Just use Steam Mobile Guard and you needn't worry. Read the Account Security recommendations to get a better understanding as to why.

PS Don't believe everything people tell you. They're likely not well versed in IT and just don't know what happened, or are purposefully portraying another story out of shame, or worse, to make you believe the system is broken and thus not use it.

I can assure you however, I've always used the best protection (and not downloaded stuff from random sites) and I've never been hijacked, scammer etc.

I mean on steam support it says affiliate sites can get into your steam account if u log in . Does it talk about sites steam accepted or every site where u log in with steam even new one?

You can log into ANY website via the Steam API as long as they properly direct you to a Steam owned domain ( steamcommunity.com ) for the login itself.

Do never input any credentials in another website directly. To make sure you can't do this evne by error, use Steam Mobile Guard.

Yeah i get your point but what i'm trying to tell you is that a guy with steam guard who did login in a scam site got all his items from rocket league robbed so i assume they can start steamapps bypassing steamguard somehow

I sincerely doubt that. You have to confirm it on your phone, or have a tradehold. If this was an issue it would be more widespread.

Originally posted by KillahInstinct:

I sincerely doubt that. You have to confirm it on your phone, or have a tradehold. If this was an issue it would be more widespread.

Sincerly, please do not doubt this.

I am Leonardo, the manager of RLTracker.pro rocket league trading site (legit site), place where we host the biggest Scammers List with scammers from Rocket League and I can confirm you that lots of people got scammed after they logged in on sites like:

rl-tracker.pro (domain to look like ours)
rocketleague.online
rl-market.com

And all of the ones who reported this had steam guard on.

Even a good friend of mine got scammed today after he logged in on rocketleague.online (yes, he had guard on).

How I can confirm that those people had guard on?! Is simple... we are traders and when we do trades via steam we dont want to wait 15 days. We have the guard on to confirm fast.

Please don’t think steam is perfect. Always people with good skills in scripting/hacking found ways to skip/jump some firewalls.

Please investigate.
Thank you

PS. If you need more infos, I and my other team members can help.

If you look closely, the site doesn't redirect you to the real Steam site - but to a site resembling the OpenID login. In other words, your friend fell for (one of the many) scams out there.

Originally posted by KillahInstinct:

If you look closely, the site doesn't redirect you to the real Steam site - but to a site resembling the OpenID login. In other words, your friend fell for (one of the many) scams out there.

Doesn't matter. U haven't understood one thing... He had Guard ON. So... even that he is stupid (he found out today that he is) and provided the user/pass, where was the Steam Guard to protect him from the scammer?! The scammer somehow used that user/pass and logged in on his account without the Steam Guard to step in.

So... Here is the problem... with Steam Guard doing nothing. Steam Guard haven't steped it when the scammer tried to login on his account.

Your friend didn't have Steam Guard on or was otherwise compromised.

It's easy to make claims, but if Steam Mobile Guard was actually bypassed noone would be safe. It's simply not the case; it works like it does with other 2FA solutions. But the weakest link is still the user.