Steam account, password managers, copy-paste, unable to change password.

[ᴁ]

I'd like to document here my 4 hours struggle that I experienced today trying to help my friend to restore Steam account access. I persuaded him to use password manager as it was not the first time he forgot his credentials. And sure, Steam 'decided to make fun' of my attempts to demonstrate how easy it is while using password manager, as there emerged SEVERAL issues with steam password system.
Firstly, there are no clear rules what characters are allowed, what are required, nor about minimum or maximum length. This made troubleshooting attempts especially painful. I had to look at web page source code to find hidden parameter that states 64 character limit.
Secondly, steam web pages that handle password creation try to be smart by sanity checking your input on (keyboard) key release state. So if you were to copy-paste from password generator, this script could not catch this state, thus invalidating any input right even if it was correct. In order to trick it I had to copy-paste new password without last character and put it in manually with a key stroke.
Moreover, this super smart sanity check fails miserably in catching the fact that you use password longer than maximum 64 symbols. And it actually is unable to perform this check, because it is the browser that silently omits everything over the limit that was set by hidden parameter mention in the 1st issue. This I can understand from developers POV, it is a quirk. What I can not live with is that there was no guideline info handy on the page requesting new password input about limitations and character set. No warning, no special page any place other on steampowered.com, I was unable to find any well defined info what can be or can not be used in my password for steam specifically, only general rules of thumb and speculation.
That's it. Hopefully devs could use see a meaningful feedback in this rant, and other users could find it in search engines next time one encounters this madness.

[Muppet among Puppets]

My passwords for steam are very short.
If you needed 64 characters for steam, i would recommend to use 128.

[Muppet among Puppets]

Faq:
Select a Strong Password

A strong password is a necessary first step toward ensuring the security of your account. Your password should meet all of the minimum requirements listed below:

Use at least 6 characters
Use a combination of uppercase and lowercase letters.
Include at least one number within the password
Do not use a name, a word that could be found in the dictionary, or a series of letters as it appears on the keyboard ("qwerty" and "12345" are not secure passwords)

Use unique passwords

[Zekiran]

Your 'friend' needs to remember a nice short, personalized password and not use a password manager. Why anyone believes those things are any safer than making up a good personal memetic ... I do not understand.

[nullable]

Zekiran původně napsal:

Your 'friend' needs to remember a nice short, personalized password and not use a password manager. Why anyone believes those things are any safer than making up a good personal memetic ... I do not understand.

There's nothing wrong with using a password manager.

1. Human memory is fickle and faulty.
   
2. It may be difficult to remember rarely used accounts urls, usernames and passwords, but you still want access to the account when you need it.
   
3. You can include all sorts of other account details in notes in the manager. Steam recovery codes for example.
   
4. Whatever Mnemonic you're using may be disrupted by the requirements of specific sites. So may not always be that simple. And even then remembering them all and being consistent for your entire life is not something most people are going to do.

There's lots of ways to manage passwords and you can argue pros and cons about them all day long. Anything that helps you to use unique passwords across most of your accounts and helps you remember your accounts is better than using the same password a bunch, and maybe better than using a weak mnemonic (not saying they're all weak) which is what some people will do. And a password manager is certainly less of a hassle than forgetting your account credentials.

I'd personally go in for pass phrases over passwords if I had my choice.

[Zekiran]

I just... y'know.

Print mine out.

I have many. They're still unique to me and me alone. If you're sitting at a computer where several other people might come across them, that's one thing. But if you've got your own computer, which no one has access to? Learn to remember your passwords.

[ᴁ]

Muppet among Puppets původně napsal:

Faq:
Select a Strong Password

A strong password is a necessary first step toward ensuring the security of your account. Your password should meet all of the minimum requirements listed below:

Use at least 6 characters
Use a combination of uppercase and lowercase letters.
Include at least one number within the password
Do not use a name, a word that could be found in the dictionary, or a series of letters as it appears on the keyboard ("qwerty" and "12345" are not secure passwords)

Use unique passwords

This.
- No mention of 64 symbol max.
- No mention that 65 symbol and following gets silently omitted.
- No mention of sybols that are allowed, whether they are required.
- No mention (not tested, found on 3rd party resources) that apparently spaces are allowed, which is rare.
- No mention (not tested, found on 3rd party resources) that apparently Alt code symbols like ᴭ and etc found in Win "character map" app are supported in password, which is ipressive if true.

The rest is off topic so far. I manage virtualized servers, so I know a thing or two about security, no need to school and this is not the subject, steam flaws are.

[ᴁ]

And the most misleading behavior from Steam. When you paste new one in password reset form you get "Incorrect password" error which sounds even more misleading in my localized error message, as if you were to not meet the password rules above and not a single word about typing it in manually.

[ᴁ]

Localized error string basicly said "Inappropriate password."

[Muppet among Puppets]

Many other clients dont allow pasting in, only ctrl+V.

But anyway, a password manager is a good idea.

Zekiran původně napsal:

Your 'friend' needs to remember a nice short, personalized password and not use a password manager. Why anyone believes those things are any safer than making up a good personal memetic ... I do not understand.

A passwordmanager can store your details encrypted.
It could auto fill in, or at least removes the need to type very good passwords.
You can add infos.
You can change things.
You can not only encrypt, you can determine how much calculation each attempts needs.
You can define a file that must be present to open the storage, next to a password.
You can make copies of the storage and store them everywhere.
You can choose any password, create passwords of any length with any premade choice of variables.
You can carry the storage with you, safely.

All this with no efford.

Its not that difficult to understand

[Supafly]

Zekiran původně napsal:

Your 'friend' needs to remember a nice short, personalized password and not use a password manager. Why anyone believes those things are any safer than making up a good personal memetic ... I do not understand.

Paper is fine for some. Personally I have 100+ and much prefer a password manager to writing them down for reasons as follows:

1. They are organised
2. Searchable
3. 1 single password to remember
4. No re-using passwords
5. Store Extra data like backup and recovery codes, Code card (bank), Security questions, memorable word/s even images.
6. Encrypted so even if someone was to access my PC or Phone and find the password managers database they can't simply use them.
5. Don't have to walk around with a password book or other paper format containing them.
7. Streamlines entering of data on most sites with an auto-type feature (user tweakable if steps different on different sites.)
8. Zero typing errors as the manager does NOT make accidental key presses
9. Automatic creation of complex passwords if you don't wish to make your own
10. Password manager could be safe and secure if house burns down (assuming you have it backed up to the cloud. I don't but do have it on multiple devices. Likely screwed if house burns down but I may not survive that anyway. If it burns down while I'm out It's on my phone which is with me so at least 1 copy is safe and secure.


********OP******** I too agree Valve should provide specifics regarding password creation. Info on my 2 accounts passwords in case it helps are as follows
32 characters of upper and lower case letter with numbers and some symbols

Looking at both my passwords these are the symbols I know work

+ = # , % /

as / works I'd assume \ would to but don't actually have \
same applies to , working so I suspect . should too

[Watermelon {JESUS IS LORD}]

i dont remember my passwords i use autofill
if for some reason the data gets lost and i cant login i just contact support to reset my password, ez

[Muppet among Puppets]

huut {JESUS IS LORD} původně napsal:

i dont remember my passwords i use autofill
if for some reason the data gets lost and i cant login i just contact support to reset my password, ez

Thats probably the worst approach i have seen

[Watermelon {JESUS IS LORD}]

Muppet among Puppets původně napsal:

huut {JESUS IS LORD} původně napsal:

i dont remember my passwords i use autofill
if for some reason the data gets lost and i cant login i just contact support to reset my password, ez

Thats probably the worst approach i have seen

but it works so i like it :P

i forgot my yahoo pw prob a dozen times but i was able to contact support and got back to it every time nice and simple

steam tho i only had to contact them once and got back in it again nice and simple

[Washell]

Muppet among Puppets původně napsal:

huut {JESUS IS LORD} původně napsal:

i dont remember my passwords i use autofill
if for some reason the data gets lost and i cant login i just contact support to reset my password, ez

Thats probably the worst approach i have seen

I use it too. For forums, game sites, steam, and all the other junk, all the passwords are similar too, derivates of each other so I can reconstruct them if I'm somewhere else/new device.

I use *unique* passwords that are stored only in my memory for my bank account, email, government services and other things that actually matter if someone gains access.

You don't need the same level of security for each and every service you have a password for.

ᴁ původně napsal:

so I know a thing or two about security, no need to school

Lengthy passwords are a defense against brute force/dictionary attacks. You can't do either on an online service, so there's no point in having one. It only matters if they manage to hack Valve and steal the database, in which case you'll get a mail telling you to change your password anyway. Apply your knowledge to the context of the use case. School out.

[Muppet among Puppets]

If the computer crashes all accounts have to be regained by supports.
And it better happens then, i guess.

Good luck.