New login UI, "Remember me", and saving only usernames (NOT passwords)

[Starcleaver]

Come on Valve. I don't want to save my password. I never save passwords. I am willing to let it remember an account name. But, unlike the previous login UI, I can't save just my username, with the new one?

My only option with the new one is, "Remember me" which is username AND password; basically an autologin when I launch Steam. I really don't want that.

If I uncheck that, it doesn't remember username/password, OR the fact that I unchecked "Remember me", meaning that the next time around I would always be typing username, password, AND unchecking the "Remember me" option. Every time.

Come on guys, this is hardly necessary. I know it may sound ridiculous to some, but it's not at all unreasonable to expect that sort of functionality, when the previous login UI's (and lots of others) did the same. Please Valve, can that functionality be patched onto the new login UI?

Again, to be clear, I should be able to commit it to remember username only, and not password, and it should not force me to uncheck "Remember me" every single time I login.

[🦊 Hermit]

Agreed, I never saved my password for automatic login, nor do I wish to do so. However I do not want to have to type in my account name and manually tick a box every time either. This update is a step backwards in functionality.

[Starcleaver]

Just to make matters worse, I just noticed that there's no way through the login UI to launch Steam in offline mode. So, if my internet goes out, and that's not unheard of in my area, there does not appear to be any way I could get Steam to fire off at all, since, as I said, there's no offline mode option.

Why is THAT not there, in addition to other missing functionality? Sigh. As you said, Hermit, this is a step backwards, functionality wise.

[rawWwRrr]

Messaggio originale di Starcleaver:

Just to make matters worse, I just noticed that there's no way through the login UI to launch Steam in offline mode. So, if my internet goes out, and that's not unheard of in my area, there does not appear to be any way I could get Steam to fire off at all, since, as I said, there's no offline mode option.

Why is THAT not there, in addition to other missing functionality? Sigh. As you said, Hermit, this is a step backwards, functionality wise.

How hard is it to simulate an offline situation to see what happens?

Log out, pull ethernet cable or shut off wifi, try to log in, behold: "You can try running Steam in Offline Mode."
https://i.imgur.com/FmFD8vm.png

[IQØ]

I'm lost for words on this one. Like, wh...Yep, pointless backwards step. I better nip onto E-bay to buy a WW2 helmet, all this head scratching is going to turn me into solar panel.

Messaggio originale di rawWwRrr:

How hard is it to simulate an offline situation to see what happens?

I would guess at, about as hard as it is for some people to be helpful without becoming toxic in the process.

[xvii-Dietrich]

{...} the fact that I unchecked "Remember me", meaning that the next time around I would always be typing username, password, AND unchecking the "Remember me" option. Every time.

Needing to remember to "uncheck" the "Remember me" option EVERY SINGLE TIME is a security threat. It only takes one mishap...

Please Steam, fix this!

I don't care if I have to type in my username and password every single time, but I don't want there to be a security trap by default on every single login. That's dangerous.

[Yzal]

This update was a downgrade.

[[N7] The Lost Bellic]

What's that old saying "don't fix what ain't broke" ... sign in was perfect (unless there is some security reasoning behind this).

[Yzal]

I think it not remembering the username it's not an intended feature but instead something's broken.

For those that don't know the last username is saved (on Windows at least) as a registry entry.
So i logged out, deleted the registry entry, logged in again (making sure to uncheck "remember me") and bam, the entry was re-created.

The username is still stored, it's just not loaded by the new ui on launch.

If you want to test it yourself the registry path (for Win 10) is

HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\

And the entry is called AutoLoginUser

[Starcleaver]

Messaggio originale di Lazy Dog:

I think it not remembering the username it's not an intended feature but instead something's broken.

For those that don't know the last username is saved (on Windows at least) as a registry entry.
So i logged out, deleted the registry entry, logged in again (making sure to uncheck "remember me") and bam, the entry was re-created.

The username is still stored, it's just not loaded by the new ui on launch.

If you want to test it yourself the registry path (for Win 10) is

HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\

And the entry is called AutoLoginUser

I'm glad to hear this, thanks for the info. It does imply that maybe something just isn't working right with the new login. I hope that's the case and they fix the mistake. Otherwise, they need to rethink what they're doing here, they really do.

[Dr.Shadowds 🐉]

If you don't want auto login, nor password saved, then what little sense for saved username really? If want to save time to login, then that kind of the whole point of auto login, and password saved.

If you switch accounts because of this reason, then shouldn't matter really as you have to type out username anyways.



FYI there new login method which is QR login, you have to opt into Steam mobile guard app beta to get the option to do QR, and should op into Steam client beta as well.

With this all have to do is just scan, no typing at all, no username, no password, just scan with your phone, and logins you in when you click confirm on phone, it even show you a location map as well for where being login from, pretty neat IMO.

[RiO]

Messaggio originale di Dr.Shadowds 🐉:

If you don't want auto login, nor password saved, then what little sense for saved username really?

The convenience of not having to re-enter it when you launch Steam. Only the password.

Messaggio originale di Dr.Shadowds 🐉:

FYI there new login method which is QR login, you have to opt into Steam mobile guard app beta to get the option to do QR, and should op into Steam client beta as well.

Doesn't help those who don't have a compatible smartphone.
Also; I've yet to receive confirmation that Valve actually fixed the issue that was brought to light at the start of the beta period, where the new login experience no longer allows you to use the special 7-character recovery codes generated when you set up the mobile guard.

I'm going to assume that in typical Valve style, they completely ignored that critical bug and pushed the whole thing live anyway.

Meaning if you use the mobile authenticator, and you drop your phone or otherwise break it; or you need to factory reset it for whatever reason, you lose access to your account with no way to recover it - WHATSOEVER.

At this point in time, it'd actually be more prudent to remove the authenticator and fall back on basic email guard. Because at least you'll always retain access to your email inbox. And most competent mail providers allow you to put 2FA protection on it as well. And they make a point of actually testing their account-security related code to ensure it works properly and doesn't suffer such pants-on-head stupid regressions as Valve allowed to happen.

[Dr.Shadowds 🐉]

Messaggio originale di RiO:

Messaggio originale di Dr.Shadowds 🐉:

If you don't want auto login, nor password saved, then what little sense for saved username really?

The convenience of not having to re-enter it when you launch Steam. Only the password.

That the thing, if have some kind of fear saving your info on your device, then this doesn't matter.

If logging on non secure / not your device, why would you want you username save on those devices.

Messaggio originale di RiO:

Messaggio originale di Dr.Shadowds 🐉:

FYI there new login method which is QR login, you have to opt into Steam mobile guard app beta to get the option to do QR, and should op into Steam client beta as well.

Doesn't help those who don't have a compatible smartphone.
Also; I've yet to receive confirmation that Valve actually fixed the issue that was brought to light at the start of the beta period, where the new login experience no longer allows you to use the special 7-character recovery codes generated when you set up the mobile guard.

I'm going to assume that in typical Valve style, they completely ignored that critical bug and pushed the whole thing live anyway.

Meaning if you use the mobile authenticator, and you drop your phone or otherwise break it; or you need to factory reset it for whatever reason, you lose access to your account with no way to recover it - WHATSOEVER.

For low end phones that slow by it os, or very old I can see this as a problem as app is heavy.

Yeah I don't think they're in a rush to fix certain things if it not critical, but who knows maybe it be fix in a month, a year, or valve time.

When you setup your mobile app, you're given a recovery code to remove mobile 2FA from account whenever you needed, which why you write down, and store it. Which is almost no different than any other 2FA that also gives recovery code's to either remove, or to login.

Also yes you can recover your account if you lost your phone, or app for whatever reason, and didn't save recover code. All have to do is make a ticket to support, and don't need an account to do that. I been guiding people to recover accounts for years with, or without them having mobile app attached to their account.

[RiO]

Messaggio originale di Dr.Shadowds 🐉:

For low end phones that slow by it os, or very old I can see this as a problem as app is heavy.

You could also consider people who do not own a smartphone at all; whether by circumstance (just too expensive) or by life choice (just don't see a need for it; don't want to be exposed to 24/7 connectivity; etc.)

There's still plenty who go by with just a 'dumb phone' aka a feature phone.
In fact, feature phones have made something of a resurgence in recent years as e.g. a fashion statement; or economic statement.

[Dr.Shadowds 🐉]

Messaggio originale di RiO:

Messaggio originale di Dr.Shadowds 🐉:

For low end phones that slow by it os, or very old I can see this as a problem as app is heavy.

You could also consider people who do not own a smartphone at all; whether by circumstance (just too expensive) or by life choice (just don't see a need for it; don't want to be exposed to 24/7 connectivity; etc.)

There's still plenty who go by with just a 'dumb phone' aka a feature phone.
In fact, feature phones have made something of a resurgence in recent years as e.g. a fashion statement; or economic statement.

You're not wrong, and that why it defaults to email 2FA.

But still don't think Steam gonna do any backflips if they're keen on pushing something such as new app updates, and wanting QR to be another method for logging in.

[RiO]

Messaggio originale di Dr.Shadowds 🐉:

]don't think Steam gonna do any backflips if they're keen on pushing something

The fact that we have to refer to calling it 'pushing' says it all, doesn't it?
Indeed: this is a matter of making the existing a worse experience, so as to push users to something else. While really, the not-morally-bankrupt approach would be to make that something else a better experience capable of drawing users to it under its own merit.

This is a UX dark pattern referred to as 'nudging' or 'pin pricking.'