Okay Steam, Its time you listend to your customers. Its time we sort our issues and your issues.

[DeathTech]

Dear steam & steam users.

I think it is high time we sort some things out, and clear the air.
I myself have been part of steam pretty much as soon as the steam platform came out.

You platform has grown, it has expanded, it has matured, and it is under siege now.
Just like any big platform there are descisions to be made.
Things to be changed, hurdles to be tackled.

However in the last year or so your measures have gone from horrible to downright terrifyingly comunitst ban hammer of doom "f everyone who is stupid" or too poor to use our fancy system.

What is this topic about? I will tell you what it is about.
Security. And the over abundant need for it. Aswell as the communities cry and rage expressed in the past few days saying it has gone too far.

The point where you actualy rescrict good citizens of the city of steam. From using your service because the are too poor to use or own a smartphone. Is disgusting uncalled for, unwarranted behaviour.

So where do we go from here?

Lets analyse and look at the problems here folks.

• Accounts are getting hacked Left Right and Centre
  
• Theft is being commited and being profitable
  
• People are angry because they are locked out of market "For their own good".
  
• The scams, scams, hacks are still getting worse.
  
• People are tired of being FORCED to eat massive shovels of "SECURITY"
  
• You and your customers are being hurt and burned financially by these occurences.

I hope thats all we really need to talk about. But for now those are the issues on my mind.
And probably 90% of your community, THAT in its own right makes it your very massive own problem.

Its time you learned that you are not in this alone steam. We are your customers.
We want to be able to go about our business not worrying about these things.
But if you are going to, for the lack of a better word, nuke yourself. to stop bad things happening.

I can not allow to let this go further without the people having a say in what is going on.
DO NOT BE AFRAID TO ASK YOUR OWN PEOPLE FOR HELP.
Its not a sign of weakness. Its a sign of trust.

And you do not trust us at the moment. Hence we are offended.
You basicly came out and told us we are all stupid. And we should all be told how to do things.

For a part this is true, there are a lot of stupid people arround. But that doesn't mean we shoot them all dead for the cleansing of the human race. No, what you do is TOLERATE them. And work arround the issue.

Lets look at sollutions as a community.

I believe a lot of us deserve the right as a long time paying customer to have the benefit of a doubt. Sure there are some bad apples but thats in any community.

Lets look together for sollutions here. Pro's and Cons.
Lets go all out and talk about this, fix this, disease, this tained cursed cancer in our mids.
And work on it together.

Accounts are getting hacked Left Right and Centre

Yes they are, just like any e-mail service, like any video service, and practically any service on the internet. Someone somewhere is getting hacked.

But why? Lets think about this for a minute.

In the last 12 years of steam usage I have never been hacked. And why is that?
Lets see here:
-I never made extremely public posts that will get everyone angry.(Untill now)
-I have never shared my password
-I have never clicked on a link even from a friend untill confirming that they are infact in the know of who I am so that I can know the link is safe. With keywords and certain fact chasing.
If the other person doesn't know who I am or what i'm doing. They are hacked. And that link is poison.
-I have never clicked on false e-mails pretending to be steam.
-I have never accepted friend requests from players I do not know.Or I haven't played with first.
-I have made use, (admittedly against my will) of steam guard. AND ENJOYED its safety.
-My steam inventory has always been set private. (since the option has been there)
-I always sell any items of value the second I recieve them.

What I am trying to get at here, is I am a cautious person. Not everyone is like me.
I am an exception and not the rule but these are things people should be advised doing to prevent being hacked in the first place.

Steam Guard was a correct descision. It made life easier & safer.
So instead people are going after e-mail accounts.

They are LESS secure. SO you thought to yourself. The safer bet, that also banks use in many cases is "Phone Authorisation". To that I say yes. And I say NOOOOOOO.

It is true that your two-factor authorsiation is usefull. Secure. And safe.
It doesn't work for ALL your customers. So you decided to sacrifce the few, for the many.
But ultimately unacceptable. You can not shoot the fat kid in the leg so he will get eaten first.
Thats just not okay.

Although you have a point at making e-mail not the main point of trade controle.
I as a denied user of the phone method can tell you right now. Your verification e-mail sucks.
For the market that is, it doesn't actualy do anything but send me back to the steam page without me logged in causing me to be super suspicious and wanting to back off.

So how do we solve the issue?

Well you can't base it on already having access to the account. (A hacker would then have complete controle.)
You can't base it on e-mail for its easily hacked if the owner is stupid or not tech savy.
You can't base it on a pc because they are easily "infected" and used to break in.
You can't base it on a smart phone because not everyone is able or willing to own them.
You won't base it on letters, (too many, too much work).
You can't use some sort of weird double password combo.
You shouldn't leave it as it is.

What can you do? I invite everyone else to help out come up with something.
But if I can express my own opinion as a security standard.

Go back to the e-mails OR mobile auth. (Do not force the auth upon us.)
Force changes to the account to be verified by e-mail.
Force changes to the e-mail or security settings to be checked by e-mail.
Use a password login. With a "secret word / sentance" that you do not ask back entirely but instead request a return of 3 or 4 specific characters of the word / sentance, with a dropdown selection. (This prevents any type of software that specifcly registers keys (and thereby e-mails the victims password))
Keep steamguard. Please for the love of god, it annoys us but IT IS HELPFULL AND GOOD.
And OPTIONALLY phone verification via text or Molbile Auth.

This way, you have a quite good security. But I have to adress the part of the peole getting hacked now.

IF YOU ARE HACKED IT IS YOUR OWN FAULT. I know a lot of you will be angry at me for saying this. But it does not make it any less true.
Let me explain though before you crucify me on a desolate mountain.

Most hacking of your accounts occurs by a failure to use steamguard or secure your own e-mail account.

The most common error with e-mail security are the following:
-Small, insecure or possibly "whitty" password.
-Passwords based on ANY personal information be it based on your date of birth, dog name, whatever.
-Secret Question is your enemy, it is basicly a secondary password.

Before I continue let me explain that last one.
80% of all hacked e-mail accounts are hacked by finding the secret answer and then asking the staff of the site (hotmail, gmail, ...) to reset the password and send the new one out to the hacker.
My secret question may be "what is the name of the first school you went to." But I can assure you my answer is a random generated highly encrypted 200 character code.
Even I don't know it, it sits on a seperate air safe drive I guard with a sniper rifle.

Seriously NEVER answer a secret question correctly. (Facebook will make it easy for them)
And treat it like a password you NEVER have to type again.
In needed BASH YOUR KEYBOARD 200 times. And press enter.

Carrying on with my list.
-Social media is your enemy if you use a weak password. Never post anything on facebook or twitter about whatever thing you used as a password. Have a dog and use its name as a password? NEVER MENTION IT ONLINE. NOT ON TWITTER, NOT ON FACEBOOK, NOT ON FORUMS, NOT ANYWHERE.
-Hacked accounts are often altered to add extra security restoration to a new e-mail. Allowing them to easily get in again whenever needed. After being hacked, always check your security settings and clear out whatever they did.

The point is, TAKE CARE OF YOUR E-MAIL AND SECURE IT LIKE ITS A GOLDMINE.
Because your e-mail is your access point to all of the internet to any site that requires a login.
IT IS OF GREAT VALUE TO HACKERS. SO ALWAYS TAKE THE BEST MEASURES.

And my last point on this subject. Something I know alot of you personally never bother.
If you are hacked, PLEASE report it to the local law authority AKA police.
Countries arround the globe are instating internet crime units with their own job, to investigate crimes of hacking and virutal theft.

If you are a victim, tell your police. They will not visibly help off the bat. Tracking, tracing, hunting criminals, gathering evidence TAKES TIME.
But trust me. You will be saving someone else ultimately from the shame that is, a hacked account.

Theft is being commited and being profitable

Here we go again.
Theft is the problem here.
How do we stop this from being profitable?

I will give you an idea or two here steam.

How about you do this:
When an item is sold. It can not be traded for 15 days. (So it can be recovered and slow stolen itmes being passed along.)
When an item is sold. It can not be marketed again for 7 days.(Prevent pawing, can be recovered)
When an item is traded it can not be retraded for 7 days.(Prevents passing along quickly)
When an item is recieved initially it becomes untradeable for a day. Unmarketable for 3 or 7 days.(I mean like CS:GO drops, card drops, gifts)
All of these are negated by mobile authenticator. And e-mail verfication is not required.
BUT e-mail notficication is ALWAYS given. So it can be undone.

This way people can still participate. And theft is slowed, if not simply reversable. It gives you more than a month to read the e-mail saying "your stuff is being stolen" And to stop, or even after the 15 days reverse the process.

Also these are assuming you remove the trade holds. Please. ;)
This way, you customers will no longer be angry about the holds, and you can still reverse the thefts.

In the case the stolen items do make their way to innocent people. Consider this. Allow the person to keep the item. But STRIP it from the ability to be marketed or traded and its value.

This will make it a PERSONAL item to that ACCOUNT. And in essence stops your theft issues in its entirety. It there is a claim of theft. This will give you many avenues of FIXING the issue without punnishing all of us.

Again I would like to ask everyone. Please if you feel you can think of other sollutions post, and tell steam all about it in this topic.

People are angry because they are locked out of market "For their own good".

You can not, tell people you are refusing to serve them because its for their own good.
Its cliche, overdone and frankly insulting.

If you implement some of the ideas in the last topic. Above this one, people would not be angry. Note this. They are not angry about the added layer of security. (Some are though because exclusion is forcing them to not be allowed to participate.) But mainly the thing people hate, is the fact you are HOLDING their trades basicly FREEZING their accounts to a standstill as they can not sell items anymore.

Aswell as this, ask anyone who dables in markets and high level economy.
Or rather ask yourself.
Is it okay to force someone to wait 15 days, with cripling anxiety that the price may go down by even a cent. Making your product posting in vain because no one will buy your stupid (after 15 days) "too pricy 14 cents item" when the day before "14 cents for the item" was a perfectly good low price.

No it isen't. You are phyicly maiming some people with that behaviour.
You wouldn't tell a stock broker they would have to wait 15 days to buy the cheap stock.
It would have gone up by then. And money will be lost. Law suits set in motion. It is not acceptable.

Seriously. Remove the holds, add time limiters restricting the rapid movement of items.
Its okay, you are trying to slow things down giving you more time to find and stop offers and stolen items. This is okay. But don't force us to wait a month of our lives to sell a stupid 3 cents item of which you only let us keep 1 cent. It isen't even worth the electricity spend on the action. You adding more layers of work, is adding insult to injury.

The scams, scams, hacks are still getting worse.

People clicking links, being stupid and not verifying your friend is really himself. Bad.
People logging into websites with steam api or not to "try lotteries for free steam stuff." Bad.
People entering prize draws on steam or websites claiming to work with steam. Bad

What do we see here? Stupidity. Or should I say naive false sense of security.
PEOPLE. STOP CLICKING ON LINKS WITHOUT CONFIRMING YOUR FRIEND IS DEFINITELY 100% YOUR FRIEND AND IS THERE.

If you recieve a friend request of someone you do not know. DO NOT ACCEPT.
If you recieve a link from a friend, no text, no explanation, or even poor explanation. DO NOT CLICK, seriously. Ask the friend; "What is my real name." or anything of a sort that they can not find our from your steam profile. If they don't answer correctly and prove they are them.
DO NOT CLICK IT AND REPORT THE HACKED ACCOUNT RIGHT THEN AND THERE.

If you go on a website telling you "enter in on a prize draw" "log in to steam via steam api" WALK AWAY, THEY ARE ALL SCAMS. You people should know better by now.

If you go on a website telling you "skins for skins", a website telling you "booster service" or anything litterally not steam. You are most likely being scammed. And then hacked.
NEVER LOG IN AN UNTRUSTWORTHY WEBSITE WITH YOUR STEAM PASSWORD.
NEVER USE THE SAME PASSWORD FOR DIFFERENT SERVICES (like e-mail & steam).

Stop click, start checking. The internet is not real life.
If your friend walks up to you in real life, you can trust them, and their links.
On the internet. You can not see the face behind the text. ALWAYS ASSUME THEY ARE NOT THEM UNTILL THEY STATE THINGS THAT IDENTIFY THEM TO YOU AS "YOUR FRIEND"

Otherwise you will be hacked. By clicking on malicious links.

I could raise the other points on my list. But they are all contained in this post already.
And it is already WAY TOO LONG.

It makes me sad I had to do this, it makes me sad we are being punished for not doing anything wrong.
It makes me sad you people just can't get along.

My fellow steam users. And my good friends of steam support. My lovely admins from the steam community. And my love the man himself, Gabe.

Please. Get along. Converse in this topic. How you feel things should and could be.
Please to the information provided inside. Secure your e-mails. Secure your accounts.
Steam. Fix the holds please.

I bid you all a farwell and hope to play games with you all soon.
I had hoped to avoid drama's like these. But sometimes you have to stand up for your fellow man and say. You are all wrong. Stop shouting. Shut your faces and get along.

We are all in this together.
Lets figure it out as a community.

Steam. I ask of you only that you take our suggestions and considerations seriously.
From your main man.
DT, with love to everyone on steam.
I am out of here before anyone starts shouting at me.

[Shion]

Nothing to shout at you for. All what you said is correct. I had this account for 7 years. There were few times when hackers tried to pass me and .src file (basically an executable, trojan, masked as a picture), but none of them succeeded.

Most popular email services already do provide 2-step authorsiation. So forcing people to install crappy app, that is basically a mobile web browser, is not a security improvement but a security hole. And those mobile codes, they are calculated locally, so steam basically gave out their generation algorythm to hackers, and that is another security hole. Maybe steam actually wants for hackers to succeed? Because, no matter how you look at it, "for your own good" doesn't explain anything.

[Darren]

Apparently you don't know how 2FA works. The security codes are ALWAYS generated locally.

They are a combination of the local time and a shared secret number which only you and Steam have.

Without that shared number there is no way to use the algorithm to generate the correct code.

And before you say X authenticator doesn't work like that they ALL use the same implementation. The only difference between Steam and Google is they do 1 more step to turn a 6-8 digit number to 5 alphanumeric characters. Thats it. You do that step on what the Google Authenticator gives you (with the appropriate shared secret) and you would get the same result.

[Discussions_Acc]

Originally posted by DeathTech:

I myself have been part of steam pretty much as soon as the original half-life came out.

You were part of Steam 5 years before it even existed? Wow.

Originally posted by DeathTech:

Accounts are getting hacked Left Right and Centre

Ok, I'll stop reading now as you clearly not know what you're talking about.

[DeathTech]

Originally posted by Discussions_Acc:

Originally posted by DeathTech:

I myself have been part of steam pretty much as soon as the original half-life came out.

You were part of Steam 5 years before it even existed? Wow.

Originally posted by DeathTech:

Accounts are getting hacked Left Right and Centre

Ok, I'll stop reading now as you clearly not know what you're talking about.

1. as soon as the steam platform came out, changed my wording, hope your happy.

2. 77000 is not nothing, if that number is "low" by your standards then you have issues

Originally posted by Darren:

Apparently you don't know how 2FA works.

Never said I did. Just said I don't use authenticators.

[boxanata]

Originally posted by DeathTech:

Accounts are getting hacked Left Right and Centre

Originally posted by DeathTech:

2. 77000 is not nothing, if that number is "low" by your standards then you have issues

The are not being hacked, they are being phished.

[laff]

You say the security measures are over-bearing, yet you say accounts getting compromised is a big problem.

Sure, it could be done with an SMS service instead of a smartphone app, but it's not really like you're losing any worthwhile features. Trading worthless digital items wasn't even a thing until recently and it's not like you can't do it anymore with the current security measures.

You just wrote a lot, I don't really see any evidence for these wild claims while you speak for 90% of the Steam user base and claim we're all offended as if that supports any argument.

Is it okay to force someone to wait 15 days, with cripling anxiety that the price may go down by even a cent. Making your product posting in vain because no one will buy your stupid (after 15 days) "too pricy 14 cents item" when the day before "14 cents for the item" was a perfectly good low price.

No it isen't. You are phyicly maiming some people with that behaviour.

Are you seriously claiming some digital item which is worth less than a quarter is maiming people because the price can fluctuate by a penny?

[Deadsin]

I agree with you 100%.

[DeathTech]

Originally posted by laff □:

You say the security measures are over-bearing, yet you say accounts getting compromised is a big problem.

Yes, for me they are over-bearing. But for people who are less security conscious it is a huge problem.

Originally posted by laff □:

it's not really like you're losing any worthwhile features

Maybe not the most worthwhile but it means the occasional free game over lengthy periods of time.

Originally posted by laff □:

it's not like you can't do it anymore with the current security measures

Actually thats exactly what I am saying. I can not sell my items anymore because of these new security features. I Don't generally bother anyways but sometimes I get the odd 1 pound worth item. And that does cover the cost of power to sell. But still. I can't anymore due to these changes.

Originally posted by laff □:

while you speak for 90% of the Steam user base

I speak for myself, and every cringy anger filled post recently popping up comlaining about it.
Which seemingly are lots, not just on steam but other sites aswell.
I am known to overexagerate percentages. Although the 90% I mention is the percentage of people who have been locked out. Not 90% Of all steam users.

Originally posted by laff □:

I don't really see any evidence for these wild claims and claim we're all offended as if that supports any argument.

I for one am offended, some people who aren't using steam mobile auth are offended.
People who don't like to hear they require a mobile to use a PC program properly. Are offended.
Who is claiming alot of people getting hacked? I got that from steam themselves.
Where did I get the number from? Steam.
Where did I get the reason for these changes from? Steam
Who is saying they are doing this because the hackers / phishers what ever you want to call them? Steam
Who loses money to the blocking people out of market? Steam & Some legit users
What wild accusations? Honnestly, steams words and claims. I am just replying to them.

Originally posted by laff □:

Are you seriously claiming some digital item which is worth less than a quarter is maiming people because the price can fluctuate by a penny?

When you are talking about high value items who can have price fluctuations daily. Yes, yes I am. If I was a stock broken and they tried to pull this on the stock market. I would have a mental breakdown and probably throw myself off a bridge.

Sure it isen't that bad in most cases. But most people feel pretty horrible after losing the opportunity to make some easy case. And steam gets a cut anyways.

And it does phsyically maim people. Just the other day I got so stressed trying to sell a stupid 14 cent box that I fisted the wall. Out of stress. With these new measures. And had to go calm down and simply realise its not possible for me at the moment to sell stuff.




It would be apreciated if those who do manage to stomach my bad writing to atleast give some suggestions or alternatives. I mean you bothered to read it. Might aswell waste some more minutes actually thinking about helping with the comeupance of ideas. Rather than the nitpicking at exact words.

I am not trying to insinuate that I speak for all. Or that I have the sollution.
I am asking everyone. To help sort our community out. And find a way people don't need to get rolled over because some malicious individuals steal things.

I will try to change wordings here and there to clarify my intent better however my raging autism and dyslexic horde of typo's certainly don't help me get my point across.

[76561198001062896]

problem here is the following

phishing, as long as people are guillible will happen. No matter how many guidelines you make, no matter how many guides is published about this, no matter how much we scream at people not to fall for such because it will still happen.


only solution to radically stop these issues would be to remove the market and skins being tradable completely, basically cutting any incentive for scammers. But at this point its safe to say that its not an option.

[DeathTech]

Originally posted by Zetikla:

problem here is the following

phishing, as long as people are guillible will happen. No matter how many guidelines you make, no matter how many guides is published about this, no matter how much we scream at people not to fall for such because it will still happen.


only solution to radically stop these issues would be to remove the market and skins being tradable completely, basically cutting any incentive for scammers. But at this point its safe to say that its not an option.

I would agree. There is too much invested now to just remove the market & trade.
And gulible people will be gullible.

Thats why I suggested different strategies that don't lock people out. But instead slow down the trade for people unwilling or unable to be more secure.

Aswell as a strategy plan that would make the damage more controllable for steam.
My problem is their current strategy is forcing some players not to be able to participate.
While the focus should be to slow things down to a standard that makes it easier for them to recover the stolen goods.

[Τhe Rolling Cheese Wheel]

Why not a simple solution. If you as much as contact Valve about getting phished, all your future trades will suffer a 15 day cool down or require an authenticator. Seperate the dumbs from the intelligent users is the best solution. Other intelligent users will be free to trade without any cooldown or restrictions, or authentications.

This is how all security systems should work. At risk users will have be forced to turn on maximum security to use the system while other users can use the system with 0 inconveniences attached.

[DeathTech]

Originally posted by Zetikla:

problem here is the following
only solution to radically stop these issues would be to remove the market and skins being tradable completely, basically cutting any incentive for scammers. But at this point its safe to say that its not an option.

I agree. It would be a way to allow normal usage to continue and those who can't take care cautiously of their account to be "protected for their own good" in a more acceptable way.

[SniperWolfMGS]

Originally posted by Τhe Rolling Cheese Wheel:

Why not a simple solution. If you as much as contact Valve about getting phished, all your future trades will suffer a 15 day cool down or require an authenticator. Seperate the dumbs from the intelligent users is the best solution. Other intelligent users will be free to trade without any cooldown or restrictions, or authentications.

This is how all security systems should work. At risk users will have be forced to turn on maximum security to use the system while other users can use the system with 0 inconveniences attached.

Accept.... now you have created a "Haves and Have Nots" scenario. And all of those people who do have to have the max security are now madnat steam and all of those who dont have any security. And a ton more people complaining.

The fact of the matter is: The average Steam user is an IDIOT!
They can't even manage to use a search function before posting a new thread about something that has been discussed a thousand times over.

Before any of steam's security measures it went a little something like "Hey want a free knife? All i need is your log in info and ill trade it over." "OKAY!!!!!!1" and five minutes later "Steam support, how can i help you?" "My account got hijacked and all my items are gone!Give me back my items plz!plz!plz!"

So a 2 step is added now you have the same idiots giving out their login and email login and now they have 2 compromised accounts and they are still complaining about how they lost their inventories and that steam's security suxxorz...

This is the best option. If someone tries to log into your account, your phone spits out a code. If its not you, you can change your password. Done. If you dont have a smart phone and somone logs into your account, you have a grace period to get your account back and cancel all those trades you didn't authorize. Your stuff is safe! How on earth is that punishing you for being poor?

FYI You can buy basic smartphone without service for super cheap and leave it next to your computer on wifi and have an authenticator....

[DeathTech]

Originally posted by SniperWolfMGS:

Accept.... now you have created a "Haves and Have Nots" scenario. And all of those people who do have to have the max security are now madnat steam and all of those who dont have any security. And a ton more people complaining.

Yeah. I agree that it may make people mad. But you could have it slowly lower over time.
Not be a permanent thing.

Honnestly I think anyone who realy lost items to this should really be forced to use the authenticator. But I don't think I should suffer 15 day trade holds, let alone I can't even authenticate any sales anymore at all because of this.

Originally posted by SniperWolfMGS:

FYI You can buy basic smartphone without service for super cheap and leave it next to your computer on wifi and have an authenticator....

So I am supposed to buy a phone I don't want.
Just to use a regular steam function?

I do not want a mobile phone. The idea of phones is something I dispise.
I don't need them. Nor want them. The idea of spending any amount of money to buy a physical tool to allow me to do something simple.

Thats just too far.
And yes, I am that cheap. Or that poor.
We are talking a person so cheap. They will randomly awarded stuff to avoid spending money to buy a 1 pound game.

[Yuuta]

Originally posted by DeathTech:

But you could have it slowly lower over time.
Not be a permanent thing.

Okay. Let's say, it will slowly lower over time. Like, minus 1 day a week (just for example). In this way in 14 weeks users will have no escrow at all. Everyone is happy and stuff.
But hackers aren't stupid and they sure can read the news. So they will know the escrow is getting lower over time. They will just wait 14 weeks and boom. New wave of hijacking. And everyone will lose their items in a day, because hey they have no escrow just like they've asked. Well, of course not everyone, but probably a huge amount of users. And escrow becomes useless.

Originally posted by DeathTech:

Honnestly I think anyone who realy lost items to this should really be forced to use the authenticator.

Do you think it's the same 77,000 guys getting compromised every month over and over again? Don't you think some of these people (and we don't know how many of them) are new and have never lost their items before? Don't you think some of them just like you thought that they are smart enough to not lose their account?

Originally posted by DeathTech:

And yes, I am that cheap. Or that poor.

You have money to buy so many games though.