(H)Danny, Geel, or whoever - Anti API

[DanielDee]

Any chance you can make a script. That notifies oneself when an API key has been enabled?. I know this is how bots function and work as standard but humans clearly not.

I have also registered a URL and have capacity availble for quick checks. which i will provide in due course for safety purposes. I would really like to hear from the alex dude who has heavy logo.

 

anyway, as i was saying. Alex where are you www.youbeenphished.com i need you to make this work

[D.Alex]

I don't think a script like this would be very useful.  

 

 

First, once you know about this scam (SteamRep, Marketplace.tf, Opskins) you should simply remember not to enter your Steam login/password anywhere but on Steam website:

 

 

Other way to explain this in my forum post

 

 

Second, a script like this can give you false sense of security if some scammers change their tactics and either not use Steam API key at all or register it at the last second.

To do that they would need to stay logged in as you (after phishing) and it's probably going to use a lot more resources on their end but it's certainly doable.

 

The script itself is trivial, here's one example that checks for API key when you're accepting or creating trade offer.

To install you need Greasemonkey (Firefox) or Tampermonkey (Chrome).

// ==UserScript==
// @namespace TF2
// @name Steam API checker
// @description Checks if user has a Steam API key registered, every time user is accepting or creating a trade in this browser
// @match https://steamcommunity.com/tradeoffer/*
// @icon https://steamcommunity.com/favicon.ico
// ==/UserScript==

$J(function(){
  $J('<div>').load('/dev/apikey input[type=submit]', function(){
    var btnName = $J(this).find('input').attr('name');
    if( btnName == 'Revoke' ) alert('You have API key registered on your Steam account');
  })
})

 

Related script for MP deposit and discussion