. There's definitely nothing wrong with using a password manager to mitigate some well known human flaws, like memory. And adds another layer of security to something that arguably you do want to keep secure.

[Muppet among Puppets]

A password manager is a (possible local) tool that functions like a book with all the stuff in it,
but adds the before mentioned benefits.