App bypasses steam guard?

[Harryoe]

You can log into your account and gain access to your account without 2fa (you don't need a steam guard code). This seems like a major security problem- Or am I missing something?

[Frugl]

You are logging in from the app that can already give you the steam guard code.

[Г]

it's still bypassing a second factor: you can now log into a steam account solely with a "something you have" factor, the phone with the steam app logged in, no need for a "something you know" factor, a traditional password. it is, in fact, a major security downgrade, and one you should be able to turn off somehow.

[Matri Dunadan]

Originally posted by Г:

it's still bypassing a second factor: you can now log into a steam account solely with a "something you have" factor, the phone with the steam app logged in, no need for a "something you know" factor, a traditional password. it is, in fact, a major security downgrade, and one you should be able to turn off somehow.

Agreed. This is a HUGE security risk. Anyone who has your phone can INSTANTLY access your Steam account.

At least with the previous code method they still need your password, so losing your phone isn’t a huge risk.

[Drunken F00l]

The app knows the codes and will automatically provide them during the login process. The old app did the same.

edit: I thought y'all were talking about how you can login to the app itself without providing any 2fa

[Matri Dunadan]

Originally posted by Drunken F00l:

The app knows the codes and will automatically provide them during the login process. The old app did the same.

Codes are no longer needed, since whoever stole the phone can just scan the QR to login, since the app can no longer logout.

Meaning the phone thief doesn’t even need the login details or password.

And since they now have access to your account on the PC, they can change the password, registered email, registered phone number, security questions & answers, refresh & invalidate the Recovery Codes, literally everything needed in order to recover our account is invalidated.

[Lighthouse]

Originally posted by Drunken F00l:

The app knows the codes and will automatically provide them during the login process. The old app did the same.

Originally posted by Matri Dunadan:

Originally posted by Drunken F00l:

The app knows the codes and will automatically provide them during the login process. The old app did the same.

Codes are no longer needed, since whoever stole the phone can just scan the QR to login, since the app can no longer logout.

Meaning the phone thief doesn’t even need the login details or password.

And since they now have access to your account on the PC, they can change the password, registered email, registered phone number, security questions & answers, refresh & invalidate the Recovery Codes, literally everything needed in order to recover our account is invalidated.

This is a simple fix. All they need to do is make it so that they need to enter the Family Share code to enter the QR Code Scanner/Authenticator.

And if they forget their Family Share Code, steam support can be more than happy to help them out.

[Matri Dunadan]

Originally posted by Furry Femboy:

This is a simple fix. All they need to do is make it so that they need to enter the Family Share code to enter the QR Code Scanner/Authenticator.

And if they forget their Family Share Code, steam support can be more than happy to help them out.

Or! Just allow us to log out, which disables the QR scanner, but retain the code generator, just like in the old app.

This way, 2-Factor is preserved, since it requires both the password and the code to login.

[Lighthouse]

Originally posted by Matri Dunadan:

Or! Just allow us to log out, which disables the QR scanner, but retain the code generator, just like in the old app.

This way, 2-Factor is preserved, since it requires both the password and the code to login.

Valid point.
I think they are trying to add in QR scanning for some reason, maybe to keep up with standards of the modern way?

[cSg|mc-Hotsauce]

Originally posted by Furry Femboy:

Valid point.
I think they are trying to add in QR scanning for some reason, maybe to keep up with standards of the modern way?

People have asked for it for years.

[Lighthouse]

Are they going to fix this problem because now im starting to get a little anxiety from it..

[Matri Dunadan]

At this point the 2FA code generator is superfluous. Using the QR scanner is only available while logged into the app, and it instantly bypasses 2FA.

And if the 2FA code generator only works while logged in, what even is the point when the QR scanner is right there?

[FAT CONTROLLER]

Originally posted by Matri Dunadan:

At this point the 2FA code generator is superfluous. Using the QR scanner is only available while logged into the app, and it instantly bypasses 2FA.

And if the 2FA code generator only works while logged in, what even is the point when the QR scanner is right there?

Exactly, the code generator might as well be removed at this point. It serves ZERO purposes while we are forced to stay logged in and forced to use QR code.

[Varpie]

Originally posted by Matri Dunadan:

Originally posted by Furry Femboy:

This is a simple fix. All they need to do is make it so that they need to enter the Family Share code to enter the QR Code Scanner/Authenticator.

And if they forget their Family Share Code, steam support can be more than happy to help them out.

Or! Just allow us to log out, which disables the QR scanner, but retain the code generator, just like in the old app.

This way, 2-Factor is preserved, since it requires both the password and the code to login.

Another option would be to use biometrics to secure the new "Steam Guard" (or, simply, to the app, since having access to the store with no extra security is already not great). That way, it would still be 2FA: what you have (the phone) and what you are (biometrics).

[rvcjew]

The old logged out method was great and had a easy to use widget as well. The qr code should be behind the os built in biometrics at least or your password if it is needed. Either way it needs to be a choice.

[zaphodikus]

The way the first time after updating it takes you to the guard tab, that looks like a login tab is terrible OOB design. The first time after upgrade please after logging in DO NOT TAKE ME TO STEAM GUARD tab, take us to a "thank you for logging in" message. It's the right thing to do to prevent panic. Yes I know we have multiple accounts support now. But a clear indication that they have completed the challenge prevents heart failure. (Althogh the jumpy scrolling is giving me seizure, so there is that)

Yes I know its hard to please everyone all the time. But the default tab was just a bad default. Change it.