this post was submitted on 19 May 2025
290 points (99.0% liked)
Games
38748 readers
2746 users here now
Welcome to the largest gaming community on Lemmy! Discussion for all kinds of games. Video games, tabletop games, card games etc.
Weekly Threads:
Rules:
-
Submissions have to be related to games
-
No bigotry or harassment, be civil
-
No excessive self-promotion
-
Stay on-topic; no memes, funny videos, giveaways, reposts, or low-effort posts
-
Mark Spoilers and NSFW
-
No linking to piracy
More information about the community rules can be found here and here.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What does GOG's 2FA do that Steam's 2FA doesn't?
At a glance (haven't enabled yet, will later today), GoG uses the RFC standard TOTP model. This means you can use whatever app you want whether that is the google authenticator that ties it to your cloud account, something related to your password manager (e.g. keepass or bitwarden), or even just a python script you have in a random directory. It gives you control of your 2FA and protects you in the event you lose a device without properly de-authenticating it.
Valve use their own model that, to my knowledge, is only accessible through the Steam mobile app. Which is a huge nightmare if you ever have a device stolen/damaged (and is why you back up the recovery code)
Just enabled. Yup, bog standard TOTP and they even provide the plaintext key so that I don't have to extract it from a QR code.
It ~~presumably~~ works with a normal TOTP app.
E: confirmed it works
Steam works with a normal TOTP app for me, hell, it works with two normal TOTP apps for me
I'm pretty sure it doesn't but I'll bite: How did you set that up?
I don't recall, I've set it up a few years ago - I've been trying to look for instructions for another comment, but it seems that they made it VERY difficult for people without rooted Android to obtain the TOTP secret.
Though it is RFC 6238 compliant, using 5 digits instead of 6.
Okay, let's say there's currently no native support for normal TOTP, mostly because Steam doesn't give you access to your TOTP key.
That much I can agree with at this point.
Actually, it's arguably even worse - it's not that Steam doesn't support normal TOTP, it's that Steam goes out of their way to prevent TOTP from being used without switching to an entirely new algorithm.
Could be worse. GOG's approach is super annoying, and a lot of platforms (like fucking Apple) actually require the use of insecure and invasive SMS verification. And as far as I know Steam hasn't been hit with any data breaches since 2011.
My honest reaction:
Unless I’m missing something, Steam only does code to email 2FA, not an actual TOTP app
They have TOTP but only in their app.
So effectively, they don’t do what GOG is doing.
Not exactly, no
Steam works with a normal TOTP app for me, hell, it works with two normal TOTP apps for me
Teach a brother how? I swear I couldn’t find it anywhere in the account settings.
I don't quite remember how to get the TOTP secret from the Steam app (they could in fact take notes from GOG here), iirc you have to extract it from the Android app via adb;
but once you have it, if this GitHub comment is correct you simply have to set the code size to 5 digits.
If your phone has a rooted Android install, I found this guide.
... I swear when I did it, it wasn't this hard ._.