Steam Automation needs client confirmation dialogue

[Trondheim]

As there seems to be an increasing number of people using automations systems like java to fleece Steam Users then I would say that there needs to be a steam dialogue popup to confirm that the user is actually aware that steam is doing something automatically.

I understand that steam want to make things easier for third party retailers like HumbleBundle for instance but with the increasing number of people wanting to attack steam users then there needs to be some confirmation that the user actually wants the automation to act on their account.

See http://www.bbc.co.uk/news/technology-29177284 for the twitch steam issue, I would say that that all the alterations made should have verification to confirm that the user is allowing the site to alter their account

[Black Blade]

As much as i understand its not something that works much from sites, but after it ask for your Email and Name it ask you to download something that is the malware that dose all these automaton part

Its not something done on the site it self, so or i miss understand you
Or i really cant see how its connected to what is going on humble bundle and all that

Edit-Add

Just wanted to add i think its better to link to the page that says more then less
http://www.f-secure.com/weblog/archives/00002742.html

[aiusepsi]

Code running on your computer can do anything you can do. That's the root of the problem.if you can verify an action, malicious code running on your computer can verify an action for you.

In many cases these sorts of programs use a third-party reimplementation of the Steam client which talks directly to the Steam backend. That bypasses entirely any protections Valve could add to the client.

[Trondheim]

My point about Humblebundle was that there are "good" uses for automation, previously this service would obtain a code that would need to be entered manaually into the steam client to provide the games purchased however they changed this to a linking of your steam and humblebundle accounts to prevent people selling the codes on.

What f-secure seem to be saying is that the already authenticated machine and webclient are making changes via the steamcommunity web automation system. That there does exist "good" systems that interface with the steam service has resulted in people assuming that steam have made certain that this system cannot be abused.

As to "code running on your machine can do anything you can do" is true up to a point however services such as captcha make things much more difficult for the attacker by requiring much more complex code to emulate both the machine and the operator.

[Muppet among Puppets]

The file could be a remote access tool tomorrow.
So best suggestion:
Dont follow random links and their instructions.

[Web v1.0]

The latest insanity from F-Secure is that it considers the KBdarkside.exe to be a virus and tries to remove it.

[Trondheim]

It sounds like it was picked up via heuristic scan so whilst it might not be an official virus it might have more functionality than one would normally expect in a game.

It might just be copy protection like Sony's BMG see http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal or it might be writing to its own code.

I wrote some code that was marked as a virus one day and ignored the next, it happens sometimes to truely innocent code but once they see the binary then it doesnt take them long to choose which it is

[Tito Shivan]

When giving warnings, one treads a thin line between being useful and becoming annoying.
Warning about any automated process can really easy become annoying, people bypass and ignore it.
(How many people disable the Windows UAC warnings?)