Security question

[sandokanski]

I was reading a rather long discussion about an user who was scammed and some funds were taken away from their account.

The overall consensus was that the account was compromised long ago, that's why there are no suspicious login attempts in the login log. And the attacker used a session token to monitor the account until there were some funds in the wallet.

Assuming this is the case how can a normal user CHECK if that is the case? So can I check if someone have stolen a session token and is actively using it to monitor my account status?

I'm not interested in an answer: "secure your account, here is how". I can find those every day, I just need to click on a random "I was scammed" post.

[ReBoot]

If you have an API key you didn't generate, that's a dead giveaway.

If you suspect your account might've been accessed by someone else, do the usual steps, that is deauthorize all other devices and change your password.

Ultimately, that boils down to remembering. Did you ever interact with a phishing site?

[DarkCrystalMethod]

Step 1 is to change your password
Step 2 is to deauthorise all sessions(logs your account off of every device, that includes trade sites and 'other' systems that you may have handed your credentials to)
Step 3 is to log in. Re-authorize any trusted sites and devices.

[sandokanski]

Originally posted by ReBoot:

If you have an API key you didn't generate, that's a dead giveaway.

If you suspect your account might've been accessed by someone else, do the usual steps, that is deauthorize all other devices and change your password.

Uktimat ls, that boils down to remembering. Did you ever interact with a phishing site?

I don't have an idea where to look for that API key, or what it is used for.

I don't suspect anything, just like the other user was clueless until the event occurred. That's why I want to make a plan how to check if I need to secure my account. Securing it every day will be a bit excessive, so perhaps there is a way to know when you should do it, before it is too late. Maybe there isn't and my question is pointless.

I only use Steam client to access Steam. So no logins in a browser. Just in case.

[ReBoot]

Originally posted by sandokanski:

I don't have an idea where to look for that API key, or what it is used for.

Click on a random "I was scammed" post and look there as for where to find your API key.

That said, you have indeed to secure your account daily. Security is a constant process, constant vigilance. I don't mean "look daily whether there's an API key", I mean "be careful in every single online interaction".

[miamew3]

Originally posted by sandokanski:

Originally posted by ReBoot:

If you have an API key you didn't generate, that's a dead giveaway.

If you suspect your account might've been accessed by someone else, do the usual steps, that is deauthorize all other devices and change your password.

Uktimat ls, that boils down to remembering. Did you ever interact with a phishing site?

I don't have an idea where to look for that API key, or what it is used for.

I don't suspect anything, just like the other user was clueless until the event occurred. That's why I want to make a plan how to check if I need to secure my account. Securing it every day will be a bit excessive, so perhaps there is a way to know when you should do it, before it is too late. Maybe there isn't and my question is pointless.

I only use Steam client to access Steam. So no logins in a browser. Just in case.

*Deauthorize all other devices https://store.steampowered.com/twofactor/manage

*Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

[sandokanski]

Originally posted by miamew3:

*Deauthorize all other devices https://store.steampowered.com/twofactor/manage

*Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

I don't want to do the deauthorization for all my devices every day. There must be a way to know if that autorization was used by a 3rd party.

My account doesn't have AP keys.

So only few devices. One of them I want to deauthorize though. But I don't see a way to do it for that one. Just for all of them.

[ReBoot]

Originally posted by sandokanski:

I don't want to do the deauthorization for all my devices every day. There must be a way to know if that autorization was used by a 3rd party.

That way is called "paying attention". You won't neccessarily get notified. You may get an email informing you of a new (& successful) login attempt but don't rely on that.

The only realistic way is contant vigilance when it comes to online interations. You need 2 things:
1. Common sense
2. Awareness of phishing

Grow those two and your account will be safe & secure for good.

[sandokanski]

Originally posted by ReBoot:

That way is called "paying attention". You won't neccessarily get notified. You may get an email informing you of a new (& successful) login attempt but don't rely on that.

The only realistic way is contant vigilance when it comes to online interations. You need 2 things:
1. Common sense
2. Awareness of phishing

Grow those two and your account will be safe & secure for good.

So there is no way to tell if my account was accessed from a different city or different country?
Steam probably knows. But it would be rude to ask them to check their logs, every now and then.

[ReBoot]

Originally posted by sandokanski:

So there is no way to tell if my account was accessed from a different city or different country?

You may get an email. Emphasis on "may".

Originally posted by sandokanski:

Steam probably knows. But it would be rude to ask them to check their logs, every now and then.

If you want to check, you can check yourself. No need to ask. Check for the API key, there's also a login history on the support page.

Quite frankly, regularly(ish) checking those places is a buzzkill if I ever saw one and it's way easier to pay attention to not let baddies into your account in the first place but if you prefer retroactively checking to proactively protecting, sure, go ahead, you can check that stuff yourself.

[sandokanski]

Originally posted by ReBoot:

Check for the API key, there's also a login history on the support page.

Checking for API worked.
However checking the login history asks me for a username and password. The exact reason why I do not use a web browser, as I don't want to type those in a browser, even embedded one.
How do I know something is not redirecting this login page to their phishing site?

[Chronocide]

Originally posted by sandokanski:

Originally posted by miamew3:

*Deauthorize all other devices https://store.steampowered.com/twofactor/manage

*Revoke the API key https://steamcommunity.com/dev/apikey (there should be nothing in the APIKEY)

I don't want to do the deauthorization for all my devices every day.

Yeah, so the easy solution is, if you look around, you'll find that like all the users with these issues are playing only a handful of games. It's like counterstrike, team fortress, and dota....that's it (I might have missed one). Just don't play those games and don't ever trade anything.

Set your profile to private. And don't stockpile steam cash in your account, and don't brag to people online that your account has valuables on it.

Oh, and if you have discord, set discord to not display which games you are playing.

[ReBoot]

Originally posted by sandokanski:

Originally posted by ReBoot:

Check for the API key, there's also a login history on the support page.

Checking for API worked.
However checking the login history asks me for a username and password. The exact reason why I do not use a web browser, as I don't want to type those in a browser, even embedded one.
How do I know something is not redirecting this login page to their phishing site?

... you know because help.steampowered.com clearly got steampowered.com as the domain which is the official one.

Also, I mentioned common sense earlier and common sense says "clicking a Navigation link on the official web site, as well as clicking a menu item on the Steam desktop client, both will lead you to official places, not phishing". Common sense is great!

[sandokanski]

Originally posted by Chronocide:

Originally posted by sandokanski:

I don't want to do the deauthorization for all my devices every day.

Yeah, so the easy solution is, if you look around, you'll find that like all the users with these issues are playing only a handful of games. It's like counterstrike, team fortress, and dota....that's it (I might have missed one). Just don't play those games and don't ever trade anything.

Set your profile to private. And don't stockpile steam cash in your account, and don't brag to people online that your account has valuables on it.

Oh, and if you have discord, set discord to not display which games you are playing.

I do have some of those games in my library, but I never played them.

My profile was set on private, but people complain they do not trust private accounts. Maybe that's better, though. Why should they trust me?

No. I don't have discord. Although i think to join one game discord server, but I'll definitely use a separate e-mail account for that.

[ReBoot]

Originally posted by sandokanski:

but I'll definitely use a separate e-mail account for that.

That'll do literally nothing against scams on Discord. You still have to utilize common sense, no matter which email address.

[miamew3]

I wouldn't say you need to deauthorize your devices everyday. Maybe just do a security check every couple of months to be on the safe side.

It also helps to be clued up on how scams work and avoiding phishing site/3rd party trading sites.