All Discussions > Steam Forums > Help and Tips > Topic Details

This topic has been locked

Epidemia-ilha Oct 31, 2014 @ 10:49pm

Is it safe to sign into sites through steam?

I ask because I came across this site http://www.wiiuiso.com/ andat the top it says sign in via steam and, that's kinda new to me, especially since the site contains frree games..

Something went wrong while displaying this content. Refresh

Error Reference: Community_9708323_

Loading CSS chunk 7561 failed.
(error: https://community.cloudflare.steamstatic.com/public/css/applications/community/communityawardsapp.css?contenthash=789dd1fbdb6c6b5c773d)

< 1 2 3 >

Showing 1-15 of 33 comments

Epidemia-ilha Oct 31, 2014 @ 11:35pm

There is a sign in option via steam.

Kargor Oct 31, 2014 @ 11:41pm

If it's done properly, then yes -- it's safe. It has to go through the Steam website.

The easiest way to be sure is to log into the Steam website first, then use the "log in through Steam". That way, the "login through Steam" will merely ask you whether you want to log into that site using your current Steam account -- you never have to enter your Steam credentials. So if a website fakes the "login through Steam" and asks for your credentials, you know it's trying to phish you.

3rd party websites have "public" access -- i.e. they can only see stuff that everyone on the internet can see by clicking through your profile. They cannot see private stuff or change anything -- unless they asked for permission to redeem keys, in which case they can add games to your account. If that's the case, then Steam will ask you for this permission during the login procedure.

Last edited by Kargor; Oct 31, 2014 @ 11:45pm

Epidemia-ilha Nov 1, 2014 @ 5:02am

Thanks, and do they ask steam for the login button?
I don't see how steam would like to be affilieated with a "illegal" website.

Thagirion Nov 1, 2014 @ 5:07am

Anyone know if theres a problem with uplay or is it just me??

 KARR™ Nov 1, 2014 @ 8:08am

Originally posted by Matthew Sobol's Daemon:
Originally posted by Epidemia-ilha:
Thanks, and do they ask steam for the login button?
I don't see how steam would like to be affilieated with a "illegal" website.
I'm guessing they have to ask for permission to do such a thing, at least for anything more personal than reading data you've set to public.

Not really.
It's free to access the Steam API, you and I could create a site that adds the 'sign in through Steam' button that displays details about users and their accounts, etc. It's all free public information

If a site is detrimental to Steam, they may block access for that user/site to the API, but if they don't know about the site... they can't do anything!

Kargor Nov 1, 2014 @ 8:34am

Originally posted by Matthew Sobol's Daemon:
Originally posted by Epidemia-ilha:
Thanks, and do they ask steam for the login button?
I don't see how steam would like to be affilieated with a "illegal" website.
I'm guessing they have to ask for permission to do such a thing, at least for anything more personal than reading data you've set to public.

Steam doesn't give out more information that your public stuff. And everyone can use that mechanism, even you could make a website that can "login through Steam".

Although I haven't tried doing it myself just yet. Some of their web-stuff requires things like an "API-key", which may or may not involve some form of registration that may or may not be denied.

Either way, to my knowledge, Steam uses a standard protocol called '"OpenID" which is also used by other websites to provide "login through..." services for 3rd party sites.

Technically, the "login through Steam" redirects a website to Steam, and returns a user-ID unique to Steam (probably the long number for your account) along with the information that the user is indeed THAT user. That's all that the 3rd party site ever sees -- no passwords or private information.

Originally posted by Matthew Sobol's Daemon:
Well, yeah, that's what I said. What about info like adding keys or messing about with inventory items, though?

During the "login through..." procedure, Steam will ask you whether you want to allow that site to register keys, if the site asks for that capability. If they don't ask for it they can't do it.

Sites can never access your inventory other than reading it if it's set to public.

Last edited by Kargor; Nov 1, 2014 @ 8:39am