Steam is kinda weak on security

[LusciousWeeb]

So, my friend got hacked many times, and the hacker somehow got into his steam mobile auth and stole his items, and lets just say that getting hacked like that MULTIPLE times is proving something
also, I've been hacked before out of the blue, c'mon valve, fix this bullcrap, my friend is now gone because he is sick of losing his ♥♥♥♥ all the time. This is one of many major issues that this platform has.

[BossGalaga]

Цитата допису Satoru:

Цитата допису Mae Borovski:

Why everyone believes that steam securities is fine?

Because there's no indication that anything is wrong

If there was a security issue on Steam, why would hackers use it on nonsense accounts that have no value. Why would someone waste that on an account with no value, rather than attack say you knwo like a famous streamer? or one of the bots of a trading site? Or like gabe? Such an exploit would be worth a TON of money on the open market. Yet somehow they're using it on rando accounts with negligible value

^^

There's two common factors in nearly all of these "hacks." Greed and gullibility, on the user's end.

[Tito Shivan]

Цитата допису CJ HUNTER:

I don't get it how it's not cool to get into a van with a man that gives you ice cream, but it is very ok to enter sensitive information on any url over the internet.

It's not that hard to guess. Using the internet usually provides a false sense of security.

People use the internet while inside of their home, where we feel safe, confident and secure. It's easier to make mistakes when you feel relaxed and confident, doing it in slippers and a hot cup of cocoa. You're not going to get mugged while inside of your locked home.

It's the same mental process that makes us pick up our noses while inside our cars at a traffic light, despite being surrounded by glass and at everyone's view. The inside of the car is processed as a 'safe space' so people do what they'd do at these spaces, despite being in plain view of everyone.

Цитата допису Satoru:

It likely they were just SteamAPI scammed anyway

That would easily explain the 'repeatedly part' OP's friend should revoke any issued API key before trying to secure his account.

Цитата допису BossGalaga:

There's two common factors in nearly all of these "hacks." Greed and gullibility, on the user's end.

Hacks also rely on fear and authority in order to work. It's not always someone offering dollars for pennies. Sometimes it's a "Steam Admin" warning about how your account with +100 games is going to be banned or how you were reported for a scam trade and going to get your items removed... The key part of every scam is forcing the user to make decissions under pressure (You're going to get banned/miss this trade NOW unless you do X)

[Muppet among Puppets]

Цитата допису Tito Shivan:

Цитата допису BossGalaga:

There's two common factors in nearly all of these "hacks." Greed and gullibility, on the user's end.

Hacks also rely on fear and authority in order to work. It's not always someone offering dollars for pennies. Sometimes it's a "Steam Admin" warning about how your account with +100 games is going to be banned or how you were reported for a scam trade and going to get your items removed... The key part of every scam is forcing the user to make decissions under pressure (You're going to get banned/miss this trade NOW unless you do X)

"There is one rule. And it needs to be broken. There is one goal. And when you attain it, you...." (get scammed).
-The path-

[CJ HUNTER]

Цитата допису Tito Shivan:

Цитата допису CJ HUNTER:

I don't get it how it's not cool to get into a van with a man that gives you ice cream, but it is very ok to enter sensitive information on any url over the internet.

It's not that hard to guess. Using the internet usually provides a false sense of security.

People use the internet while inside of their home, where we feel safe, confident and secure. It's easier to make mistakes when you feel relaxed and confident, doing it in slippers and a hot cup of cocoa. You're not going to get mugged while inside of your locked home.

It's the same mental process that makes us pick up our noses while inside our cars at a traffic light, despite being surrounded by glass and at everyone's view. The inside of the car is processed as a 'safe space' so people do what they'd do at these spaces, despite being in plain view of everyone.

I couldn't agree more with this, you are right. Maybe they should do something about it and teach them in schools that the internet is a dangerous place and some basic stuff.

But as hard as you try, you can't teach common sense and the fact that nothing in life comes for free, you have to work for it.

[Seraphita]

Except from the fact we're not "home" on the internet. We travel elsewhere. Giving your info away is like going out of your home, knocking on a stranger's door and give them your bank info. You do not do that and therefore you should not do that online. Your home is your computer. Internet is you leaving your home to go elsewhere even if not physically. People NEED to be careful. >.>

[BORG]

I cannot disagree with this discussion topic to be honest. Valve's Steam security design definitely has it's inherent flaws and although generally it works OK, Valve and the community have gotten comfortable with the system and many insecurities of the system are being overlooked because of that comfortableness. We can't always blame the end user for everything. Valve really does need to step up their security by design. Steam needs a more intuitive security design and implementation and only Valve can do that.

Changing account information and credentials is simply too easy for an attacker. For example, changing e-mail, password and any other various account information is instant if they do manage to gain access to an account. There are no grace period of account modification or access limitations either and this only encourages attackers to compromise accounts. It's just too easy for them to compromise Steam accounts and get game bans, steal trade items, damage reputations and so on. Needless to say, the list is quite extensive. The security of Steam needs to be a lot better to protect its members better.

It is critical that Valve address this issue soon because there is a considerable voice going around regarding Valve's lacking Steam security. If things don't change, I suspect it's very possible Steam will lose a considerable amount of members in the coming years.

I really don't think Valve is going to want more reports land on the Better Business Bureau either. The complaints are stacking up and things already look bad enough as it is.

Here is the BBB web page: https://www.bbb.org/us/wa/bellevue/profile/online-gaming/valve-corporation-1296-27030704

Once security complaints start to roll out on the BBB, it's going to be pretty hard to reverse that F rating in the future. Trust is earned and seeing that is not very convincing that Valve has the consumer's best interest in mind. I encourage people to use the BBB website too, to review Valve whether it be positive or negative. Your voice needs to be heard and seen by the masses.

Hopefully Valve will take the security issues more seriously in the coming years. If not, people may have to consider taking their business to another platform in the not too distant future. That future is edging closer and closer too as other great platforms have emerged in the last several years. Several of those platforms are growing considerably fast too.

I am a concerned Steam member. It is my opinion that Valve needs to take these things more seriously to ensure the future sustainability and longevity of Steam as a software distribution platform and valve as a corporation.

[Muppet among Puppets]

You can choose the best passwords with steam.
You can add steam guard.
Your account name is not known.

Personally i dont know how to do it better.

People have to go out of their way to let someone in their account.

[cinedine]

Цитата допису BORG:

I really don't think Valve is going to want more reports land on the Better Business Bureau either. The complaints are stacking up and things already look bad enough as it is.

Valve literally doesn'T give a ♥♥♥♥ about the BBB.
If you look into the reports you will see that
(a) their F rating is soley because they don't bother to reply to the BBB reports
(b) most of the reports don't even have anything to do with Steam/Valve
(c) those that do are actually cases for their support which people didn't bother to use

Edit:

To entertain you:

first review:

I bought software from this company. Unbeknownst to me, the software had
issues that make it nearly unusable on modern computers. I spent several
hours researching the issues to find they are well documented and not
fixable. I requested a refund from Valve and they refused. Do not buy
software from this company.

- Not a Valve related issue

first viewable issue:

08/20/2018
I accidentally bought the wrong cards at ******** on Tuesday 8-14-18. I realized when I went home that these 3 $50 cards was the wrong cards. I went back to ******** on Wednesday 8-15-18 and they couldn't refund me my money back on to my credit card. They could figure out how to get a hold of the business for me so I tried,as well and i couldn't find a phone number or anything for this business. I just want my $ back on my credit card and to return these cards that I have no use for. I still have the receipt and I don't want to be down $150 because of a stupid mistake that I made.

- Not a Valve issue

[Muppet among Puppets]

I am sure someone mentioned the bbb when he found it stupid that you needed access to the old email to change the email.
Now someone comes mentioning the bbb because you dont need access to the old email to change the email......

[Winged One]

no company actually takes the BBB seriously anymore.. not after all the "hmm, if you donate some money to my kids college fund maybe I won't give you a bad rating" they have done over the years..

[Drab]

https://www.motherjones.com/politics/2010/07/hamas-gets-rating-bbb/

If you've given money to the BBB; you've been scammed.

[BORG]

It's just perspective view folks. I'm not trying to ruffle feathers, split hairs or create conflict of interests. I am just expressing my concerns as a Valve customer and Steam member. I don't expect everyone to agree or disagree. What I do expect is for people to consider the possibility that things could be done in a different way, to better Valve and Steam. I present information as I see it. I'm not here to debate it. The information is what it is - nothing more; nothing less.

All I ask is that people consider the notion of Valve stepping up security to make Steam better. There is always room for improvement in anything we create as imperfect human beings. Steam is no exception to imperfection.

[Winged One]

Цитата допису BORG:

It's just perspective view folks. I'm not trying to ruffle feathers, split hairs or create conflict of interests. I am just expressing my concerns as a Valve customer and Steam member. I don't expect everyone to agree or disagree. What I do expect is for people to consider the possibility that things could be done in a different way, to better Valve and Steam. I present information as I see it. I'm not here to debate it. The information is what it is - nothing more; nothing less.

All I ask is that people consider the notion of Valve stepping up security to make Steam better. There is always room for improvement in anything we create as imperfect human beings. Steam is no exception to imperfection.

and what do you expect them to do? Steam already has better security than all the other platforms (with the possible exception of battlenet)..


no amount of security will help when the person getting their account compromised did so by WILLINGLY giving away their info

[Muppet among Puppets]

If there were stories of people who lose their account without leaking details,
you would have a point.

[BORG]

I wish people could see things from a different and more open minded perspective on the entire situation. This is why having an opinion in the community is somewhat pointless. People become too defensive on subjects rather than brain storming ideas that can actually improve the entire platform of Steam. It's similar to being excessively fanatical of something. Anything that is imperfect can be improved upon. So, instead of being combative on the subject, why don't we brain storm ways Valve can better security? No security is perfect. Some are better than others, but there are always better ways to do things in an imperfect world.