Steam Mobile Authenticator is insecure, breaks, does not use encryption properly

[Legion]

I recently got a new phone, which required me to remove the authenticator from my old phone and install it on the new phone. This prompted me with three things that are absolutely wrong about this app and hence Steams 2FA solution.

First, I was prompted to let the Mobile Authenticator app generate new backup codes while it was still on the old phone and I had to do nothing but open the app and press a button. This is a security flaw. Anyone with temporary access to my phone can generate these codes and repeatedly gain access to my account at a time of their choosing without my consent.

Second, I did not have the recovery code. I could not remove the authenticator without calling support and I could not add another authenticator on my new phone without removing the authenticator on my old phone. Requiring access to the old authenticator is problematic in case of a lost phone or such as in my case the situation where the SIM had long been replaced and the old SIM deactivated. Having to call support is not handy for anyone.

Last, the authenticator codes had remained working after my SIM was deactivated and I received a new one. Most times when I had a new SIM, usually on a Windows phone, 2FA authenticator codes stopped working as an insurance against surviving tampering after theft after the SIM has been disabled by the owner. It also ensures nothing important can be in memory and be gained access to while the phone is on but locked in strange hands with ample time to make that scenario work.

I suggest that Steam review their authenticator app and make sure recovery codes or backup codes are not obtainable just by opening the app and pressing a button, make a screenshot and send it anywhere in the world or beyond in about 30 seconds.

I request that Steam remove the authenticator app altogether and standardize on ietf standards based TOTP/HOTP codes such that people do not need a separate app to 2FA enable their Steam account (but use the default app for their phone OS for one time passwords/authenticator codes) and in the process being more certain that the whole authentication system is following security practices better than it does today.

Regards

[Black Blade]

Legion eredeti hozzászólása:

I just want to use the Authenticator app that I already have. For convenience, too.

Someone signing into their account just to play games is already quite serious enough to have to fix this.

More so if you consider games that keep inventory or stats and especially if these are worth a lot of play time to collect.

The mobile part is mostly for trading part, if you are not in trading then you don't need it as much as if someone is to gain access to your account they will have to wait for a long time before been able to trade so you will have time to get your account back
My guess then over all you don't really need the Auf that much and email maybe enough
But if you are trading mobile is needed so you can confirm something that the other 2FA cant do

Maybe my own opinion on the matter only

[The End]

Legion eredeti hozzászólása:

I don't live to keep my Steam secure.

Lazy is no excuse for not securing YOUR OWN stuff.

Legion eredeti hozzászólása:

The system should be secure by default and even fool proof.
It isn't.

It is very secure, only thing it can't deliver is COMMON SENSE to the user, that they have to provide themselves.

It's foolproof too, but no matter how foolproof you make something, some idiot will make it fail.

Your lack of understanding, is not Valves or the Apps fault.

[Legion]

Well just consider I understand what you're saying as 'compromise the security of your account further, because the mobile 2FA sucks'. Proofs my point. My original post requested the Steam app to be properly reviewed and fixed or replaced.

I'm not quite sure what the benefit is of me posting in this forum and getting the crap I got in response, on top of that giving the suggestion I would have to convince the community in numbers before Valve might get itself involved. Just the sheer amount of text written over my simple report and request is in itself inefficient already.

Please just get this looked at by knowledgeable people and rated for its merits, Valve?

That's just my own opinion on the matter.

[Legion]

Rockon eredeti hozzászólása:

Lazy is no excuse for not securing YOUR OWN stuff.

I have to disable the grace period on my phone?

Get a life.

[Satoru]

Legion eredeti hozzászólása:

I don't live to keep my Steam secure.

The system should be secure by default and even fool proof.

It isn't.

And this utterly ignorant statement shows entirely how blatantly clueless you are. Your purport to show 'security' issues with the app, yet make such a statement that shows you have absolutely zero idea of what security means.

Legion eredeti hozzászólása:

Well just consider I understand what you're saying as 'compromise the security of your account further, because the mobile 2FA sucks'. Proofs my point.

No it doesnt

This is again like saying the security on your front door is inescure because you left the back porch door open.

My original post requested the Steam app to be properly reviewed and fixed or replaced.

Your entire original post is filled with lies and misinformation.

I'm not quite sure what the benefit is of me posting in this forum and getting the crap I got in response

If you post a bunch of blatant ignorant nonsense don't expect people who actually understand what 'security' and 'encryption' actually means and tell you your ideas are pure garbage.

You want your ideas to be assessed on their 'merit'. Given your ideas have no merit, they're being ripped to shreds by those who know how the system works, by those who understand what the system is supposed to addreess from a security standpoint.

If you don't want people who are obviously more knowledable than yourself to destroy your bad ideas, make a blog.

Just the sheer amount of text written over my simple report and request is in itself inefficient already.

Your 'simple report' is again filled with

1) lies
2) misinformation

Which requires so much text to unravel the utter nonsense you 'perceive' as security issues when its blantanly obvious you have no idea what 'security' means.

Please just get this looked at by knowledgeable people and rated for its merits, Valve?
.

They don't have merit. That is why they are being shot down. Bad ideas stemming from bad assumptions about 'security' are the probelm here. Not the system.

Lets look at the 'merits' of your claims

1) Waah I need backup codes to remove the authenticator. No. You need the R-code which the authenticator tells you to write down. You didn't. Your fault
2) Waah why can't I leave my phone unattended! Physical security is your responsiblity. Steam is not responsible becuase you magically think leaving an unlocked phone out to be stolen is a problem with the 'security' of the app
3) Waah the 'encryption' is broken! No its not. Its also amusing you dont' even acknowldege your own vast ignorance on this part. You've just conveniently ignored all responses to it

Conclusion: all of the above are a PBKAC issue. Not a security problem.

Its already been looked and it works as intended. The fact that you think leaving your phone unattended is a problem "the app" is supposed to solve shows again this is a PBKAC problem.

[The End]

Legion eredeti hozzászólása:

Rockon eredeti hozzászólása:

Lazy is no excuse for not securing YOUR OWN stuff.

I have to disable the grace period on my phone?

No security will ever be good enough, if you leave your "door" open, that is pure logic.

[Legion]

I'm not reading this.

Even if you might be right that I might improve my security by disabling the PIN on the phone, good luck convincing the other billion people on earth with mobiles to do that once they install the Steam app. The suggestion is impractical.

Not one other authenticator I've seen allows generating codes that work outside the 30-second-ish window during which the currently shown code is active. The problem is with the app, not with my front door.

[The End]

Legion eredeti hozzászólása:

Not one other authenticator I've seen allows generating codes that work outside the 30-second-ish window

Is that backupcodes you are talking about? If yes, they do.

you can use backup codes to sign in. Follow the instructions below to generate backup codes

Creating and viewing a set of backup codes
To create a new set of backup codes:

Sign in to your account at https://myaccount.google.com/security/signinoptions/two-step-verification.
Look for the “Backup codes” area.
Click Setup or Show codes.
If you are fine using the current set of backup codes, you can print or download them. If you believe this set of codes might have been stolen or you’ve used many of the backup codes, you can generate a new set by clicking Get new codes.

https://support.google.com/accounts/answer/1187538?hl=en

[Satoru]

Legion eredeti hozzászólása:

I'm not reading this.

So apparently you don't want your ideas analysed on their 'merits'. But again that is the tactic of those who's ideas are so bad they cannot stand up to scrutiny

Even if you might be right that I might improve my security by disabling the PIN on the phone,

Thank you for the straw man argument

Not one other authenticator I've seen allows generating codes that work outside the 30-second-ish window during which the currently shown code is active.

Yes 'no other' authenticator has written backup code. Except for like:

Google - https://support.google.com/accounts/answer/1187538?hl=en
Discord - https://support.discordapp.com/hc/en-us/articles/115001221072-Lost-Two-Factor-Codes
Trello - http://help.trello.com/article/993-enabling-two-factor-authentication-for-your-trello-account

But yes NO ONE else uses it.

Its sort of amazing you make claims about things that are demonstrably false as giant proclamations that are supposed to prove your point.

The problem is with the app, not with my front door.

Considering EVERYTHING you have said has been wrong and incorrect. The problem is the same as it always has been

PBKAC

[Spawn of Totoro]

Legion eredeti hozzászólása:

I'm not reading this.

Even if you might be right that I might improve my security by disabling the PIN on the phone, good luck convincing the other billion people on earth with mobiles to do that once they install the Steam app. The suggestion is impractical.

No one suggested you disable the pin. They are saying you need to have a pin on it.

Legion eredeti hozzászólása:

Not one other authenticator I've seen allows generating codes that work outside the 30-second-ish window during which the currently shown code is active. The problem is with the app, not with my front door.

Blizzards does. Two minutes.

Google Authenticator does as well. Longest I waited was two minutes. Gmail also generates extra codes you can print and store, in case you lose the authenticator.

I have six Authenticators on my phone. It isn't hard to switch between them for any given service.

Battle.net
Google Authenticator
Steam
Authy
SQEX Token
SWTORSK

As they all work the same way and I only access them when I need them, it takes the same amount of time and effort for each so it doen't matter if I have to touch a different one each.

They all suffer from the same security issues as eachother too. If someone already has your name and password, then there is already a breach in your security. Chances of them getting a working code is a lot smaller then getting your name and password. Chances of them getting all three are even less.

[Legion]

Sure backup codes work for more than 30 seconds. And that is a problem, because they can be generated and stolen while you are not aware that they are.

Backup codes are to be generated *at setup time* and not at any moment after. That is for example the case with Google account 2FA.

I would point out those codes don't get stolen by strangers so easily as by the guy you are playing games with or the guy you know in places where you might be fine leaving your phone for a moment while you talk with someone else or whatever - people you otherwise trust and that know to look for the Steam app and are interested to misuse it.

I might call it ignorant that your mind is confined to your absolute neverfailing knowitall attitude. Certainly people are mostly able to prevent their phones from being stolen - and where they can't usually the grace period is usually passed at the time they get pickpocketed or whatever. Maybe just probably likely you should have known (define ignorance) that I consider a much broader set of situations and probabilities than simple theft of the device.

[The End]

Legion eredeti hozzászólása:

Backup codes are to be generated *at setup time* and not at any moment after. That is for example the case with Google account 2FA.

Wrong.

To create a new set of backup codes:

Sign in to your account at https://myaccount.google.com/security/signinoptions/two-step-verification.
Look for the “Backup codes” area.
Click Setup or Show codes.
If you are fine using the current set of backup codes, you can print or download them. If you believe this set of codes might have been stolen or you’ve used many of the backup codes, you can generate a new set by clicking Get new codes.

https://support.google.com/accounts/answer/1187538?hl=en

[Satoru]

Legion eredeti hozzászólása:

Sure backup codes work for more than 30 seconds. And that is a problem, because they can be generated and stolen while you are not aware that they are.

Again the "I want to leave my phone out to be stolen" problem is not a security issue. It's a PBKAC problem

Backup codes are to be generated *at setup time* and not at any moment after. That is for example the case with Google account 2FA.

It would be nice if you actually read the things you talk about instead of you know just lying and making stuff up.

You can generate backup codes on Google at any time. You simply log into your account and generate a set. When you generate a new set the previous set is immediately deprecated.

You love making claims that are literally just lies don't you?

Oh and Trello and Discord do the same thing. Oh but wait isn't it NO ONE does this?

Oh and before when you claimed hte SIM card was tied to the token generation. Yet another lie.

Again if you're gonna lie, then double down on the lying,and lie basically all the time, you need try harder with making up lies that are not easily falsfiable.

would point out those codes don't get stolen by strangers so easily as by the guy you are playing games with or the guy you know in places where you might be fine leaving your phone for a moment while you talk with someone else or whatever.

Again "let me leave my phone out for anyone to steal" is not a security problem with the app

Its a PBKAC problem.

\I might call it ignorant

This is pretty damn rich coming from the one person who is literally the most ignorant person on this thread, conveneintly moves the goal post when confronted with information counter to their position, and simply just lies about stuff now that you have nothing else to do.

The security of the app is fine

PHYSICAL security of the device is your responsibility. Put a PIN on your phone and stop blaimng steam because you think leaving your phone out to get stolen is an 'app problem' and not a PBKAC problem.

[Matt]

Steam Guard on the app was created to prevent/curb certain methods of account and item theft (i.e. malicious code running on a user's computer that instant trades their items possibly without their knowledge, "screensaver" scam etc.

Account theft due to a lost phone or computer isn't a major issue, as compared to others.

[Legion]

You cannot get backup codes from the Google Authenticator app.

You cannot get backup codes for a Microsoft Account at all. And with good reason. It would indeed be better to completely remove them.

The issue is not theft but purposeful misuse. That was in my last post, if you care to read.

Otherwise, I appear to be repeating myself over and over.