New trading policy.

Not sure if everyone has seen this yet, but I am extremely glad:

​

I'm sorry, but I've little to no sleep for the past few days, so I'm a bit braindead. Can someone explain to me what this would do?

Now if only people would stop using the same password for their accounts and emails then all of these hijackings could end!

hmm, its a protection requirement on a account to be able to trade...

No idea, but it says to me that a high enough percentage of traders don't have SteamGuard enabled to invoke this action by Valve... also, with hijacks of accounts that didn't enable it, hijackers cannot trade the items... wow... I would propose to valve that a activation of SteamGuard on a specific machine must ALSO be 15 days at least before on that computer can be traded.

I just ago send a email to valve:

But that's tricky, what about users who switch machines, or lost the activation credential in that machine (IE; wiping Steam, I think), they'll have to wait like 2 weeks and that's too much.

I thought that Steam Guard is enabled by default.

In any case, it would be better if that restriction is applied from logins like a distance of 500 KM, than the current user. Many hijacks are from Russians, or people who are really distant from the user.
That would help more IMO.

Also, to enable to lift the restriction prematurely via support, provided the user gives enough evidence that's legit.

Well there is a balancing act between security and any impost that might be odious to users I guess.

This small change, while not as strong as it could be, will have a very tangible impact and could end up saving the bacon of many at least in terms of the kind of scenarios I envisage, so good one Valve!

For the questions:
- Steamguard can only be enabled if you have an email verified to the account. Not everybody has done that. I do believe if it is verified, that the steam guard would be default on.
Which would leave to a tantalizing conclusion that valve detected a number of accounts that where not steamguard protected, not verified to a email, and involved in less then good trading practices....
- For being trading disabled for 2 weeks: well, I rather have that then that a hijacker could run with my items. Also, when ppl regain their account, they sometimes are re-hijacked within hours again. A reset of the 15 days is key there. more below.

After having a chat with Mattie, there are some downsides to it (and my proposal):
- To disable trading on a account for 2 weeks, they would disable steamguard... we find that... pretty insecure. we rather have a button that "disables trading for 15 days", ie a reset for that period.
- Moving computers, that would consist of a 15 day inability to trade. The only way for a work around imo is by having the computer with trade access affirm the new computer.
- LAN's visited with another comp/laptop would render ppl to be unable to trade. As would be like visiting a friend, logging in and trading from that...
- Work computers with Steam (I really wonder why a corp environment would allow one to run steam...) would have to wait (if having a new comp at job, or new job). See the "affirm" new comp above
- the way I see the "affirm" work is via a dialog box of steam, which lists which computers are having steamguard, and allow new unauthorized to trade comps to trade (and in 1 go to have a overview of comps that accessed the account, and remove Steamguard auth on certain comps). This doesn't solve the "LAN" occurance where somebody would be on borrowed hardware.

One possible way to catch those is to have a Trade Password, that needs filling in per trade done (and if wrong password, cancels the trade window, so a new trade has to be set up).

Most of those points where brought by Mattie, just rewritten those from chat.

I'm still of the opinion to "trade lock" new computers to an account. But a separate password in trade box would be a very good option. But it must be protected against brute force methods.

Great policy.

Bravo Valve!

It's not only for hijackers, and for carders too, they can't use carded keys on their accs during 15 days ^_^, so Valve bans will be stopped for a long time ( it is for items that was received from carded keys, such as: earbuds, bills hats, max heads etc... )

Good way Valve.

no, not correct... they will get easy around that:
- make account
- verify it with email
- make it steamguard protected
- wait 15 days
- then use stolen CC.

the above posts of mine where aimed at hijackers, to prevent hijacking and/or making it way less interesting to them.

Maybe you're right, but I think it will reduce drastically willingly from carders. People are too lazy to create an account for playing :3 to say nothing about the hundreds of accounts for carding, but I think carders will found another way for it, but not soon.

It most certainly will help, but of course the serial offenders will always find ways around such precautions.

My view is if this measure helps prevent only a portion of problem transactions, it will be worthwhile.

Ultimately, it only helps with the "disable steamguard" type of hijacking scams. Most phishing links include an email and email password field to them to circumvent steamguard. Sure, it will help some, but in the grand scheme of things, I don't believe it is going to make a large difference in terms of number of scams.

This would be a huge pain in the ass to anyone who uses multiple computers and idle/alt accounts.

Overall though this is a good thing, why people don't use steamguard to begin with is beyond me. But at least Valve is making an effort to protect people.

I think that this move was not necessarily created to blanket the entire hijacking problem but rather to fix one specific problem they had with security. They still expect you to be smart in your trading.

Not really, you can "enable" them all, no need to "enable" one, and disable the other etc. Idle/alts same deal. Really its not an issue using alts, multiple computers etc. You're already using them, so having all of them in Steamguard now will make it an easy transition.

As I discussed with Mattie, the only problem will be activation on a new computer/laptop when going to a LAN (I'm one to bring my own... but some seem to use a laptop thats not theirs), for you don't have access to your own computer to trade or do anything. I really don't see any other problems.

They are also starting to become more regular with VAC cautions and trading bans, I think Steam are starting to see that scammers and scammer alts can be a real problem for people. Although they did see this before but i dont think it was high on their priority list

I think you mean Valve Trade Probation tag, and not VAC Caution... VAC is regarding cheats, like aimbots, speedhacks, wallhacking etc.

You may have gotten the wrong end of the stick, I dont think i put it well i meant that i think that the Steam Moderators/Admins in general are being more Consistent and going into more depth now then around 2 months ago, Do you know what I mean?