Warn of possible account hijacking

gergelyszabo94 / csgo-trader-extension

CSGO Trader Browser Extension to help with CS:GO item trading, marketing and much more

https://csgotrader.app

GNU General Public License v3.0

211 stars 41 forks source link

Warn of possible account hijacking #43

Open gergelyszabo94 opened 5 years ago

gergelyszabo94 commented 5 years ago

Warn the user that they might be hacked if an offer they are sending gets canceled or something they tried accepting gets declined. The way this could be implemented is still quite hazy in my head, but something useful could turn out of this that would save some user's items from getting scammed away.

gergelyszabo94 commented 5 years ago

Some possible indicators of an impersonator:

Having a trade link in their bio / showcase that does not belong to their account.
Having an inventory link in their bio / showcase that does not belong to their account.
Keywords: alt account, storage account, main account, discussion account.

gergelyszabo94 commented 5 years ago

Keep a database of high-profile traders like me who are the most impersonated. There could be some kind of form where people could apply, but it has to be implemented in a way that does not allow abuse.

TcQPAD commented 4 years ago

Other indicators:

People who changed their nicknames to something like BOT [A KNOWN TRADING SITE] (CS.MONEY, etc...) (impersonation)
People sending weird links in trade offers/messages, for example, clones of known trading sites (phishing attempts)
I'd add people with no trades/new accounts who ask for your expensive skins overpaid through Paypal and ask you to go first

I can try to implement these if you agree, but I'll need to dig in your code as I found your project two days ago and didn't quite read the code.

gergelyszabo94 commented 4 years ago

@TcQPAD The nickname one could be good and probably not too hard to implement. The extension could add an additional warning to trade offer with suspicious links, but I don't think this kind of scamming is too prevalent anymore. I am not sure about the third point, how would you identify these people?

I originally created this issue to try to figure something out to save people from giving their items away once their account is compromised. But I threw in some more anti-scamming ideas as well. Maybe we could give profiles a trust score. Point out if the account is newly created, has no or just few items and other things I mentioned in comments before.

Any contribution is welcome, if you need any help navigating through the project let me know! I know it grew quite large and complex over time.

TcQPAD commented 4 years ago

Hi, for the third point, we could examine their trade history (if possible, not sure it's do-able with steam API) + keywords in their trade offer?

Yes a trust score could be good. Things to consider for the trust score:

number of items in the inventory
age of the account
time spent playing games
things in previous comments

I can take a look at it mid of july, I'm quite busy with work right now haha.

gergelyszabo94 commented 4 years ago

Yes, trade history can be retrieved from the API, doing work on exactly that in #104 atm: