Add support for Steam TOTP

[throwaway78239]

Is your feature request related to a problem? Please describe.
Steam totp is currently not supported because it is 5 digits and is in letters instead of numbers.

Describe the solution you'd like
Support for steam's totp through the custom form with 5 digit pin of letters.

Describe alternatives you've considered
Bitwarden currently has support for this feature which may help with figuring out how to add support. https://community.bitwarden.com/t/question-about-steam-totp-codes/3513

[throwaway78239]

If support for steam is added, maybe some sort of custom application type field could be added in the advanced form with presets for existing services.

[Bubka]

Suggestion added to the project's roadmap. I'm not a steam user, any chance I could think about it by myself.

Thank you 👍🏻

[Blake192]

This steam otp library works well for generating otp codes for steam's proprietary 2fa algorithm: https://github.com/DoctorMcKay/php-steam-totp. It should be as easy as using this library with composer, adding the logic for a new custom otpType called steam, and then adding the option in the frontend.

[Bubka]

Thanks @Blake192 for the lib.

As said I'm not a Steam user, I've never experimented their Steam guard auth process. So I've read some articles/posts and my understanding is that they only provide a mobile app that just generate (custom) TOTP code without the ability to get the personal secret directly. The workaround to get the secret would be this : https://community.bitwarden.com/t/question-about-steam-totp-codes/3513/10

Can you please confirm this is relevant and that the use of Steam Desktop Authenticator is mandatory to get the secret.

[Blake192]

Yep, you have to use steam desktop authenticator, winauth, or a rooted andriod phone to get the secret.

[Bubka]

Ok, thanks for the confirmation.

As a Linux user with an iPhone and no steam account I don't know how I will check steam codes generated by 2FAuth 😅

[srijansaxena11]

As a Linux user with an iPhone and no steam account I don't know how I will check steam codes generated by 2FAuth 😅

I can help with testing if required? Or you can create a free steam account? 😅

[gwlegion]

that could be a great addition to your software.
i could help with testing too

[gwlegion]

aegis (android application : https://github.com/beemdevelopment/Aegis) got the steam guard support ...
and a toturial to explain how to get a key for steam desktop authenticator or steamguard-cli
It's open source ...

[Bubka]

Thanks for the heads up.

The process to get the OTP parameters is not really accessible (this has held me back initially) but I guess a good part of 2FAuth users are tech/geek/advanced users. Will work on it seriously, this will make a great functional addition with the Google Auth import feature.

[gwlegion]

i'm here if you need help !
best way if you're not a steam user is to create a new account (free), and setup steam desktop authenticator and aegis ... you'll got the full process to get the key
i'm here if you need something