10 ms·

I keep being somewhat baffled by Steam's login process every time I'm forced to go through it. Apparently Steam is such a cesspool of (pre)pubescent teenagers,

by aasasd 6y ago

I keep being somewhat baffled by Steam's login process every time I'm forced to go through it. Apparently Steam is such a cesspool of (pre)pubescent teenagers, with rampant account hacking and theft of funds, swag or whatever, that they feel the need to fortify the process if only to make it more inconvenient for the hackers. - “Remember the password” barely ever works, even on desktop. Since I don't quite log in every day due to being too old for that, I have to redo the process every time—on a machine that I bought with my own money just for myself and intend to protect with both technical means and physical force. - Somehow copy-pasting passwords from KeepassX/XC doesn't work on Mac, with the shortcut. Not sure if this is a misfeature of Steam, but I have to paste the password to an editor first and then copy out of there into Steam. (Seems though that ‘paste’ in the context menu does work—this might've changed since I first noticed the issue.) - And of course, the weird variation on 2fa, via email, instead of the good regular TOTP. As is tradition by now, I'm also given the choice of installing yet another app on the phone, which somehow doesn't quite seem to serve my interest.

Nullabillity 6y ago
FWIW, the app uses a variant of TOTP. Some TOTP apps (including one for Yubikeys[0]) support generating them if asked to. [0]: https://github.com/Yubico/yubioath-desktop/issues/72 https://github.com/Yubico/yubioath-desktop/issues/72
blackearl 6y ago
How often are you logging into Steam? The app stays logged in for me pretty much forever
- dfabulich 6y ago
  I have the same issue. On Mac, I log in to Steam about once a week (sometimes longer than that). I have to login with my password and get a Steam code almost every time.
  - dkersten 6y ago
    Huh strange. I’ve used steam on windows, Mac and Linux over the years and with different frequencies of use and still only ever have to manually log in once every few months.
  - kbenson 6y ago
    Does the Mac version of Steam install through the Mac App store (or is it offered there), and does that store also have the webview restrictions? If that's the case, I'm wondering if that's triggering them to use web login methods, and while I haven't logged into steam on the desktop again since I installed it on this new one ~6 months ago, I have to log into the website and get a code almost every time I want to do something there, so I wonder if the Mac version of Steam is somehow under the web based login restrictions.
    - Wowfunhappy 6y ago
      > Does the Mac version of Steam install through the Mac App store It does not, and I can't see it ever being allowed there. It's quite literally an alternate app store!
      - kbenson 6y ago
        LOL, that's true. I wasn't even thinking of what Steam does, and was just considering it's authentication mechanism. Doubly silly of me, since I'm definitely interested and following to some degree the Epic lawsuit.
    - dfabulich 6y ago
      The website definitely has a crazy short session length (it can't be more than 48 hours, probably substantially less). I do login to the website more often than I do the native Steam app, typically to wishlist games that I see linked from other web sites. I wonder if logging into the website invalidates all of my sessions after however many hours.
    - deleted 6y ago
      [deleted]
- _jal 6y ago
  I stopped using Steam because it was too annoying. Not sure what all they get up to for their anticheat crap, but something I do with my network/machine apparently sets them off. Fighting with bullshit like this is not what I'm looking for when I want a game, so screw it, if a game needs Steam, I don't need the game.
- ehsankia 6y ago
  It's not an issue with the app, it's in the browser only. I like using the browser for browsing since tab support is better, bookmarking and also extensions such as Steam Enhanced.
mhh__ 6y ago
My steam account is worth more than my computer, I'm quite happy that it's hard to steal. I also don't have to log in every time I use it, that's not a steam-problem.
- Aardwolf 6y ago
  One issue: if you lose access to your email, you also lose access to your worthy steam account, since it emails a code every time
  - wnevets 6y ago
    Doesn't the steam mobile app provide access codes?
    - elliottcarlson 6y ago
      It does
      - Aardwolf 6y ago
        How does that one authenticate itself then? (NOTE: I didn't even know the PC gaming service steam had a mobile app ;))
        wnevets 6y ago
        Well in the scenario where you lose access to your email address you would theoretically still have access to your phone with the steam app already installed and authenticated
        deleted 6y ago
        [deleted]
        stevewodil 6y ago
        For me, when I download Steam Authenticator it's tied to my phone number so the first time I login it will send me a text message code, and then from there it generates the authenticator codes in app
devrand 6y ago
I think they restrict the 2FA methods since they want tighter control over them. For example, if you use their Steam app for 2FA and you need to move it to a new phone your account gets put into a restricted mode and you cannot use the Community Market for 15 days. This restriction also gets applied to any item you touch, so if you trade an item to someone else, the store restriction moves with the item. They also strong-arm you into using the app. If you log into a new device (or Steam thinks it's a new device since you cleared cookies) and you don't use their app for 2FA, then the device will not be able to trade or use the market for 7 days. They only waive this restriction if you use their app for 2FA and it has been active for at least 7 days. It's a bit frustrating since the Community Market/Trading is likely only used by a minority of users, but seemingly a ton of login limitations are imposed because of it.
- Kaze404 6y ago
  > It's a bit frustrating since the Community Market/Trading is likely only used by a minority of users, but seemingly a ton of login limitations are imposed because of it. It's probably because it moves a significant amount of money, between trading cards, CSGO knives, TF2 hats, etc. Of course, nothing comparable to banking systems and general-purpose marketplaces, but I personally think those protections only add to the product.
  - aasasd 6y ago
    > Of course, nothing comparable to banking systems and general-purpose marketplaces Rumor is, some MMO games have markets exceeding GDPs of plenty of first-world countries, and ingame items are used by gangs to move funds across borders. Both Cory Doctorow and Neil Stephenson wrote books featuring this phenomenon, and I'm pretty sure they both usually take their ideas from reality. Since Steam is a Big Guy, and its market is dedicated to this very activity and sits on top of many games at once, I'd guess it to have a sizeable slice.
    - Kaze404 6y ago
      Wow, that sounds like an interesting read. I'll see if I can track one of those books down, thanks!
birdyrooster 6y ago
I had to remove and reinstall Steam to get my auto login working again
nonsince 6y ago
I lost my password, access to my email address and all information that could have been used to identify me like my paypal account. This was somewhere around 2017. It took 2 emails to get them to transfer my account to my new email address and reset my password.
- dkersten 6y ago
  Did they ask for much to verify it was yours? Given what you said, I guess not?
  - utf_8x 6y ago
    Here's my experience with recovering a Steam account. Some time before I lost access to my Steam account, I bought Portal 2 for the PS3 which included an activation code to get the PC version on steam for free. When I asked Steam support to help me regain access, they asked me to write a specific thing on the flyer with the activation code, scan it and send that in to verify It's my account. After that they helped me recover the account.
    - dkersten 6y ago
      That actually seems like a pretty reasonable solution, in your particular case.
eat_veggies 6y ago
It's a weird variant of TOTP, but you have to be rooted or modify the app in order to extract the secret to use with other apps. Years ago I wrote a script to do it, but I'm not sure if it still works -- it's not really worth doing imo https://github.com/steamguard-totp/steamguard-shared-secret https://github.com/steamguard-totp/steamguard-shared-secret
- jannes 6y ago
  Unfortunately, you can't use Steam Guard without a phone number.
- MayeulC 6y ago
  The issue is that the app uses a custom protocol to confirm Steam community transactions (Steam inventory trades, etc). So if you use an authenticator like AndOTP, you lose the ability to confirm those. I reverted to e-mail. I only have free software on my phone, and don't regret that choice.
Kaze404 6y ago
I'm not sure what you mean by auto-login not working. I've had my Steam account for 11 years and I can remember a time where that was the case, but it works so reliably nowadays I didn't even remember it was an issue until reading your comment.
- mrlala 6y ago
  Yeah exactly, I have steam on 5 computers at home here between kids and myself that are used all the time.. rarely is anything logged out unexpectedly.
- Wowfunhappy 6y ago
  How often do you log in? My experience is that a lot of this stuff works really well if you're using Steam regularly, and completely falls apart if you use it once a month.
  - Kaze404 6y ago
    Interesting. I definitely log in daily, I have Steam set to auto-launch because of Remote Play.
  - e_proxus 6y ago
    It also logs you out as soon as you enable a VPN connection (to a different cpuntey/IP?) while running.
- ehsankia 6y ago
  I'm 90% sure it's a account-based bug. My account has had this issue for ~6 years now (I've used steam for 15 years). It happens on any browser or device. No cookie clearing, doesn't happen to any other account, etc. Every time I bring it up, the majority of people say they don't have an issue, while a small handful of others chime in about experiencing it too. It has to be a bug, or maybe a security feature for accounts of a certain size?
  - chupasaurus 6y ago
aimor 6y ago
“Remember the password” barely ever works This has been my experience too. I still check the box every time I log in.
leokennis 6y ago
Actually, when using Steam on macOS, it feels like traveling back to 2005. I like Steam, it’s convenient and it works, but I don’t think “being ahead of the curve” is in their dictionary.
kamyarg 6y ago
Download the mobile app, they have an option to enable OTP pushes, when I login my phone gets the code directly in notifications. I also was annoyed by email code thingy until I found this recently.
jonathanlydall 6y ago
Compromising of game accounts with real world monetary value is very much an industry, one with competition, customer service, supply chains, etc. Source: I used to do customer service for Blizzard and a large part of our work was dealing with accounts compromised by gold sellers.
thedmstdmstdmst 6y ago
Valve introduced Steam and it's security by Gabe announcing his login and password to the world. You couldn't get in though precisely because of the 2FA. This was a LONG time ago when things being secure on the internet wasn't a given to most people.
zepearl 6y ago
> “Remember the password” barely ever works, even on desktop. It happens to me only when I keep switching machines (sometimes I play on Linux, sometimes on Windows) => I guess that it's some kind of security check. If I stick all the time to a single machine then I basically never have to re-login (if I don't stop playing for something like 1 month or longer).
ehsankia 6y ago
> “Remember the password” barely ever works, even on desktop Is that for browser or client? I had issue with the browser for the past 6 or so years. Every time I bring it up, a few others mention having this issue but not everyone. I think it's an account based issue since it happens on any device I use. It only happens with Steam and no other site.
pugworthy 6y ago
As others have said, the value of accounts can be very high. Mine's that way, not just for the games on it, but for its age.

by aasasd 6y ago

Nullabillity 6y ago

FWIW, the app uses a variant of TOTP. Some TOTP apps (including one for Yubikeys[0]) support generating them if asked to. [0]: https://github.com/Yubico/yubioath-desktop/issues/72 https://github.com/Yubico/yubioath-desktop/issues/72

blackearl 6y ago

How often are you logging into Steam? The app stays logged in for me pretty much forever

dfabulich 6y ago
I have the same issue. On Mac, I log in to Steam about once a week (sometimes longer than that). I have to login with my password and get a Steam code almost every time.
- dkersten 6y ago
  Huh strange. I’ve used steam on windows, Mac and Linux over the years and with different frequencies of use and still only ever have to manually log in once every few months.
- kbenson 6y ago
  Does the Mac version of Steam install through the Mac App store (or is it offered there), and does that store also have the webview restrictions? If that's the case, I'm wondering if that's triggering them to use web login methods, and while I haven't logged into steam on the desktop again since I installed it on this new one ~6 months ago, I have to log into the website and get a code almost every time I want to do something there, so I wonder if the Mac version of Steam is somehow under the web based login restrictions.
  - Wowfunhappy 6y ago
    > Does the Mac version of Steam install through the Mac App store It does not, and I can't see it ever being allowed there. It's quite literally an alternate app store!
    - kbenson 6y ago
      LOL, that's true. I wasn't even thinking of what Steam does, and was just considering it's authentication mechanism. Doubly silly of me, since I'm definitely interested and following to some degree the Epic lawsuit.
  - dfabulich 6y ago
    The website definitely has a crazy short session length (it can't be more than 48 hours, probably substantially less). I do login to the website more often than I do the native Steam app, typically to wishlist games that I see linked from other web sites. I wonder if logging into the website invalidates all of my sessions after however many hours.
  - deleted 6y ago
    [deleted]
_jal 6y ago
I stopped using Steam because it was too annoying. Not sure what all they get up to for their anticheat crap, but something I do with my network/machine apparently sets them off. Fighting with bullshit like this is not what I'm looking for when I want a game, so screw it, if a game needs Steam, I don't need the game.
ehsankia 6y ago
It's not an issue with the app, it's in the browser only. I like using the browser for browsing since tab support is better, bookmarking and also extensions such as Steam Enhanced.

mhh__ 6y ago

My steam account is worth more than my computer, I'm quite happy that it's hard to steal. I also don't have to log in every time I use it, that's not a steam-problem.

Aardwolf 6y ago
One issue: if you lose access to your email, you also lose access to your worthy steam account, since it emails a code every time
- wnevets 6y ago
  Doesn't the steam mobile app provide access codes?
  - elliottcarlson 6y ago
    It does
    - Aardwolf 6y ago
      How does that one authenticate itself then? (NOTE: I didn't even know the PC gaming service steam had a mobile app ;))
      - wnevets 6y ago
        Well in the scenario where you lose access to your email address you would theoretically still have access to your phone with the steam app already installed and authenticated
        deleted 6y ago
        [deleted]
      - stevewodil 6y ago
        For me, when I download Steam Authenticator it's tied to my phone number so the first time I login it will send me a text message code, and then from there it generates the authenticator codes in app

devrand 6y ago

I think they restrict the 2FA methods since they want tighter control over them. For example, if you use their Steam app for 2FA and you need to move it to a new phone your account gets put into a restricted mode and you cannot use the Community Market for 15 days. This restriction also gets applied to any item you touch, so if you trade an item to someone else, the store restriction moves with the item. They also strong-arm you into using the app. If you log into a new device (or Steam thinks it's a new device since you cleared cookies) and you don't use their app for 2FA, then the device will not be able to trade or use the market for 7 days. They only waive this restriction if you use their app for 2FA and it has been active for at least 7 days. It's a bit frustrating since the Community Market/Trading is likely only used by a minority of users, but seemingly a ton of login limitations are imposed because of it.

Kaze404 6y ago
> It's a bit frustrating since the Community Market/Trading is likely only used by a minority of users, but seemingly a ton of login limitations are imposed because of it. It's probably because it moves a significant amount of money, between trading cards, CSGO knives, TF2 hats, etc. Of course, nothing comparable to banking systems and general-purpose marketplaces, but I personally think those protections only add to the product.
- aasasd 6y ago
  > Of course, nothing comparable to banking systems and general-purpose marketplaces Rumor is, some MMO games have markets exceeding GDPs of plenty of first-world countries, and ingame items are used by gangs to move funds across borders. Both Cory Doctorow and Neil Stephenson wrote books featuring this phenomenon, and I'm pretty sure they both usually take their ideas from reality. Since Steam is a Big Guy, and its market is dedicated to this very activity and sits on top of many games at once, I'd guess it to have a sizeable slice.
  - Kaze404 6y ago
    Wow, that sounds like an interesting read. I'll see if I can track one of those books down, thanks!

birdyrooster 6y ago

I had to remove and reinstall Steam to get my auto login working again

nonsince 6y ago

I lost my password, access to my email address and all information that could have been used to identify me like my paypal account. This was somewhere around 2017. It took 2 emails to get them to transfer my account to my new email address and reset my password.

dkersten 6y ago
Did they ask for much to verify it was yours? Given what you said, I guess not?
- utf_8x 6y ago
  Here's my experience with recovering a Steam account. Some time before I lost access to my Steam account, I bought Portal 2 for the PS3 which included an activation code to get the PC version on steam for free. When I asked Steam support to help me regain access, they asked me to write a specific thing on the flyer with the activation code, scan it and send that in to verify It's my account. After that they helped me recover the account.
  - dkersten 6y ago
    That actually seems like a pretty reasonable solution, in your particular case.

eat_veggies 6y ago

It's a weird variant of TOTP, but you have to be rooted or modify the app in order to extract the secret to use with other apps. Years ago I wrote a script to do it, but I'm not sure if it still works -- it's not really worth doing imo https://github.com/steamguard-totp/steamguard-shared-secret https://github.com/steamguard-totp/steamguard-shared-secret

jannes 6y ago
Unfortunately, you can't use Steam Guard without a phone number.
MayeulC 6y ago
The issue is that the app uses a custom protocol to confirm Steam community transactions (Steam inventory trades, etc). So if you use an authenticator like AndOTP, you lose the ability to confirm those. I reverted to e-mail. I only have free software on my phone, and don't regret that choice.

Kaze404 6y ago

I'm not sure what you mean by auto-login not working. I've had my Steam account for 11 years and I can remember a time where that was the case, but it works so reliably nowadays I didn't even remember it was an issue until reading your comment.

mrlala 6y ago
Yeah exactly, I have steam on 5 computers at home here between kids and myself that are used all the time.. rarely is anything logged out unexpectedly.
Wowfunhappy 6y ago
How often do you log in? My experience is that a lot of this stuff works really well if you're using Steam regularly, and completely falls apart if you use it once a month.
- Kaze404 6y ago
  Interesting. I definitely log in daily, I have Steam set to auto-launch because of Remote Play.
- e_proxus 6y ago
  It also logs you out as soon as you enable a VPN connection (to a different cpuntey/IP?) while running.
ehsankia 6y ago
I'm 90% sure it's a account-based bug. My account has had this issue for ~6 years now (I've used steam for 15 years). It happens on any browser or device. No cookie clearing, doesn't happen to any other account, etc. Every time I bring it up, the majority of people say they don't have an issue, while a small handful of others chime in about experiencing it too. It has to be a bug, or maybe a security feature for accounts of a certain size?
- chupasaurus 6y ago

aimor 6y ago

“Remember the password” barely ever works This has been my experience too. I still check the box every time I log in.

leokennis 6y ago

Actually, when using Steam on macOS, it feels like traveling back to 2005. I like Steam, it’s convenient and it works, but I don’t think “being ahead of the curve” is in their dictionary.

kamyarg 6y ago

Download the mobile app, they have an option to enable OTP pushes, when I login my phone gets the code directly in notifications. I also was annoyed by email code thingy until I found this recently.

jonathanlydall 6y ago

Compromising of game accounts with real world monetary value is very much an industry, one with competition, customer service, supply chains, etc. Source: I used to do customer service for Blizzard and a large part of our work was dealing with accounts compromised by gold sellers.

thedmstdmstdmst 6y ago

Valve introduced Steam and it's security by Gabe announcing his login and password to the world. You couldn't get in though precisely because of the 2FA. This was a LONG time ago when things being secure on the internet wasn't a given to most people.

zepearl 6y ago

> “Remember the password” barely ever works, even on desktop. It happens to me only when I keep switching machines (sometimes I play on Linux, sometimes on Windows) => I guess that it's some kind of security check. If I stick all the time to a single machine then I basically never have to re-login (if I don't stop playing for something like 1 month or longer).

ehsankia 6y ago

> “Remember the password” barely ever works, even on desktop Is that for browser or client? I had issue with the browser for the past 6 or so years. Every time I bring it up, a few others mention having this issue but not everyone. I think it's an account based issue since it happens on any device I use. It only happens with Steam and no other site.

pugworthy 6y ago

As others have said, the value of accounts can be very high. Mine's that way, not just for the games on it, but for its age.