Make removing a game from account a bit more secure.

[Marmik Emp37]

Removing a game from steam is too easy. It doesn't matter if family view is on or not, one can directly go to steam support from your account & remove recent / any games they want with couple of clicks.

Now these games can also be recovered the same way but in order to recover the game you need to notice or remember which game you've removed.


Why is this an issue?
Imagine a scenario, I am at my house playing a game. I feel the urge to pee so I leave my computer unattended for a short time. Where my brother can just come up to my support page & remove multiple games permanently in a very small window of time without me even noticing. I will eventually see the amount of games I own going down if I remember the previous count or I may not find out about this maneuver for a long time. Even if I notice this it might take some time to find which games were removed from a big library of mine.

It's just a small feature that might even not be too difficult to implement. But please prompt a guard code, password or pin before actually removing any game. Also sending a mail about this would only be brighter.

[Supafly]

Easiest way to identity games you've owned is to check purchase history and achievements.

If you're leaving you're computer to pee or anything else just press Windows Key + L and it'll lock the screen so you'll need to sign in again

[Pscht]

If you don't trust your own brother, try that cool new invention called a door lock.

[RiO]

Originally posted by Supafly:

If you're leaving you're computer to pee or anything else just press Windows Key + L and it'll lock the screen so you'll need to sign in again

The same problem also applies to a PC set up with multiple user accounts, where one or more of the Windows user accounts belong to people that use Steam and that configure its login with "Remember me" enabled.

Steam's core system design is antithetical to proper security practices, because it doesn't properly partition data by Windows user account. It still pigheadedly adheres to the old "let's just dunk it all into the app install folder"-tenet that rightfully was sent packing at the end of the '90s.

It will happily auto sign-in with whatever is the last user that signed in with "Remember me" enabled, regardless of the Windows user account under which Steam is running.

(Also; don't try to to run Steam twice with two different Windows users at the same time. It won't end well!)

Originally posted by Pscht:

If you don't trust your own brother, try that cool new invention called a door lock.

Uhm... The use of "imagine a scenario" kind of implies that it's not to be taken as the literal situation, I'd think.

[76561198407601200]

Originally posted by Marmik Emp37:

It's just a small feature that might even not be too difficult to implement.

It isn't difficult to implement and in fact there is already a feature which you log out of your steam account where untrusting family members can't remove games from your account.

[Supafly]

Originally posted by RiO:

(Also; don't try to to run Steam twice with two different Windows users at the same time. It won't end well!)

I do. However my kids each have their own windows account and drive. Their Steam is installed on their drive. Neither have admin privileges can't access anything on another drive.

C:\ = OS

3 Steam accounts
D:\ Mine
E:\ Kid1
F:\ Kid2

Best setup I could do in order to prevent them accessing the others stuff. It does mean Steam install 3 times

[[?]legit]

As mentioned before, you are responsible for the security of your account. We don't need more "security features", if anything, we need less.

[.geeK]

Originally posted by legit:

As mentioned before, you are responsible for the security of your account. We don't need more "security features", if anything, we need less.

Less security features for something that is a prime target for social engineering and phishing?

That's a new one, especially in terms of something that could have real world effects on this.


---

I think OP gave a usecase which seems reasonable. I also don't see the harm in providing a Notification, or extra prompt to further control deletion is asking too much.

Additionally, expanding your purchasing history to also include game actions, such as delete also makes sense from an auditing perspective, so that seems fairly reasonable and relatively trivial.


Alternatively, something like a "soft delete" which queues your game to be deleted in X amount of days, and sends an email to your account saying "You've deleted X game. This will be permanent in X days, to recover, click this link before {date} to reverse" -- something like this would be purely for games which passed the return window -- but that would provide additional security for something that could indeed cost users money.

I think any time a company can prevent a user to lose money, hurt themselves or simply just get better insight into the issue, the better.

---


OP I support your ask.

[Marmik Emp37]

I do follow most of these techniques & understand your points. I don't really have a brother but it would be just better to ask for a pin or code or something before doing this right? You never know what can happen when.

[Marmik Emp37]

Originally posted by Supafly:

Easiest way to identity games you've owned is to check purchase history and achievements.

If you're leaving you're computer to pee or anything else just press Windows Key + L and it'll lock the screen so you'll need to sign in again

Which also shows ♥♥♥♥♥♥♥♥ of market transactions so I still gotta find through.

[Marmik Emp37]

Originally posted by Pscht:

If you don't trust your own brother, try that cool new invention called a door lock.

What if Door Lock (IRL password) + Steam prompt for a password. Security x2?

[Marmik Emp37]

Originally posted by Snakub Plissken:

Valve is responsible for Steam's security. You're responsible for your system's security. And you have to manage the unique circumstances of your living arrangements yourself.

At a certain point you have to admit, you're logged in as admin to your PC. And you're logged into your account. You've identified and authenticated. How many more checks and confirmations does one need to manage every feature/scenario? You want to re-auth every time you do something? Or just instances you think could use it? I think you should have to re-auth every time you launch a game, because what if instead of going pee, the doorbell rings and you answer the door and get caught up in a conversation and so your brother goes in, starts playing some online game and gets you banned.

Don't you need protection from that as much as anything else?

Of course having additional re-authentication isn't bad or anything. But there's a pretty narrow path to walk before it becomes unusably cumbersome too.

Makes sense. But for the scenario you posted, there exists family view where my imaginary brother cannot play the game to get me banned, because it is locked. However he can remove that game which is ridiculous. So... need to auth before removing.

[Marmik Emp37]

Uhm... The use of "imagine a scenario" kind of implies that it's not to be taken as the literal situation, I'd think.

It has not. Just being more careful. I log out everytime I leave my room after I learned this method of deletion of games. I used to keep steam logged in at my home before.

Also I don't have a brother.

[Marmik Emp37]

Originally posted by legit:

As mentioned before, you are responsible for the security of your account. We don't need more "security features", if anything, we need less.

I disagree.

[Marmik Emp37]

Originally posted by .geeK:

OP I support your ask.

Thank you. Well phrased.

[Dick]

Have brother. Can confirm he did something similar. Cannot confirm his current status. If only Gaben fix this.