So I was away from home for past weekend dealing with my father's passing. One evening as my brother and I were kicking back in the hotel room after a very stressful day, he called me over to look at an email he'd just gotten.

"Your Steam account: Access from new device"

His account had been accessed from an unknown location. The device used had also presented the correct password. SteamGuard had intercepted the login and emailed a confirmation code.

I asked him if his kids were savvy enough to set up Steam on their own computer at home using his login credentials. A quick call home confirmed no. None of the kids were even on the computer that afternoon.

My brother's password was not terribly secure (7 characters, most of which made up a word). Fortunately due to SteamGuard being turned on his account wasn't compromised.

Even if they had gotten in, his account has only a handful of games, no SteamWallet balance or credit card info, and he didn't do any kind of trading or marketplace activity. BUT, it would have been a pain in the ass to get it back. And in the meantime the hacker could have used the account to scam other people leaving my brother to be blamed.

So if you haven't done so already, turn on SteamGuard. It might just stop you from having a bad day... or worse.

Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”

Why passwords have never been weaker—and crackers have never been stronger

9 years ago*

Comment has been collapsed.

Thoughts?

View Results
Yay, account security!
<shrug>
wut? LOLZ tl;dr giv me steamgard game

Reserved

9 years ago
Permalink

Comment has been collapsed.

Hidden GA concluded. If you weren't expecting sneakiness, here's what you missed:

http://www.steamgifts.com/giveaway/eUZUH/contrast

9 years ago
Permalink

Comment has been collapsed.

But what was the sneak?? :p

9 years ago
Permalink

Comment has been collapsed.

Wave your cursor over the asterisk following the sentence, "... leaving my brother to be blamed."

Or just inspect the page source in the same spot.

9 years ago
Permalink

Comment has been collapsed.

Wow, no asterisk showed up on my page, but I see the anchor in the source. Weird.

9 years ago
Permalink

Comment has been collapsed.

Huh... OK I guess that makes sense. I was scratching my head trying to figure out how to make the asterisk not show up since it seemed too obvious. I guess it appears as a marker to the thread creator to show where the link is located and is invisible to everyone else.

9 years ago
Permalink

Comment has been collapsed.

my password: hillaryClintonIs100%Hot

9 years ago
Permalink

Comment has been collapsed.

would you please stop using my password

9 years ago
Permalink

Comment has been collapsed.

Jesus dude why so long?
I personally use 123456 as my password.

9 years ago
Permalink

Comment has been collapsed.

But how do you remember so many different characters? 11111 is just so much easier!

9 years ago
Permalink

Comment has been collapsed.

Its kinda hard I know... but sometimes i just leave a blank space as my password.

9 years ago
Permalink

Comment has been collapsed.

please, everyone knows that apassword is the most secure password.

9 years ago
Permalink

Comment has been collapsed.

That's the kind of thing an idiot would have on his luggage!

9 years ago
Permalink

Comment has been collapsed.

Its called security

9 years ago
Permalink

Comment has been collapsed.

hunter2

9 years ago
Permalink

Comment has been collapsed.

I only see ***
What did you type?

9 years ago
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 5 years ago.

9 years ago
Permalink

Comment has been collapsed.

pass: spankdatass

9 years ago
Permalink

Comment has been collapsed.

Took me a while, for some reason I read this as "spank data ss"

9 years ago
Permalink

Comment has been collapsed.

( ͡~ ͜ʖ ͡°)

9 years ago
Permalink

Comment has been collapsed.

I always have it on just in case, and to make it even more secure I activated Steamparental (blocking pretty much everything in case my e-mail is also compromised)

9 years ago
Permalink

Comment has been collapsed.

I don't even know why someone would decide to turn steamguard off o:

As far as I know you can't even use the market with it turned off, can you?

9 years ago
Permalink

Comment has been collapsed.

This. By default, SteamGuard is ON. Why some people turn it off? Don't know, maybe they are into "shaddy" things too.

9 years ago
Permalink

Comment has been collapsed.

It's not on by default. I know because I created a new account last week, and I couldn't use family sharing without setting up Steam Guard first.

9 years ago
Permalink

Comment has been collapsed.

I've never touched the Steam Guard settings and it has always been enabled by default for me.

9 years ago
Permalink

Comment has been collapsed.

steamguard + mobile security op, i will never deactivate it

9 years ago
Permalink

Comment has been collapsed.

steamguard = yes
7-days wait after steamguard activation = yes
market 7-days cooldown for new purchases = no
trade email confirmation = no
stupid more-expensive-than-$3-item market email confirmation = no

9 years ago
Permalink

Comment has been collapsed.

You do realise you can disable the trade email confirmation jazz, right?

9 years ago
Permalink

Comment has been collapsed.

the $3 item one?

9 years ago
Permalink

Comment has been collapsed.

Yeah u can disable that :)

9 years ago
Permalink

Comment has been collapsed.

oh, i didn't see that option :3 thanks!

9 years ago
Permalink

Comment has been collapsed.

it was added quite recently, when i found out about it i straightly disabled it. its soo annoying! even more than the trade offer one

9 years ago
Permalink

Comment has been collapsed.

I really don't know why anybody would want to turn it off to begin with.
I mean besides the obvious peg-legged one-eyed dubloon humpers...

9 years ago
Permalink

Comment has been collapsed.

I used to work in IT at an university while I was a student and you would not believe how easily accounts are compromised. Things like Steam Guard and mobile authentication are wonderful tools in preventing improper access, because so many users use weak, compromised, or simply the same password over and over.

9 years ago
Permalink

Comment has been collapsed.

Yep. Been there.

9 years ago
Permalink

Comment has been collapsed.

Dickhead users at my place of work will follow a link that gets emailed to them, see a web page that says "Please to be inserting your email address and password to be accessing the filez that you requested" and happily fill those details in.

You can't protect the truly stupid.

9 years ago
Permalink

Comment has been collapsed.

I personally use the Steam Authenticator from the steam app for android, it's basically the same deal, except you don't have to access your email every time.
Plus, if someone were to hack my email as well I'd have my account secured untill recovery.
Unless that someone also stole my phone ... nah, s/he'd probably never get past the lock screen.

9 years ago
Permalink

Comment has been collapsed.

Or iOS, this is the only reason I have the steam app. The rest of that app is pretty meh.

9 years ago
Permalink

Comment has been collapsed.

It seems you don't have very clear the definition of hacker....
Hacker is an expert in computer security.
People that steal accounts are not hackers, they are just asshole kids

9 years ago
Permalink

Comment has been collapsed.

Hacker is someone who can hack something, this includes people who hack good ol' console games to make them different, as well as those who go through data your keyboard sends to the computer to try to find and steal your password.

Neither of these require being a general expert of a computer, I am very good at the first one, but never tried the later.

9 years ago
Permalink

Comment has been collapsed.

No..... You are also confunsed... Damn TV
Hacker: Expert in computer security
Cracker: Person that crack computer programs or introduce trojans/virus in other computers
Phreaker: Expert in telephone systems
Carder: Person dedicated to stole/clone credit cards info
Lammer: Person with poor knowledge about computers but they think they are super hackers.
Defacer: Person dedicated to penetrate web servers (yay for my erotic English)
Script Kiddie: user with no knowledge about computers that just download hacking tools without knowing how they work.

TV calls all of them 'hacker' because TV is the silly box

9 years ago
Permalink

Comment has been collapsed.

I went to college for computer science, i promise you, you are mistaken.

Here's the definition:

hack·er/ˈhakər/noun
a person who uses computers to gain unauthorized access to data.

You appear to be referencing silly internet speak rather than actual facts as I am.

9 years ago
Permalink

Comment has been collapsed.

What is a fact for you it seems it is not a fact for me :)

9 years ago
Permalink

Comment has been collapsed.

Facts are always facts, you means beliefs. You can always believe whatever you want, fact or lie. So live your lie.

9 years ago
Permalink

Comment has been collapsed.

Facts are always facts is not a proper answer :|
If you don't want/know how to discuss then don't reply my comments.
Thanks for the blacklist, it shows me your maturity :)

9 years ago
Permalink

Comment has been collapsed.

Did you ask a question? Where?
Nope, no question, it was not an answer, I was simply implying you were stupid and speaking down to you, which is how this started, with you speaking down to others about fake things you claim to know.

Just eat your crow and shut your mouth, I will not reply again, as you are clearly too incompetent to be reasoned with.

9 years ago
Permalink

Comment has been collapsed.

Siding with DarkAlkaiser on this one. Also work in a security sensitive environment with people who are professionals in that field. There are different terms that float around, but hacker is the ubiquitous term for anyone who attempts to gain unauthorized access.

9 years ago
Permalink

Comment has been collapsed.

"people who hack good ol' console games to make them different, as well as those who go through data your keyboard sends to the computer to try to find and steal your password"

Is that really a hacker for you? If so, that is pretty sad

9 years ago
Permalink

Comment has been collapsed.

People breaking into and modifying console games is not what my business worries about. But consider that while cyber-security guys know the difference between all the categories you mentioned, in the daily practice of their jobs it's not necessary to be that specific since you are usually dealing with the acts people commit, not the people themselves. Saying, "Someone script kiddied that website," is a word salad that doesn't add anything useful over saying, "Someone hacked that website."

9 years ago
Permalink

Comment has been collapsed.

The word 'hacker' has been always surrounded by negative connotations. There is a movement in my country to clean their job. A hacker is not only a person who breaks security on servers. It is also the one who avoid others can break that security, you know that. Ok, script kiddie, lammer, newbie, are terms used only inside the ciber security world, as there are similar terms in the gamers' glossary for example. When people hear the word 'hacker' they think automatically in 'ciyercriminal', someone who is commiting a cybercrime. What about all the experts in computer security that work finding bugs in programs? What about people who is working to protect our data in big companies preventing and avoiding intrusions?
I'm sure that, for most of the people here, hacker is someone that sends them a .scr file throught Steam chat, and that is sad.

9 years ago
Permalink

Comment has been collapsed.

What about all the experts in computer security that work finding bugs in programs?

These are commonly referred to as software developers who know how to properly implement cyber-security. Proper testing also plays a big role, so you can throw testers into that group as well. There are groups that do friendly "hacking" called red-teaming. These are talented people who will attempt to penetrate a computer system to determine it's weak points, then present the target with a list of fixes to plug the security hole(s). But that kind of thing is not common in the corporate world as it inflates costs. It's usually the business of highly specialized groups that are contracted for a specific job or who are internal to a government agency.

What about people who is working to protect our data in big companies preventing and avoiding intrusions?

Those are called sysadmins.

9 years ago
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 5 years ago.

9 years ago
Permalink

Comment has been collapsed.

Steamguard works for real.
(I'm from Brazil, but actually I study russian language and I do have some russians on my friendlist. Maybe is one of them.)

Here is the e-mail valve sent me:

Dear indioadagio,

Are you logging into the Steam client from a new computer? Here’s the Steam Guard code you’ll need to complete the process:


If you haven’t recently tried to login to the Steam client… from the computer located at 185.63.189.47 (RU), someone else may be trying to access your account. You can view more info about this login attempt online.

If you suspect someone else may be attempting to access your account, please either:

Change your password immediately or
Lock your account online and then request Support assistance to regain access to your account.

Thanks for helping us maintain the security of your account.

The Steam Support Team
https://help.steampowered.com

9 years ago
Permalink

Comment has been collapsed.

really stupid because no, nobody gets "hacked" with a 1 time access with the exactly correct password. you let your password be known in one way or another, and steamguard is just for people like you who randomly click phishing emails or sell/trade accounts

9 years ago
Permalink

Comment has been collapsed.

From my experience, you only get the email from SteamGuard once successful login has been achieved on a new device. It isn't 1-time access. It's recording that device in a permanent record for future access. I've never seen it send me an email based on flubbing my password input X number of times. In fact that method would be a great way of not only launching a DoS attack but the double whammy of flooding Steam user's inboxes with unnecessary mail about failed login attempts.

9 years ago
Permalink

Comment has been collapsed.

I work in IT, i wear different hats everyday. I could tell you a common password i see very often is "Admin001" or "admin001", heh.

9 years ago
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 8 years ago.

9 years ago
Permalink

Comment has been collapsed.

I agree. But you can only remind them every so often and hope for the best. The last time I helped them tighten up their router with a highly secure password and wrote it down for them, I got an eye-roll from my sister-in-law when she saw it.

Passwords suck. But we don't have a better solution yet for the masses.

9 years ago
Permalink

Comment has been collapsed.

hacker

When will this nonsense stop spreading?

9 years ago
Permalink

Comment has been collapsed.

tell him to scan his computer people do not "guess" passwords these days. he has something on his pc that stole the information if it's a key logger he has more problems than the steam account.

9 years ago
Permalink

Comment has been collapsed.

He put a good security package on his computer when he got it last Christmas that includes anti-malware and runs regular scans.

All along I've suspected someone got hold of his password where it was written down. He has two very strong contenders for that being the case. Fortunately in neither case is he in any danger of having sensitive accounts compromised.

9 years ago
Permalink

Comment has been collapsed.

the kids hadn't even been on the computer that day‽ unpossible!!111. may as well claim they hadn't eaten drank or worn cloths that week

9 years ago
Permalink

Comment has been collapsed.

In the end passwords don't matter that much.

Verification codes are the key, both email and steamguard.

9 years ago
Permalink

Comment has been collapsed.

ummm not true. both are equally as important.

I use passwords like this:

fuxiMyzucBvwECzPcCLfwTefeKjgEQgoUtn2TmjTQkeCjmUhSyCHbQAeysh9rA3cu4ATwdTXCU88ghzYrm4R4zQK7yyC6tuTdeHQB98nmKpqHp3EEiPaXnsoc8upBnLB

Don't you think a password like this, combined with verification codes, will make you safer than just verification codes alone?

9 years ago
Permalink

Comment has been collapsed.

I meant, in case of malware infection/keylogger.

I myself use passwords with letters small/large, numbers and at least one symbol that I can still remember when I need it from somewhere else but my home computer. With pw's like above, you'll probably need a manager and can only use it at your home computer.

9 years ago
Permalink

Comment has been collapsed.

in case of malware infection/keylogger.

don't use windows

With pw's like above, you'll probably need a manager

yep

and can only use it at your home computer.

nope, there's ways of running good managers on mobile

9 years ago
Permalink

Comment has been collapsed.

Sign in through Steam to add a comment.