Steam Escrow Discussion and Speculation

[Major Erection]

There could be a brief window lasting a few minutes after the trade is accepted, during which no penalty will be given for cancelling.  That should pretty much eliminate that one particular type of trolling with the new system, since the victim could just immediately cancel and get their items back with no penalty the moment they see that they'd been tricked into escrow.

one could just claim that steam is acting up and it's taking a while for the trade to be concluded etc.. I don't mind steam adding security features but at least make them useful instead of just creating problems that don't exist.

[Major Erection]

btw, there's a petition that's going on and it would be nice if everyone is willing to join it.

 

http://www.ipetitions.com/petition/steam-escrow-petition

[zaabluc]

New message appears when trade window is opened. So Valve is rolling out escrow.

 

"Starting 9 Dec, anyone losing items in a trade will need to have a Steam Guard Mobile Authenticator enabled on their account for at least 7 days. Otherwise, to protect against unauthorized trades, items will be held by Steam for up to 3 days before delivery."

[cąℓσceđrus ☁☽]

gonna see shit loads of trades up with "MUST HAVE STEAM MOBILE AUTHENTICATOR ENABLED"

 

seriously, who the hell is gonna wait 3 days to complete a trade

[Buy my mixtape fam]

gonna see shit loads of trades up with "MUST HAVE STEAM MOBILE AUTHENTICATOR ENABLED"

 

seriously, who the hell is gonna wait 3 days to complete a trade

yeah, valve is shitting themselves if they believe people will be okay with that

[xosmin]

gonna see shit loads of trades up with "MUST HAVE STEAM MOBILE AUTHENTICATOR ENABLED"

 

seriously, who the hell is gonna wait 3 days to complete a trade

the same people that now wait 7 days after using steam market

[PSI Wind]

You know, I'd be okay with this if it was like Bing where a robot calls you up with a code and you enter it. Doesn't matter what phone you use either. But I don't have a smartphone so thanks Volvo.

[cąℓσceđrus ☁☽]

the same people that now wait 7 days after using steam market

 

thats different because you actually get the item in your inventory

 

with this new thing, someone who doesnt have sma activated, they can cancel the trade at 2.99 days, thats plenty of time for prices to change and it kills fast profit turnovers

 

 

literally nobody will trade with anyone who doesnt have sma

[Дебра]

the same people that now wait 7 days after using steam market

 

You can still use your items instantly on the market. With escrow it's no access whatsoever for either parties.

[Capuless]

On the bright side "SAVE 5% - 33% ON ITEMS IN THE MARKET WITH A SECURED ACCOUNT." Too bad I don't have a smart phone. 

[E-Arkham]

I installed the mobile authentication today.  My phone's an android, and this process was a complete and royal PITA.  It took a long time for the app to even install, and then took me an hour because the app would only show the steam guard page as blank with no setting options, even after multiple restarts.
 
The app itself drains your battery way too fast if it's on.
 
The other massive downside is that it shows you as being online on friends even if you're not, and logging out (whether app, browser, or desktop) does not help.  Turning on the app automatically logs you into friends, regardless of your settings.  This is a huge hassle IMO (unwanted messages sent to your phone while you're out and about or driving, or missed messages that were sent because people think you're online when you're not, etc) and needs to be fixed ASAP.

 
Using the actual authentication code so far was quite simple.  And having a constantly changing code is actually crazy secure, so that part at least is very nice.
 
For those of you who use alt accounts to store stuff, according to this comment by DrunkenF00L on reddit, you should be able to use the same phone number for multiple accounts and "swipe" between the passcodes.  I haven't tested this myself as you still get a popup telling you the phone number will be "disassociated" from other accounts when you try to add the number, so I'll wait until this is properly sorted out.

[xosmin]

I installed the mobile authentication today.  My phone's an android, and this process was a complete and royal PITA.  It took a long time for the app to even install, and then took me an hour because the app would only show the steam guard page as blank with no setting options, even after multiple restarts.

 

The app itself drains your battery way too fast if it's on.

 

The other massive downside is that it shows you as being online on friends even if you're not, and logging out (whether app, browser, or desktop) does not help.  Turning on the app automatically logs you into friends, regardless of your settings.  This is a huge hassle IMO (unwanted messages sent to your phone while you're out and about or driving, or missed messages that were sent because people think you're online when you're not, etc) and needs to be fixed ASAP.

 

Using the actual authentication code so far was quite simple.  And having a constantly changing code is actually crazy secure, so that part at least is very nice.

 

For those of you who use alt accounts to store stuff, according to this comment by DrunkenF00L on reddit, you should be able to use the same phone number for multiple accounts and "swipe" between the passcodes.  I haven't tested this myself as you still get a popup telling you the phone number will be "disassociated" from other accounts when you try to add the number, so I'll wait until this is properly sorted out.

 

quick question: is this something like confirmation of trades or steam guard (aka you need you enter a new code for each trade or it's something that needs to be on and will be triggered if something changes (login from a new comp etc)? from waht i've read so far seems the first one, but i dont know anyone who actually uses this, so i can't be sure. thanks

[E-Arkham]

quick question: is this something like confirmation of trades or steam guard (aka you need you enter a new code for each trade or it's something that needs to be on and will be triggered if something changes (login from a new comp etc)? from waht i've read so far seems the first one, but i dont know anyone who actually uses this, so i can't be sure. thanks

Well, the escrow thing isn't active yet, so I'm not sure... but so far it just seems to affect you when you logon to steam. You get a popup asking for the current code (which changes every 30 seconds), type it in, and hit submit code, similar to steam guard when logging in from a new device.

 

I don't think you actually have to type in the code each time you make a trade.

 

[Edit] Ok, just to be clear:

 

I sent a trade to an alt.  Instead of confirming via email, I had to confirm via the app - "In order to send this trade offer, you must verify it in your Steam Mobile app. You can verify it by launching the app and navigating to the Confirmations page from the menu."   I start the app, check confirmations, click "OK" and it's done.  Basically the same as with email, just using the app instead.

 

I did not have to enter in the current code, but I did have to turn on the app.

 

To be honest, using the app instead of email to confirm is actually slightly more convenient (saves me the one step of refreshing email), so I will give them that.

[WDZ-RR Poncho Sullivan]

Wouldn't it be something if all three communities of the big three games - DOTA 2, CS: GO and TF2 - united to take down this escrow nonsense?

[xosmin]

Well, the escrow thing isn't active yet, so I'm not sure... but so far it just seems to affect you when you logon to steam. You get a popup asking for the current code (which changes every 30 seconds), type it in, and hit submit code, similar to steam guard when logging in from a new device.

 

I don't think you actually have to type in the code each time you make a trade.

 

[Edit] Ok, just to be clear:

 

I sent a trade to an alt.  Instead of confirming via email, I had to confirm via the app - "In order to send this trade offer, you must verify it in your Steam Mobile app. You can verify it by launching the app and navigating to the Confirmations page from the menu."   I start the app, check confirmations, click "OK" and it's done.  Basically the same as with email, just using the app instead.

 

I did not have to enter in the current code, but I did have to turn on the app.

 

To be honest, using the app instead of email to confirm is actually slightly more convenient (saves me the one step of refreshing email), so I will give them that.

so it will screw the trading bots.

thank you for taking the time to check

[Gren]

 

 

It was pretty painless for me.  I had no issues, took less than 2 minutes (already had the app installed though).  

 

Tested it out on scrap.tf, straight forward experience.  After accepting the trade offer I was prompted to confirm the trade in the app which I was able to do without entering a code and with no issues.  

 

So the process seems ok.  However, if there isn't a change made to this process, it will render scrap.tf and every other bot basically useless (unless you want to wait 3 days for your items).  IMO, that would be a serious blow to the trading community. 

[OverduePixels]

It was pretty painless for me.  I had no issues, took less than 2 minutes (already had the app installed though).  

 

Tested it out on scrap.tf, straight forward experience.  After accepting the trade offer I was prompted to confirm the trade in the app which I was able to do without entering a code and with no issues.  

 

So the process seems ok.  However, if there isn't a change made to this process, it will render scrap.tf and every other bot basically useless (unless you want to wait 3 days for your items).  IMO, that would be a serious blow to the trading community. 

 

Pretty much all Bot related site will be useless or won't work. Sites like Lounge, Jackpot, Scrap.tf, Backpack automatic all doomed.

 

As a side note...

 

Looks like Valve is moving forward with it unless more people opposes it.

https://www.reddit.com/r/tf2/comments/3u8rwh/psa_the_steam_escrow_system_comes_into_play_dec_9/

[Nobu]

I've been using the mobile app since it was released. The escrow does suck but the app itself is alright. Installation, configuration etc all took less than a minute. 

 

The app generates a unique Steam Guard code that expires after a specific time. Trade confirmations are done through the mobile app instead of emails. All you do is open the trade, view what items you are trading etc and click "Confirm". Everything works exactly the same as how you would do it through your computer and email. 

 

I'll agree with E-Arkham though about the chat function in the mobile app being retarded. Even if I tap on the "Go Offline" in the settings page, it will log me back into chat the moment I reload the app lol. I just hope that Valve finds a solution for users without smartphones or those not wanting to use the app or just scrap the whole idea since so many people are upset with it. 

[OverduePixels]

I've been using the mobile app since it was released. The escrow does suck but the app itself is alright. Installation, configuration etc all took less than a minute. 

 

The app generates a unique Steam Guard code that expires after a specific time. Trade confirmations are done through the mobile app instead of emails and they work pretty much the same way. All you do is open the trade, view what items you are trading etc and click "Confirm". 

 

I'll agree with E-Arkham though about the chat function in the mobile app being retarded. Even if I tap on the "Go Offline" in the settings page, it will log me back into chat the moment I reload the app lol. 

 

Nevermind, I ended up installing it anyway. Valve is not giving any options at the moment.

[The Recluse]

Guys,

 

There is a tremendous, and I mean super mega tremendous difference between "wow 2fa is great and expiring security codes is a great idea" and "if someone doesnt have 2fa with expiring security codes enabled the items will disappear for 72 hours" 

 

Nobody's saying the 2fa system isn't good, or that steam's implementation is bad, it's this absurd nanny-state policy bullshit that sucks. This punishes people aren't stupid enough to click on links and people who aren't scammers/literally everyone who is not Russian. 

 

It absolutely sucks, and you should get 2fa anyways because security is good and if you're the kind of person that doesn't see the point in having it you are definitely the kind of person who should have it. 

 

If you're smart and can see the obvious benefits of 2fa check out https://twofactorauth.org/to see what other companies support it. 

 

This is a little different than email confirmation. Email confirmation is really good but if a hacker, say, put a keylogger on your computer because you're a total fucking moron that clicked on hatt-genera.tor/phishing for a sick free unusual from a stranger, they could easily have access to your steam email as well as your steam account, so it's not exactly foolproof. 

 

With the Steam App, even when you fail miserably at trying to pirate a video game and instead become a porn dialer with more trojans than a sex shop, they still can't compromise your backpack because unless they physically steal your phone there's no way for them to confirm the trade.

[xG:CL Scootaloo]

Came to share my Mobile Authenticator experience. Hopefully it will help for people looking to answer questions about having a setup similar to mine.

So, I don't actually have a smart phone, but I do have an Android tablet that is contracted for data through Verizon Wireless. My first initial thought was that I could just use my MDN from the tablet to try and synchronize my Steam Guard when it asked for a phone number. But, as many of you already know, it requires a phone number to send an SMS text to, so obviously that wouldn't work.

So then I decided I would instead have a text sent to my cell line, which ISN'T a smart phone at all. I inputted my cell number and waited for the message. Once I received it, I inputted the code it gave me and the Mobile Authenticator App accepted it and began to work.

So then I decided to test it. I logged out of Steam on my PC and logged back in, and when I went to verify my Steam Mobile Authenticator from my tablet, it accepted it just fine!

So it seems that they only need a phone number to send the SMS code to. After that, it seems it isn't necessary for anything. I'm able to receive my authenticator codes on my tablet just fine and I don't have any sort of SMS plans on it. 

So, if you were wondering if you could use an android tablet or an iPad via wifi or a data plan, it worked fine for me. 

 

Testing trading went swimmingly, and in fact, I actually prefer receiving my notifications for trades through the mobile app vs email. It seems to arrive much quicker and I'm not stuck waiting up to 5 minutes after accepting a trade to get an email. So that's a plus I guess.

This entire debacle is a royal pain in the ass, but at least it works. And I don't understand why everyone is in a tizzy thinking you HAVE to have a contracted smart phone for it to work. I don't and it works just fine. But then again, I am lucky enough to have an Android tablet. It could be worse. I could have a windows device, or no device at all. T.T

[xosmin]

at this point i'm really curious to find out what happens when you enable the mobile thingy but you have the trade confirmations disabled. if they allow this scenario, it will be great news for traders

[Tasty Salamanders]

at this point i'm really curious to find out what happens when you enable the mobile thingy but you have the trade confirmations disabled. if they allow this scenario, it will be great news for traders

From my understanding mobile authentication replaces email confirmation. Given the Escrow/Trade Hold that follows a lack of mobile authentication there is no good news for traders, only bad news.

 

Also the popular petition to Valve was mysteriously deleted and a new one has been created, and of course there is speculation Valve is behind the disappearance of the previous one but no one really knows at this point.

Previous/deletion petition: http://www.ipetitions.com/petition/steam-escrow-petition

New petition: http://www.ipetitions.com/petition/steam-escrow-petition-2

[xosmin]

From my understanding mobile authentication replaces email confirmation. Given the Escrow/Trade Hold that follows a lack of mobile authentication there is no good news for traders, only bad news.

 

Also the popular petition to Valve was mysteriously deleted and a new one has been created, and of course there is speculation Valve is behind the disappearance of the previous one but no one really knows at this point.

Previous/deletion petition: http://www.ipetitions.com/petition/steam-escrow-petition

New petition: http://www.ipetitions.com/petition/steam-escrow-petition-2

so far, it looks that you can use the same phone number for multiple accounts ( https://www.reddit.com/r/Steam/comments/3u84sr/is_it_possible_to_use_2_steam_accounts_for_mobile/cxcr37w) and also scrap.tf found a way to emulate the mobile authentication and embed it into bot's code ( https://scrap.tf/announcement/482 ).

and if the scenario i mentioned on my previous post works, it will actually be a good thing to move from email to phone codes. but ONLY if the trade confirmations can be disabled.

about the petition - that's really, really fucked up

[Shrap -tt-]

I just enabled the mobile authenticator, (already had the steam app) and tried a test trade (I had email confirmations off) and I didn't have to confirm the trade with a mobile code. I do have the market discounts now though