Keep getting random Steam friend requests, action needed!

[Dunestorm]

Something seriously needs to be done, I think I've somehow been targeted by bots. I get a couple completely random friend requests a day which I have to manually ignore/block every time. I think it's time for recaptcha to be required in order to add friends to Steam or a way to appear completely invisible to people not already in your friends list.

PS. I have a very secure password and I don't really advertise my profile anywhere to anyone (it's set to private).

[hotdogPi]

You just posted here. Just be warned that you have an increased chance now.

[Gwarsbane]

Posting anywhere on the discussion areas will get you an increased number of bots trying to contact you.

Also if you post on any of the trade sites around you will get bots headed your way.


But just randomly bots will try to add you too. I know a few people that don't post anywhere on discussion area and don't do the trade sites and still get bot invites all the time.

[TirithRR]

Having a public inventory and using third party trading sites (the various "lounge" sites) drastically increases your bot spam.

[Dunestorm]

Publicado originalmente por Gwarsbane:

Posting anywhere on the discussion areas will get you an increased number of bots trying to contact you.

Also if you post on any of the trade sites around you will get bots headed your way.


But just randomly bots will try to add you too. I know a few people that don't post anywhere on discussion area and don't do the trade sites and still get bot invites all the time.

This doesn't invalidate my point though, it's far too easy to be attacked by bots. The only way to not be is to unplug the ethernet cable from your PC and play offline. I should be in control of whether people are able to even see my publicly...

[Dunestorm]

Publicado originalmente por TirithRR:

Having a public inventory and using third party trading sites (the various "lounge" sites) drastically increases your bot spam.

Everything on my profile is private other than a couple things only limited to my friends. Thanks, but I'd like to clarify I'm well aware of privacy precautions that I needed to take. It all doesn't work.

[Gwarsbane]

Publicado originalmente por Dunestorm:

This doesn't invalidate my point though, it's far too easy to be attacked by bots. The only way to not be is to unplug the ethernet cable from your PC and play offline. I should be in control of whether people are able to even see my publicly...

The only way to not be public on steam so that bots can't see you is to not be on steam at all. As I have said, they can still randomly add you via a brute force type where a list of steam account numbers are produced and tell the bots to go down the list one by one and try to add the person.

I have made a few suggestions to steam about how they could make it so that people could control who can contact them or not. But its still not 100% cause all the bot users have to do is get their bots up above the minimum levels but doing that would be very expensive.

Here is a thread I started a while back that I keep trying to bring up with hope that someone at valve will at least consider. Again its not perfect, but at least it gives more control into the users hands and would make things far more expensive for bot users.

http://steamcommunity.com/groups/SteamClientBeta/discussions/1/35222218908404417/

[Dunestorm]

Publicado originalmente por Gwarsbane:

Publicado originalmente por Dunestorm:

This doesn't invalidate my point though, it's far too easy to be attacked by bots. The only way to not be is to unplug the ethernet cable from your PC and play offline. I should be in control of whether people are able to even see my publicly...

The only way to not be public on steam so that bots can't see you is to not be on steam at all. As I have said, they can still randomly add you via a brute force type where a list of steam account numbers are produced and tell the bots to go down the list one by one and try to add the person.

I have made a few suggestions to steam about how they could make it so that people could control who can contact them or not. But its still not 100% cause all the bot users have to do is get their bots up above the minimum levels but doing that would be very expensive.

Here is a thread I started a while back that I keep trying to bring up with hope that someone at valve will at least consider. Again its not perfect, but at least it gives more control into the users hands and would make things far more expensive for bot users.

http://steamcommunity.com/groups/SteamClientBeta/discussions/1/35222218908404417/

Yes, this is exactly the sort of thing we need! We should have far more control over what types of users are able to see us. We can't completely stop bots, but Valve are capable of putting restrictions in place so you can't just type someone's name and be guaranteed to appear on a friend's list.

Definitely think there should be some sort of human verification before you're allowed to add people though, this has already been added to trading.

[Gwarsbane]

You don't seem to understand how the automated adding system for bots work. They are not going though a steam page to get there.

A list of numbers is generated like this....

1234567890
1234567891
1234567892
1234567893
1234567894
1234567895
1234567896
1234567897
1234567898

And so on. The bot is coded to read a line of text and added to a profile link so that it loads up the page for the profile.

So for example sets lets say your profile id number is 1234567892
The bot is told to get the first number
1234567890
It ads it to the profile link and gets
http://steamcommunity.com/profiles/1234567890
Then the coding tells the bot to load the page and look for error messages
Error message found, it now goes to the next one...
1234567891
it loads up http://steamcommunity.com/profiles/1234567891
gets an error message
it loads up http://steamcommunity.com/profiles/1234567892
It doesn't get an error message. Code for the bot now tells it to load the code for adding the account as a friend.
It sends the code and you get added. It then waits to get added to start spamming.

Its all automated and there is very little valve can do to stop all that automation because none of it happens on their end.

Though I suppose they could limit the amount of friend requests sent out by any one account to maybe 20 or 30 a day at max as I don't think there is any human out there that needs to add that many people each day.

Again they can slow it down, but they can never really stop it as long as its possible to add other people to your friends account and trade stuff with them.


As to the human verification, thats already been bypassed by bots. Same with the CAPTCHAs that came just before it. The only thing CAPTCHAs and e-mail verifications is doing is annoying humans.


Basically you have to make stuff that stops bots but lets humans keep going without them even noticing. Its not easy to do that. The suggestions I made, again would make things more expensive for bot owners, and would be a little annoying for people, but generally most wouldn't even notice the restrictions.

The limit on how many people you can add a day is something again I doubt any actual human would notice.

[Scotty]

Also a thread posted on a possible solution already on Suggestions/Ideas to fix it: Auto Block Friendship Requests Based On Certain Criteria
Valve already knows that this is becoming a problem and are probably already looking into it so hopefully they can fix it soon.

[Twi]

Weird, I never get them.

[Scotty]

Publicado originalmente por ZapperBullet:

Weird, I never get them.

These bots are typically targeting people who play CS:GO, Dota 2 and, maybe TF2 players although I'm not 100% sure on TF2.

[Hagger]

I never had them until today. Got two random invites in a row.

[Twi]

Publicado originalmente por Zero:

Publicado originalmente por ZapperBullet:

Weird, I never get them.

These bots are typically targeting people who play CS:GO, Dota 2 and, maybe TF2 players although I'm not 100% sure on TF2.

Lucky me, the only one i got is tf2.

[Tito Shivan]

Publicado originalmente por Gwarsbane:

You don't seem to understand how the automated adding system for bots work. They are not going though a steam page to get there.

But they are.
Ask users who post trades on ♥♥♥♥♥♥♥♥♥♥ what happens after posting a trade there. They get a swarm in invites every time they post or bump a trade.

No need for random generating URLs when you have a list from a third party site (which mean they're users with items) or on a Steam Group member list.

[Gwarsbane]

Publicado originalmente por Tito Shivan:

But they are.
Ask users who post trades on ♥♥♥♥♥♥♥♥♥♥ what happens after posting a trade there. They get a swarm in invites every time they post or bump a trade.

No need for random generating URLs when you have a list from a third party site (which mean they're users with items) or on a Steam Group member list.

And your point? I don't post in the trade groups and don't bump trades and stuff like this, and I still get them. Why because they do have the random adds like I said, but they also add people from popular trade areas like the counter strike, DOTA2 and TF2 discussion/trade areas of the steam forums. They also add them from 3rd party sites.

Again unless you actually get rid of your steam account, you are gonna get a phishing bot invite. Even with all the things I have suggested and seen suggested its not going to stop them 100%.

I'm not saying the bots are 100% from random created stuff, I'm just saying that they don't actually need to go through a steam page and steam software to find and add someone. As long as you have a steam account they can add you.