Don't know, not interested in Dota.

But you seem to have an issue with your SHIFT KEY. Maybe you should trade for a new keyboard first.

Originally posted by CuteLittleWaif:

I did read the thread.

Then your question should've been answered before you posted, making your question obsolete.

Originally posted by AK87:

"That would mean that TF2OP would have to host all of the thumbnails, which is a lot of extra unnecessary space."
and a purge system for attachements wouldnt help with that issue?
like you could start with purge inaktive trades / closed trades and all the attachments in that, sure it takes up some space, but again i think thats a little price to pay for keeping the site link free for phishing attacks etc ;)

It's not just the space that is the problem, but traffic und thus performance.
Also, bad enough people have to use multiple

blank

lines,

ALL CAPS, and even letter s p a c i n g.

I don't need the notes, and much less the posts, to be cluttered with useless images too.

Originally posted by El Barto:

Are you able to select several levels or craft numbers? If not, could it be implemented? Like a comma-separated list or something.

You can just put the item multiple times into the list with a different level or craft number. That ought to be enough for everybody, I guess.

Originally posted by samhudson333:

Did you try counting them?

lol, I wasn't aware there was another way before

I don't think we need the letters again to filter, but the class / other filters were pretty useful. I would like to see a comeback.
It was easier to just use the mouse instead of having to lean forward and using the keyboard.

Also, sad to see the "search completed trades" disappear again before I even had a chance to try it out.

Originally posted by eddy |S:Dota2 commons>2 scrap|:

i see a lot of ppl who get items from marked scammer, usuaully i report them, but nothing happen. probably becouse those ppl are donators.

That's got nothing to do with it. Often the items were traded from a scammer but the scammer was not marked at the time the item was traded. There is a delay between a scam happening, it getting reported and then until the scammer is makred.
Also you need to be able to prove that he traded with the scammer, which is not always easy.

One more thing for the list:
- do not consent to using teamviewer or any other remote access software for any reason

more a scam than hijack protection, but anyway...

Originally posted by Zemnmez:

Greetings all, my job on TF2OP is to find and advise on securing 0days and other exploits, as such this is very relevant to what I do. I'm considering making a post with advice on these things, but I don't really know what people want to know, so ask away if you have any questions.

I take it you want to make a post about giving guidelines / help on how one can protect himself from attacks.

I don't have any questions about that, but maybe some answers that may help you out with what should be covered, in my opinion.

- keep your OS up-to-date
- keep your Browser up-to-date
- keep your Browser plugins and add-ons up-to-date and to a minimum required
- update especially Flash and Java regularly
- maybe disable the Java Plugin if you don't know you need it
- consider Flash block as browser add-on (but that might hurt TF2OP Ads)
- consider a (free) Virus protection, (e.g Avira)
- if you see a post / link offering anything for free, ignore it and don't click any links.
- if you did use a link and are prompted to download anything, do not accept the download
- if you did use a link and are prompted accept executing anything by your browser, do not accept
- you should not get a steam login page after visiting a link
- make sure you only enter your Steam password at steamhost.cn/steamcommunity_com or steampowered.com
- use a different password for your e-mail and steam account
- do not click any links that someone sends you in your trade /chat window while trading.
e.g. do not click any links that someone claims you need to visit while trading to prove you item is not duped
(don't know if that vulnerability has been fixed by valve yet)

That's all I can think of for now...


What I would love to know though, is a few technical things.

It was Regen that pointed out many phishing links got posted from one location (IP), but with different accounts.

Then there seem to be more and more victims that claim they never got any e-mail about Steam Guard, had a different e-mail password than Steam password, never visited a phishing site and yet got hijacked without them knowing anything.

It seems that the hijackers have a way to hijack not the entire account, but instead only the session, I suspect.

They do not seem to be able to alter the password (even before the new e-mail confirmation) but can steal the items and use an existing TF2OP authentication to distribute phishing links.
That I suppose is only possible by downloading a "FreeHat.exe".
Or 0-day, but I highly doubt 0-day exploits are used in Steam Account hijacking, especially not by the ones that specifically target TF2OP as well to distribute their phishing links.

I would be interested in if the attacker just stole the TF2OP session and if TF2OP has safeguards like checking the IP address to validate the session?
Is there a log where one could see if a session of such an hijacked account has been used from 2 different IP addresses within a short period of time?
How long is the TF2OP session valid without refresh?

He has/had nothing valueable in his BP, that's probably why he didn't even notice he was hacked.
If anything, that must be a very rare example of an hijacked account where the bp value increased during the hijack: http://backpack.tf/profiles/76561198044359343