IJBM: "Steam's new security features are ruining Steam!"

glennmagusharvey

Well, perhaps, if you don't have a smartphone, and actually want to profit off of trades and Steam Community Market transactions.

But honestly, fuck the item economy.  People like complaining so bitterly about microtransactions and forced online gameplay, yet they gladly take up item trading and market usage.

I wouldn't mind if all the trading cards, emoticons, badges, and profile backgrounds all just disappeared.  Would I "lose" a bunch of value?  Well, you could say yes, since I have a bunch of trading cards, but you could also say no, because I'm not ever planning to throw them onto the Market anyway.

But what would be gained?  Steam could go back to being all about selling and digitally distributing games.

Simplicity FTW.

Bee

I don't think it's ruining Steam, and I wouldn't be too brokenhearted if they cut the whole thing either --but taking cuts of the sales has made them asstons of money, so they won't.  Just kind of a dick move in reaction to a bunch of really bush-league security failures.

After the cards get devalued down to 4-8 cents like they always do, Steam takes a very significant chunk of the sale.  Even if you have a smartphone, an authenticator text message will often cost more than what the user gets out of the sale.  It doesn't seem like much, but unless you're dealing exclusively in high-price items it completely removes user benefit in a really subtle and nasty way because you don't notice until weeks later when your phone bill comes in and you don't associate the cost to it anymore.

glennmagusharvey

The authenticator is self-contained within its data usage rather than generating text messages, so it would count as smartphone data usage cost.  I will admit that I am sorta lucky that I have unlimited data on my phone, and I also don't actually use that much of it so it's not unheard of for me to go through a month using less than 200 MB of data on my phone, between it using wifi connections and me generally not using it much.

And I think it's possible to have it on a tablet or not-actively-serviced smartphone.

But yeah, the funny thing is that Steam takes a more significant chunk if it's really low-priced -- 1 of 3 cents goes to Steam, so that's 33%, much higher than the 5% they usually take.

That said, what sort of alternative would you propose to what Valve has done so far regarding security?  They do have to deal with legions of scammers trying to phish and hijack people.  Someone I read today suggested that they come up with their own dedicated external hardware device.

Bee

I guess I might be the weird one in thinking they don't have much responsibility to prevent people from being idiots on the internet.  It's fucking 2016.  Phishing and social engineering are things the average Steam user has literally grown up on and should really, really know to look out for by now.  And if they haven't gotten the idea at this point, I'd frankly rather they learn it the hard way by losing a few bucks of virtual items than their bank account or something.

That, and the breaches the new measures are really in response to were all the result of extreme stupidity on Valve's part -- not just obscure programming quirks, but REALLY dumb stuff like secondary cache servers giving people someone else's session id, or letting you reset anyone's password by leaving the security question blank.

glennmagusharvey

The problem isn't that they have a social responsibility but rather that they get a crapton of Support tickets from people who've been phished, from what I've gathered.

Bee

And like, I understand and sympathize with that.  I've dealt with customers who hosed their data by not reading the instructions or doing something super-dumb.  I know exactly how frustrating it is to have to deal with things very clearly not the problem of you or your software, and I know what it feels like to waste a lot of manpower doing it that you'd really rather spend on making better software.

The thing is, you will never be able to fully compensate for stupidity.  And you can only put in so many measures to do it before you start adversely affecting the experience of customers who aren't idiots.

I guess I'm also more than a little baffled at the scale of phishing problems Steam has.  Because I'm aware it has tens of thousands of compromises a month, but I just don't get why.  At least WoW had a booming gold-farming economy and a hacked high-level account could readily provide a good amount of liquid assets that lowbies would pay for.  Steam accounts don't seem to really have all that much that can be sucked up by a hacker.  Almost all the net worth is in already-used game keys.  Like, there's some trading cards or TF2 boxes that would be worth a couple bucks in total, and maybe a couple gift copies of games, but I wouldn't expect the average account to even be worth the time investment to compromise it.

Am I the weird one for not having a cluttered inventory of expensive shit laying around?  Because it really seems like the bigger risk is that a phishing victim would give away login credentials that might be identical to other more important sites.