Steam safe for brute force?

[ger.Illuminat[um]]

Hi!
I just had a curious discussion with someone who desperately needed to know my actual steamaccount name.
My question is simple: Is it possible with help of a brute force attack to get into someone's steam account? Or is it somehow protected?
I use a pretty strong password in my opinion; 10 alphabetical, 2 capital the rest small, 2 Numbers and one special character and also Steamguard.
Could this someone potentially get into my account just with the known accountname?
I know there was once a possibility to get into an SteamGuard-protected account via a cr4cked steam.dll which injected itself somehow or something.
Am I safe?

Thanks!
greetings

[Jony]

лол

[Cathulhu]

While Bruteforce is technically possible, Valve implemented safeguards against that. For example, if you enter a wrong password three times the account gets locked for 15 minutes.
That gives you only 20 tries an hour, 480 a day, 14400 a month.
Sounds much, but if you take into consideration that a password with 8 letters can have about 3.026×10^15 different combinations it would take quite some time to try all possible combinations, about 94.5 years to be exact.
I'm pretty sure Valve would notice a bruteforce attempt in way less than a week and take additional actions to protect the account.

[ImmortalMan#GFS]

м м

[Muppet among Puppets]

Originally posted by ger.Illuminatum:

Hi!
I just had a curious discussion with someone who desperately needed to know my actual steamaccount name.

What was the "reason"?


See it that way: Your email address shows its account name all the time. So to say.
Do you think your email is unsafe after someone knows your email address?

[76561198016353073]

help

[pdlzera]

Vai Corinthians !!

[ger.Illuminat[um]]

Hey!
Thank you all for your quick answers.

Originally posted by Cathulhu:

While Bruteforce is technically possible, Valve implemented safeguards against that. [...]
I'm pretty sure Valve would notice a bruteforce attempt in way less than a week and take additional actions to protect the account.

Okay, thanks!

Originally posted by Muppet among Puppets:

What was the "reason"?

I bought a Bioshock Key and it was already activated ._. I bought quite a few games and was never unhappy with this shop (a German shop, no chineese one or someting) and the support wanted picture proof of me typing in the key while seeing a list of my games (to see if it wasn't already activated or something, don't know). So I blacked out my accountname in the top right and the support didn't allow that as a proof, because the picture was obviosly edited.

Originally posted by Muppet among Puppets:

Do you think your email is unsafe after someone knows your email address?

Hm, that's quite an interesting comparison, I never thought of that.
Okay, I think as long they don't ask for my password to test if THEY could avtivate the key theirselves I have not much to fear :D
Thanks alot!

greetings

[NyaGPT]

What if someone knows your pass or that of a vualve empleye *cough* gaben *caugh* cuase he/she published it and manages to break in is that there or gaben fault

[Cathulhu]

Valve does not safe passwords on their servers. No one with more than half a brain does that. You only safe hashes of passwords and SALT them so that even if someone obtains that data, he almost certainly can not use it, unless he spends half an eternity removing the SALT and reverse calculating the hash, both would take a very, very long time.

Unless you are utterly moronic like Sony and safe them in plain text.

For reference:
https://en.wikipedia.org/wiki/Hash_function
https://en.wikipedia.org/wiki/Salt_%28cryptography%29

[NyaGPT]

Originally posted by Cathulhu:

Valve does not safe passwords on their servers. No one with more than half a brain does that. You only safe hashes of passwords and SALT them so that even if someone obtains that data, he almost certainly can not use it, unless he spends half an eternity removing the SALT and reverse calculating the hash, both would take a very, very long time.

Unless you are utterly moronic like Sony and safe them in plain text.

For reference:
https://en.wikipedia.org/wiki/Hash_function
https://en.wikipedia.org/wiki/Salt_%28cryptography%29

still what if some1 hacks gaben

[Cathulhu]

At one time Gabe Newell gave away his Steam account name and passwords intentionally and still no one was able to enter his account:
http://www.escapistmagazine.com/forums/read/7.268638-Gabe-Newell-Gives-Away-Personal-Steam-Password
No one was able to enter it anyway.
Valve is not stupid.

[Tev]

Out of normal breaching, if put into numbers.

Unless things have changed much from 2011, it uses AES-256.

A 256bit encryption is the mathematical equivalent of 2^256 key possibilities. To put that into perspective, 2^32 is about 4.3 billion, and it keeps growing exponentially after that. What does this mean though? Well simply put, let’s say hypothetically all the super computers in the world (the ultimate brute force attack) decided to group up and tasked themselves to decrypt your AES-256 key so they could access your data. Assume they could look at 2^50 keys per second (which is approximately one quadrillion keys/second – a very generous assumption). A year is approximately 31,557,600 seconds. This means that by using the one billion super computers required to do this, they could check about 2^75 keys per year. At this rate it would take these computers 2^34 years (the age of our universe) to look at less than .01% of the entire key possibilities.

[NyaGPT]

Originally posted by Cathulhu:

At one time Gabe Newell gave away his Steam account name and passwords intentionally and still no one was able to enter his account:
http://www.escapistmagazine.com/forums/read/7.268638-Gabe-Newell-Gives-Away-Personal-Steam-Password
No one was able to enter it anyway.
Valve is not stupid.

i got as far as the steam guard screen XD
but dont tell gaben i did

[El Cactus]

:x

[baajimyriam]

Even on 2004 brute force was useless.