Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor authentication". This is visible on public profiles for anyone.

This could let possible hackers quickly find out whether an account uses two-factor authentication, letting them choose targets more efficiently.

Should people be concerned about this security risk? Should it be reported to Valve? Or is it harmless?

Doesn't this feature completely undermine the purpose of 2FA as hackers would simply avoid accounts with it and choose other accounts that are valuable targets without 2FA?

share|improve this question
4  
lol - yes it is a security risk - and it should encourage people to enable 2FA! – schroeder Jan 5 at 19:36
    
It's really just bad opsec. Not necessarily undermine 2FA. – RoraΖ Jan 5 at 20:15
1  
@Meta. It's better than not having 2FA at all, where everyone is a target. – TTT Jan 5 at 20:58
    
@TTT it's not really a question about having 2FA or not it's a question about having 2FA with a public note saying it's enabled or not (so that anyone can see if you have that enabled on your account) and it's effect in regards to security of the ecosystem as a whole. – iismathwizard Jan 5 at 21:16
9  
Please don't edit your question to add "EDIT: some more stuff." Instead, edit the question to read as a coherent, self-contained question that makes sense for the first time you read it -- edit to be what it should have been from the start. No need to highlight what has changed or preserve old information -- we have revision history for that. – D.W. Jan 6 at 0:10
up vote 15 down vote accepted

I think this works a bit like a home alarm system sign. Just the sign itself in your front lawn will deter burglars from even trying to get into your home because of how much more difficult it looks like it will be.

In a similar sense, having this achievement acts like the sign: if an attacker saw this they might not even try to get into this account because it's increased perceived difficulty.

Does this increase the likelihood of another account being targeted?

  • I'd say yes since the pool of potential targets just became smaller, any individual in that pool has an increased chance to be a target

What can those without the achievement do to reduce their chance of being attacked?

  • Put up a home security sign (Enable two factor authentication!)

Summary: It doesn't undermine two factor authentication but, hopefully, encourages others to follow best practices in securing their accounts.

share|improve this answer

It does not undermine the purpose of 2FA, but it might affect the security of users not using 2FA.

The goal of 2FA is to change login to require, well two factors. Specifically, something you know and something you have. Publishing a list of users that use 2FA does not reduce the security of 2FA. An attacker still must obtain the password and the device.

On the other hand, there may be attack strategies that only work for accounts that do not use 2FA. For example, if a password dictionary attack is possible, attackers may use the published list to identify accounts that don't use 2FA and hence are vulnerable to the password attack.

share|improve this answer

I think it is important to distinguish between three different questions one might ask:

  1. Does this undermine the security of a particular user who uses 2FA? Answer: No. If you're using two-factor authentication, making that public doesn't help the attacker break into your account. If anything, it helps you, by deterring some attackers from attacking you.

  2. Does this undermine the security of a particular user who doesn't use 2FA? Answer: Yes, somewhat, because it could make it easier for attackers to mount targeted attacks on users who don't use 2FA.

    That said, it's important to keep this in perspective. It's not harmless, but it's not devastating either. I don't think it's going to be a game-changer. Suppose 50% of users use 2FA. Then an attacker who tries attacking a bunch of accounts in succession will only be able to reduce the number of accounts they need to try by at most a factor of two, using the information leak pointed out in your question. That said, I suspect many attackers probably won't even bother to check the public profile and for those attackers this information leak will have no effect.

  3. Does this undermine the security of the ecosystem as a whole? Answer: Yes, somewhat. Of course, this is primarily relevant to Valve, rather than to its users. They have incentive to protect their own bottom line.

As a user, if you are concerned, one possible response is to enable 2FA on your Steam account.

Should you contact Valve to disclose this information leak? Sure -- why not?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.