Require 2FA on Community Transactions

[D. Flame]

2 many people are getting hacked and having their funds or items cleaned out when they session ID token gets stolen, because buying and selling on the community market does not require a 2FA.

Having to do a 2FA when someone tries to buy your item would be annoying because of time zones and people keeping different hours, so instead have the 2FA prompt appear for the seller at the time of listing, rather than at the time of purchase.

Having to do 2FA for each individual item would be annoying when purchasing or selling a large amount of items. Instead let players maintain a cart. Then let them list/purchase that cart all at once, and only require, the 2FA per cart, rather than per item.

This way, even if someone's login gets compromised, they do not immediately lose their inventory, since the bad actor would still need a new 2FA prompt to make a purchase or a sale.

And have the 2FA prompt show what it is for, such as "Approval Listing 13 items on Community Market," "Purchase Item from Community Market for $69."

[Nx Machina]

Accounts on Steam are PHISHED not hacked because the end user gave away all their account details.

The account name, the password and the KEY to the door, the Steam Guard Mobile code, or scanning the QR code or authorising via fingerprint giving them access to the account.

How? by either logging into a known scam site or sites, tailored malware on your PC, the vote for my team scam, you have a pending ban scam on Discord, free knife click the link, signing in through a fake login window etc.

How does Steam (a program) know it is not you when all the account details are correct? It doesn't, therefore any action taken on your account is seen as you doing said actions.

The alternative is not plausible:

1) Someone would have to "GUESS" your account name from "millions of possible combinations".

2) Next they would have to "GUESS" your password from "millions of possible combinations" and then match it to your account name with "millions of possible combinations".

3) And finally they would have to "GUESS" the Steam Guard Mobile code "which changes every 30 seconds" to match both your account name and password to then have access your account.

The weakest link is the end user, not the security offered.

[Ettanin]

Annoying and still subject to phishing.

An API bot will still intercept the so-called cart and manipulate it before re-issuing the trade. Thenafter, will wait for confirmation on the tampered-with trade.

The attack will still work because people will be too lazy to scrutinize the stuff they need to give approval for, out of tireness, feeling nagged or being under rush.

[76561198407601200]

Originally posted by Nx Machina:

Accounts on Steam are PHISHED not hacked because the end user gave away all their account details.

The account name, the password and the KEY to the door, the Steam Guard Mobile code, or scanning the QR code or authorising via fingerprint giving them access to the account.

How? by either logging into a known scam site or sites, tailored malware on your PC, the vote for my team scam, you have a pending ban scam on Discord, free knife click the link, signing in through a fake login window etc.

How does Steam (a program) know it is not you when all the account details are correct? It doesn't, therefore any action taken on your account is seen as you doing said actions.

The alternative is not plausible:

1) Someone would have to "GUESS" your account name from "millions of possible combinations".

2) Next they would have to "GUESS" your password from "millions of possible combinations" and then match it to your account name with "millions of possible combinations".

3) And finally they would have to "GUESS" the Steam Guard Mobile code "which changes every 30 seconds" to match both your account name and password to then have access your account.

The weakest link is the end user, not the security offered.

They've been whistling the same tune for years, I wouldn't anticipate something other than what has already been said. This and that, that and this.

[William Shakesman]

Scammers could easily mock up a fake "Your 2FA code was incorrect please try again" mockup. That said, having 2FA show the action you are approving at least addresses the problem which is more than most suggestions, or other posts in this thread really, do.

[Brian9824]

People already complain about the security as is, there comes a point where making it difficult for the 99% of your users who don't get phished to help the 1% that do get phished does more harm then good to the platform in general.

Security is a balancing act between being too lackadaisical and too restrictive. The overwhelming majority of users we see get hacked on the forum did not have their session id token's stolen, it came from plain old phishing.

[cSg|mc-Hotsauce]

The cs float extension that people use is just as bad as inventory helper...

https://bo3.gg/news/steam-security-risk-csfloat-extension-update-steam-cookies-access

https://www.reddit.com/r/GlobalOffensive/comments/70xofs/warning_trusted_steam_inventory_helper_now/

When you give away all those permissions, you are asking for trouble.

[Crazy Tiger]

Originally posted by Ettanin:

The attack will still work because people will be too lazy to scrutinize the stuff they need to give approval for, out of tireness, feeling nagged or being under rush.

Yeah, that's the thing. People don't check the info properly when trading. That won't change at all with OP's suggestion.

[Amaterasu]

Originally posted by Crazy Tiger:

Originally posted by Ettanin:

The attack will still work because people will be too lazy to scrutinize the stuff they need to give approval for, out of tireness, feeling nagged or being under rush.

Yeah, that's the thing. People don't check the info properly when trading. That won't change at all with OP's suggestion.

I mean you could literally have your url say thisisascamthatwillstealyoursteaminformation as part of the URL and you'll still catch at least 30 people

[DCey]

Someone just used my steam wallet balance to buy dota 2 stuff and sell lots of my old CSGO skins ... I never played dota 2 and stopped CSGO years ago .. on top of that all my friends list and chat are gone .... What can I do ?

I have zero infection on my PC/phone, just checked, I even verified my authorized devices ..nothing unusual, my PC and phones are listed, how .. is this possible ???

[D. Flame]

Originally posted by Nx Machina:

Accounts on Steam are PHISHED not hacked because the end user gave away all their account details.

Just because you keep parroting this, it doesn't make it true.

https://www.pcmag.com/news/did-you-download-this-steam-game-sorry-its-windows-malware

- February 12, 2025

Did You Download This Steam Game? Sorry, It's Windows Malware

The free-to-play game, PirateFi, infects users with malware that steals browser cookies, enabling the malware’s creator to hijack access to various online accounts.

[William Shakesman]

Originally posted by Crazy Tiger:

Originally posted by Ettanin:

The attack will still work because people will be too lazy to scrutinize the stuff they need to give approval for, out of tireness, feeling nagged or being under rush.

Yeah, that's the thing. People don't check the info properly when trading. That won't change at all with OP's suggestion.

I agree. A big warning is reliably ignored by users and thus not sufficient for any sort of sense of security and I agree doubly with you that as a result the Early Access program must be removed.

[D. Flame]

Originally posted by William Shakesman:

Originally posted by Crazy Tiger:

Yeah, that's the thing. People don't check the info properly when trading. That won't change at all with OP's suggestion.

I agree. A big warning is reliably ignored by users and thus not sufficient for any sort of sense of security and I agree doubly with you that as a result the Early Access program must be removed.

"Maybe they still wouldn't check it," is not a valid excuse when people are actively being hacked.

[Ben Lubar]

Originally posted by D. Flame:

Originally posted by Nx Machina:

Accounts on Steam are PHISHED not hacked because the end user gave away all their account details.

Just because you keep parroting this, it doesn't make it true.

https://www.pcmag.com/news/did-you-download-this-steam-game-sorry-its-windows-malware

- February 12, 2025

Did You Download This Steam Game? Sorry, It's Windows Malware

The free-to-play game, PirateFi, infects users with malware that steals browser cookies, enabling the malware’s creator to hijack access to various online accounts.

That game had a lifetime peak player count of... five.

[Amaterasu]

Originally posted by Ben Lubar:

Originally posted by D. Flame:

Just because you keep parroting this, it doesn't make it true.

https://www.pcmag.com/news/did-you-download-this-steam-game-sorry-its-windows-malware

- February 12, 2025

That game had a lifetime peak player count of... five.

Also

What people think of being hacked is someone pressing a button and all of the sudden, your computer and everything is theirs. If I was a hacker, and I wanted access to something you had, the last thing I'd be trying to hack into is your steam account to go around and buy and trade things. That's too much effort for too little gain even if it would be an effective method of money laundering. Except in order to properly money launder, the person would have their stuff back and had made a net zero in terms of financial change.

Hacking is not like in Hollywood where you just randomly type keys on your keyboard and all of the sudden, you have full access to someone's Steam account. In fact, no hacker worth a damn would target your steam account and start trading your stuff away. They'd target your payment information or your bank account. Steam Store Credit is worthless, meaning it would be a lot of effort for absolutely no gain.

So no, people don't get hacked. They trust things they shouldn't trust, refuse to do the most basic of cyber security, refuse to even let Windows Defender do its job and then complain that someone else gained access to their account.