On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts.

I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple accounts. On my fifth account or so, Steam has started preventing me from using the same password again.

How does Steam know whether a password has been used before without compromising my security?

  • 1
    If you are using randomly-generated, unique passwords in the first place, why pray tell do you want to compromise the advantage you get from that by using the same password for multiple accounts?! – a CVn Jan 31 '15 at 14:24

This is bad.

They're either storing the password:
* in unsalted form (which is bad),
* in reversibly encrypted form, from which they can reproduce the plaintext (this is worse),
* in unencrypted form (this is the worst).

The prefered way to store passwords is in salted form. This is explicitly made to prevent identical plaintexts winding up as identical ciphertexts. So they can't be using salts.

  • 1
    They could also be tying the salt to something that they are able to connect to the user as an individual but which is not related to the account per se. One thing I can think of that could fit the bill is the user's credit card number (properly secured for, and specifically the CC# might not be possible, due to PCI DSS compliance). Take a bcrypt of the credit card number, store that, and use it as the salt. That would allow them to identify duplicate passwords per person without knowing what the passwords are. – a CVn Jan 31 '15 at 16:59
  • @MichaelKjörling: I agree.@nobody_nowhere: could this be the case? Does Steam know that these different smurf accounts all belong to one and the same person (you)? – StackzOfZtuff Jan 31 '15 at 17:17
  • I cannot think of a way they can do this except by keeping track of my IP Address. I do not give away any personal information on Steam. – nobody_nowhere Feb 1 '15 at 18:21
  • They cannot know anything about me other than the fact that they are all used only from one and the same location (my IP address). But I think that my individual IP address would not be shared, correct? They can only know the IP address of my ISP at my location? I figured this out by searching for my IP address at an IP address registry. Is this correct? – nobody_nowhere Feb 1 '15 at 18:26

I don't think an authoritative answer to this can be given. It'd have to be someone who works with the relevant portions of the software, and odds are the exact algorithm is deliberately kept secret. However, we can offer more-or-less well-founded speculation.

Besides storing the password more-or-less-unsecured as speculated by StackzOfZtuff there is another possibility which appears plausible given what we do know.

Steam is a for-pay service. This means that they have certain information about the person behind the user account. For example, payment details, which are unlikely to ever be duplicated among individuals who aren't closely related to each other (family members in the same household, for example).

That leads to the obvious possibility that they are taking some of that personal information, and using it in some manner as a salt for hashing the account password. By having the salt fixed on a per-person basis, rather than on a per-account basis, it becomes trivially possible to store passwords securely (by properly salting and hashing them) while still providing the ability to detect when the exact same password (by whatever criteria the service uses) is used by multiple accounts. If I was faced with a requirement to be able to detect whether the same password is used by the same person for multiple accounts, that's certainly how I would approach the problem. Remember that the salt doesn't have to be secret to fulfill its role of enhancing the security of the system.

Of course, that doesn't say anything about why you are using the same randomly generated password for multiple accounts, negating much of the advantage of using random passwords while providing very little in terms of advantages over using different random passwords for every account...

  • I do agree that it is literally one step forward and one step back by my reusing of my password. However, an attacker should be unable to link any of these accounts together correct? – nobody_nowhere Feb 1 '15 at 18:22
  • I have not given any personal information, not even similar email addresses or something. The only thing linking these accounts is the IP from which it was last used However, Steam, doesn't (AFAIK) provide a method to look at all past logins in a fashion similar to Gmail. – nobody_nowhere Feb 1 '15 at 18:24
  • Did you pay with the same credit card, or something like that? – StackzOfZtuff Feb 1 '15 at 19:05

There is another way to do this that has not be mentioned so far that seem to me to be more secure. I like to think that such a large corporation would not store our passwords in any of the ways mentioned by StackzofZtuff but you never know.

My proposal is that when you attempt to signup, they find all other accounts with some identical piece of personally identifying information in their database (the same email address or ip address for example). For each of these potentially matching accounts, they hash the password for your new account with the same salt as the account they are checking against. If the hashes are the same they know that both accounts use the same password and they increment some counter. Once they have compared your account all other accounts with matching personal information they simply check the counter to see if you have exceeded the maximum number of accounts with the same password.

With this approach your password could still be stored in a secure manner if they hash your password a proper random salt at the end. This should not be viewed as a good way of doing things however because if a hacker has the same piece of personally identifying information they could theoretically create a bunch of accounts with common passwords and your piece of identifying information. If Steam rejects their requests after 4 signups instead of 5, they will know that they have successfully guessed your password.

  • I don't want to be the one to complain, but isn't this basically what I wrote a day earlier? – a CVn Feb 1 '15 at 20:49
  • @MichaelKjörling Your post was valid, however I interpreted it to mean that you are suggesting that the salt remains the same if identical personal information is given and that Steam is checking for other accounts with the same hash. I suggest that the accounts only have the same salt when accounts are being compared upon signing up and that different salts are used for storing passwords, resulting in different hashes being stored in the database. – scribblemaniac Feb 2 '15 at 1:55
  • I see. That would perhaps be a difference. I'll consider if I can rephrase my answer slightly. – a CVn Feb 2 '15 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.