Install Steam
login
|
language
简体中文 (Simplified Chinese)
繁體中文 (Traditional Chinese)
日本語 (Japanese)
한국어 (Korean)
ไทย (Thai)
Български (Bulgarian)
Čeština (Czech)
Dansk (Danish)
Deutsch (German)
Español - España (Spanish - Spain)
Español - Latinoamérica (Spanish - Latin America)
Ελληνικά (Greek)
Français (French)
Italiano (Italian)
Bahasa Indonesia (Indonesian)
Magyar (Hungarian)
Nederlands (Dutch)
Norsk (Norwegian)
Polski (Polish)
Português (Portuguese - Portugal)
Português - Brasil (Portuguese - Brazil)
Română (Romanian)
Русский (Russian)
Suomi (Finnish)
Svenska (Swedish)
Türkçe (Turkish)
Tiếng Việt (Vietnamese)
Українська (Ukrainian)
Report a translation problem
Discussions Rules and Guidelines
Report this post
We have also reached a point, where the safest way to store a password (except for memorisation) is actually writing it down on paper (and leaving it out of sight from any webcameras).
Way more important is the part about not entering data into external sites. All currently known schemes have at least some aspect of social engineering bound to them.
If you are logged into your Steam account in your web browser, every website that requires a Steam login should allow you to confirm your account without entering data. This is by far the easiest way to tell legitimate websites apart from fake ones.
It is still not advised to follow every link to "free" stuff and the like, as there may be malware hidden in it, but usually virus sites and phishing sites are mutually exclusive, as they do not want to ring alarms by having multiple frauds to be discovered.
And finally... threads in this forum are rather to be opened by people who seek help, than those who offer it. This text will be lost in the depths of a hundred daily threads soon, so it may not be the best place to put the effort into. Maybe consider publishing a guide about it.
And sadly, it often feels like people who take the time to read about the issues of scams often only do so after the damage is done.
TL;DR: Long > complex
Ok, so you say that the passwords if "kept" on the system (so offline mode can work) are actually protected well. Then I guess no one can hack my system and retrieve said password?
Anything can be hacked.
https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60
Examples of hijacking attempts
A list of common scams can be found here. <-----------LINK to here :
https://www.reddit.com/r/Steam/wiki/scamtypes
It covers pretty much everything you said, and more. Problem is, sadly like this eventually, people don't want to read it, even after they get scammed or hijacked.
Passwords are not targeted these days. People are. It's been proven time and again that people are the weakest link in the security chain. It's easy to overwhelm someone when their emotions are being manipulated or those who just generally always let their guard down and have no situational awareness. The weakest of the herd are prioritized as it requires the least effort and generally always nets a favorable result for the attacker. They know it is far easier to have someone just give them what they need (IE: username and passwords) than it is to try and hack it.
For 1. it's not bad to fluff date of birth, but also draw back if you ever happen to forget about it if didn't record it like password manager, another problem is that most services barely, if at all go by this, as this is basically one of the last options for proving account ownership which would be used for free users, instead of those that became customers. Another problem is that some services goes by your ID DOB, rather then giving false DOB to them such as gov services, banking, or etc...
For 2. Not always true, the thing is if you use names, or words you realize they have to go though the whole dictionary, but not only that but not everyone uses english dictionary which is another thing have to take into account, now names that even more crazy to it as well as can have millions of names, this can be your name, someone, something, fictional, or whatever. The real problem is when only go for the bare minimum password requirement where made it way too simple is where the real issue about. That's why more compaines enforce people to push for capitalize letters, add numbers, symbols, or even special characters which make things 100x more harder for attackers when comes to that, as not only they have to figure out name/word if used, but also all kinds of placement order, and more.
For 3. This is good but shouldn't be limited to passsword, it should be any private info shouldn't be shared at all period, and should always be common sense when comes to that for that reason, less details thrown around on the internet about you, the less they have any idea how to attack you without knowing any of your important details, but always want to take into account you don't want to use same password for everything, can use same password for group of accounts or across services, but ensure to have different passwords for your most important things like payments services, gov account service, and etc.... So even if attacker manage to get one password, it no threat to your important things, and can always change the least non-important accounts passwords.
With all that in mind, more compaines are already equipped against brute force attacks for years, that means attackers can't brute services someone account like can't set up a bot to spam million times to get someone password until it cracks, as well happens after number of fail attempts you get with a cooldown that can last an hour upto a week depends how the services set it up, not only that but can also auto lock accounts, or warn user of such events, as well even track if someone trying to login from said IP as well. Example Microsoft can show you all login attempts history, as well IPs, and method of trying to login.
Now moving on internet safety tips, and advices for using Steam.
^This.
Believe it, or not most hasks, or hackers you might think, or believe are not actually software hackers at all, but actualy social engineering hack basically anyone can do this really, that means people that trick you to giving them your info, just like those scam Nigerian prince emails, phone calls scams, message from a friend claiming needing a favor real bad, or all kind of methods to trick you into either giving money, your info, or etc to them.
When you look online majority of account theft is actually by scammers, and phishing attacks, not hackers, as people are the most common targets online.
and dont post your Steam API Key on some 3rd party Skin sites :)
As long you don't share proof of ownership with other "party" they can't used that agasint you to try take your account.
Nobody hacked your account. Nobody. If anyone had access the problem came from your side. Most likely by giving away account information. If you didnt actively do it something else is compromised on your end. A Keylogger for example. Though even that wouldnt do that much if you use Steam Guard (which you should).