I made a post on reddit about a Steam security design flaw I have found, and guess what... - Page 1

Nov. 28, 2015, 5 p.m.

I really don't know what will happen to normal Trading after December 9...

Nov. 28, 2015, 5:08 p.m.

I really don't know what will happen to normal Trading after December 9...

We already have developed an auto system of setting up Steam guard mobile authenticator and submitting the codes when needed. I believe dispenser.tf will be unaffected. However if there is unexpected change from Steam after Dec.9, we may need to suspend service until we have found workarounds for the new problems. But the part about setting up authenticator and submitting the code, is not a problem.

Rock

Nov. 28, 2015, 7:51 p.m.

Hi Joto,

1) Does "service suspension" means we won't be able to access our gifts and pull them back to local account if needed?
2) Market trades will be fine, but how will the old style trades be handled in case the buyer has no mobile auth enabled? (For example, trade offer was sent out, the buyer excepts and the items get put on hold. What happens if he cancels later, obviously the items will be returned back to bot inventory, but will they be resynched with the bot owner admin interface as well or put back into the trade automatically? Or will there be a (configurable?) requirement that buyer must have mobile auth enabled?)

Thanks

Joto

Nov. 29, 2015, 8:37 a.m. (Last edited by Joto on Nov. 29, 2015, 8:38 a.m.)

1) Yes. However it probably won't happen. We have almost already re-logged-in all bots with authenticator. Unless they pull out another change after Dec.9, everything should work out fine.

2) We cannot work out a solution on this before we do not know exactly how trading will work after Dec.9. We need to see how Steam is going to handle cancelled trades before we adapt the changes here. Preferably we want every users to enable authenticator on their side so that no escrow is needed.

\\ Damrew´s //

Nov. 29, 2015, 10:05 a.m. (Last edited by \\ Damrew´s // on Nov. 29, 2015, 10:48 a.m.)

I really don't know what will happen to normal Trading after December 9...

" Can I share my phone number between multiple accounts?
Yes. You may use the same phone number on multiple accounts. You may enable Steam Guard Mobile Authenticator on multiple accounts on the same phone by logging in to each account within the app and following the procedure to enable the authenticator on each account. The app will provide codes for all accounts regardless of which account is currently logged in to the app. Accounts with the same phone number may be treated as the same identity with respect to the Steam Subscriber Agreement, policies, or restrictions. "

all bots use same number? if one bot sell revocked games and steam ban this bot all bots can have ban?

and +1 in all your comments

FreqNasty

Nov. 29, 2015, 10:08 a.m. (Last edited by FreqNasty on Nov. 29, 2015, 10:09 a.m.)

nvm

Joto

Nov. 29, 2015, 1:43 p.m.

I really don't know what will happen to normal Trading after December 9...

No, we remove all numbers after setting up the mobile authenticator.

\\ Damrew´s //

Nov. 29, 2015, 2:03 p.m. (Last edited by \\ Damrew´s // on Nov. 29, 2015, 2:05 p.m.)

No, we remove all numbers after setting up the mobile authenticator.

then those bots that steal accounts can also use a similar system, this valve protection measure is absurd, and probably steam harden more the escrow feature

🎮 PalkoVvodets 🔑

Dec. 2, 2015, 2:38 p.m.

No, we remove all numbers after setting up the mobile authenticator.

What do you mean? Did you remove steam app from mobile device after setted it enabled? Then you cant verify every your enter to steam acc as steam FAQ says
Or you enable and after disable mobile auth? Then it a huge hole at steam security, maked this issue useless versus steal-bots.
Or something else?

Edward

Dec. 2, 2015, 2:56 p.m.

This is really not needed from Valve / Steam, they're just slowing down trades nothing more or improved security is being done.

Edward

Dec. 2, 2015, 3:41 p.m.

@Joto; And what about when someone declines / cancels a Trade Offer? Then the Bot will be on Trade Restriction for some time? How's this gonna be fixed then?

Joto

Dec. 2, 2015, 5:34 p.m.

@Joto; And what about when someone declines / cancels a Trade Offer? Then the Bot will be on Trade Restriction for some time? How's this gonna be fixed then?

After Dec.9 we should take down side 1-2 days and test these things, to be better prepared for all kind of situations. At this moment I cannot tell because there is no way to test.

Joto

Dec. 2, 2015, 5:35 p.m.

No, we remove all numbers after setting up the mobile authenticator.

We remove the phone number on the Steam profile, not the mobile app.

🎮 PalkoVvodets 🔑

Dec. 2, 2015, 7:04 p.m. (Last edited by 🎮 PalkoVvodets 🔑 on Dec. 2, 2015, 9:57 p.m.)

We remove the phone number on the Steam profile, not the mobile app.

Just wonder - by your opinion:
1) Only sms-device(phone number) added to acc is enough to pass through 3 days block?
Note: I read all steam links and FAQ about this 3 days block. And there was nothing strict confirms that added phone number solve trade block. But for "Mobile Authenticator" (which always mentioned with mobile app) it was.
2) Add to and then remove from acc your phone number will not return back 3 days block? I mean its logically to give 3 days restriction to acc if phone number removed, cuase it is key of this innovation like "have phone nuber - have free trade". No?

(the opinion of Steam we all will learn at 9 dec)

P.S. Its not about trust or not for your moves. Just trying to gather all info which could help all of us.

Edward

Dec. 2, 2015, 7:31 p.m. (Last edited by Edward on Dec. 2, 2015, 7:37 p.m.)

What about people who won't have this Mobile Authentication Enabled and will troll others with Sending Offers and declining or canceling? So this way everybody can go on a Trade Restriction, what did Steam done with this?