Steam Guard Key Fob

[shipit]

I would be interested in purchasing an authenticator fob similar to the Blizzard authenticator. I don't use a cell phone due to personal reasons and it is painful to enact trades and operate on the Steam market. Also, having the added security on my account would be a big plus. Please develop a unit to be purchasable for us non-cellphone/smartphone users.

[cSg|mc-Hotsauce]

What's next?

We’re already working on improvements to the Steam Chat app, including voice chat. With Steam Chat moving to its own dedicated app, the original Steam Mobile app will see significant upgrades focused on account security. Our plans include better Steam Guard options to help securely log into your Steam account, such as QR codes and one-touch login, and improved app navigation.

https://steamcommunity.com/games/593110/announcements/detail/1621770561065348220

Steam Mobile App - The mobile app is getting a refresh to add more login types and help users secure their accounts.

https://steamcommunity.com/groups/steamworks/announcements

[Cat on Linux]

there's desktop app for steam auth - SDA. works well if you don't want to use cell phone or tablet. google for Steam Desktop Authenticator and make sure you're looking at github page with user Jessecar96 - this one is the original creator of this app.

[shipit]

Originally posted by Cat on Linux:

there's desktop app for steam auth - SDA. works well if you don't want to use cell phone or tablet. google for Steam Desktop Authenticator and make sure you're looking at github page with user Jessecar96 - this one is the original creator of this app.

Thank you Cat, I will look into that!

[Phantom]

Ensure that you download the actual SDA by Jessecar.

There are many clones out there that are fake and simply just malware that can steal your account details.

[Spawn of Totoro]

Originally posted by Cat on Linux:

there's desktop app for steam auth - SDA. works well if you don't want to use cell phone or tablet. google for Steam Desktop Authenticator and make sure you're looking at github page with user Jessecar96 - this one is the original creator of this app.

I would not suggest this as it is a security risk. Any number of things could have been done to it, including key logger or other malicious activity.

There is no physical authenticator. The only official one is on the phone, through the iOS or Google stores.

[Cat on Linux]

Originally posted by Spawn of Totoro:

Originally posted by Cat on Linux:

there's desktop app for steam auth - SDA. works well if you don't want to use cell phone or tablet. google for Steam Desktop Authenticator and make sure you're looking at github page with user Jessecar96 - this one is the original creator of this app.

I would not suggest this as it is a security risk. Any number of things could have been done to it, including key logger or other malicious activity. It puts your account security at risk.

There is no physical authenticator. The only official one is on the phone, through the iOS or Google stores.

I'm not saying this is official. using cell phone for anything rather than calls is also security risk. everything has security risk, even downloading your purchased game from steam servers. so far I'm yet to see any single report from people who used real SDA from Jessecar and had their credentials stolen.

[cSg|mc-Hotsauce]

There is a reason why it is called 2FA. Removing the 2 from it defeats the purpose.

[Cat on Linux]

Originally posted by cSg|mc-Hotsauce:

There is a reason why it is called 2FA. Removing the 2 from it defeats the purpose.

:qr:

how it is called "removing"? you can have steam app on one PC and SDA in virtualbox or on another PC. it don't have to be attached to your PC.

[Spawn of Totoro]

Originally posted by Cat on Linux:

I'm not saying this is official. using cell phone for anything rather than calls is also security risk. everything has security risk, even downloading your purchased game from steam servers. so far I'm yet to see any single report from people who used real SDA from Jessecar and had their credentials stolen.

Far less risky then using a hacked version of the authenticator, created by a stranger. There is a huge risk spike with that.

Originally posted by cSg|mc-Hotsauce:

There is a reason why it is called 2FA. Removing the 2 from it defeats the purpose.

:qr:

Yep, another reason it is riskier.

Originally posted by Cat on Linux:

how it is called "removing"? you can have steam app on one PC and SDA in virtualbox or on another PC. it don't have to be attached to your PC.

Not many would do that or know how to set up a virtual box. You are assuming everyone has such knowledge.... and happen to own two computers.

[Cat on Linux]

Originally posted by Spawn of Totoro:

Not many would do that or know how to set up a virtual box. You are assuming everyone has such knowledge.... and happen to own two computers.

why can't I assume that? :) Valve assumes all of us have supercomputers so it can drain 2Gb of RAM just to run their client, Valve assumes that all of us have latest smartphones to use their auth tool, Valve assumes we have unlimited broadband by tearing apart our network activity with this new UI. If what Valve assumes is true at least in half, then I can assume that everyone who doesn't want to use smartphone can find in their garage old laptop or PC they no longer use because it doesn't meet Valve's jacked system requirements :)

[PXL]

The majority of PC users go through life using PCs as is. I mean they don’t have the need to run anything in a VM. If someone is actively using VMs for running stuff safely in a container then I’d question just how safe and secure their PC is in the first place.

Experienced pro user using a VM - fine.

Inexperienced user using a VM as suggested while downloading possibly insecure and unsafe software to bypass the proper 2FA ...

That’ll end well.

[76561198407601200]

Originally posted by Cat on Linux:

Originally posted by Spawn of Totoro:

Not many would do that or know how to set up a virtual box. You are assuming everyone has such knowledge.... and happen to own two computers.

why can't I assume that? :) Valve assumes all of us have supercomputers so it can drain 2Gb of RAM just to run their client, Valve assumes that all of us have latest smartphones to use their auth tool, Valve assumes we have unlimited broadband by tearing apart our network activity with this new UI. If what Valve assumes is true at least in half, then I can assume that everyone who doesn't want to use smartphone can find in their garage old laptop or PC they no longer use because it doesn't meet Valve's jacked system requirements :)

Because if you take a browse through just the help section alone, you can see that there are those who can barely operate a pc properly, much less being able to setup virtualbox. You can assume as much as you like, but an assumption can be wrong, such as in this case.

[Cat on Linux]

Originally posted by The Living Tribunal:

Because if you take a browse through just the help section alone, you can see that there are those who can barely operate a pc properly, much less being able to setup virtualbox.

you're telling it like setting up a Virtualbox and creating guest OS is something hard novadays. it's no harder than to install your video drivers. couple of simple settings in the GUI and you're set. I don't understand why you're implying that all windows users are that helpless. If they can read and follow simple instruction there's nothing hard. M$ even provides with already made images of Windows 7/10 for developers, no need to install windows, just add to your Virtualbox and use as you would normally use Windows.

[Spawn of Totoro]

Originally posted by Cat on Linux:

you're telling it like setting up a Virtualbox and creating guest OS is something hard novadays. it's no harder than to install your video drivers. couple of simple settings in the GUI and you're set. I don't understand why you're implying that all windows users are that helpless. If they can read and follow simple instruction there's nothing hard. M$ even provides with already made images of Windows 7/10 for developers, no need to install windows, just add to your Virtualbox and use as you would normally use Windows.

Most, not all. Not just windows users either. There are those like that on Linux and Mac too.

The developer even warns of it being a security issue:

FINALLY: Using this application is a bad idea, because it COMPLETELY DEFEATS THE PURPOSE of two-factor authentication! If your desktop is infected with a virus, it will be able to hijack the authenticator app and completely subvert the protection. THIS APPLICATION DOES NOT PROTECT YOUR ACCOUNT; IT ONLY ALLOWS YOU TO USE STEAM FEATURES THAT REQUIRE THE AUTHENTICATOR WITHOUT HAVING A PHONE. If you have a phone that supports the Mobile Authenticator, you really shouldn't use this application!

And still requires an SMS message to activate.

Note: you still need a mobile phone that can receive SMS.

[Cat on Linux]

shipit,
do proper research elsewhere to get unbiased opinions on this tool. steam forums are property of Valve corporation who imposes the requirement of having smartphone. No one here takes into consideration the fact that you don't have and don't plan to purchase one.

SDA indeed needs any phone to receive text message once. basically this is not SDA that needs it but Valve who insists in linking your phone number to your steam account if you use mobile auth.
you have couple of choices here:
a) link your existing number
b) link number from someone in your family who does not use steam (grandmas are good for that sake :))
the only time when you will need to reuse this number is when you reset/change steam guard so make sure you have access to it.

if you will go with this app don't add your phone number via steam web site, it won't send you text. proceed with app and it will request the text on your behalf. write all codes it gives to you, back up maFiles folder and in case you'll need to restore it on new PC you can just copy it without need to reset your steam guard (no 15 days cool down on market trades as for smartphone users).