You are aware private companies are not bound to give a rat's ass about petitions?

they aren't, but with enough backlash it can be a negative PR blow hurting the bottom line.

They actually listened when they announced Paid Workshop content, they changed their mind and decided to remove it, because a lot of people complained about it. So they do listen.

better sit back and do nothing then

well if valve really does want to fuck trading in the ass the community can at least ask for lube

working with steam trading is actually such a bitch. its senseless how many hoops they make you go through to get things to work properly (which indirectly makes it even more of a bitch to automate)

if someone is dumb enough to get their pw phished AND some email auth code they're fucking hopeless honestly. but theres probably other reasons cause there's no way they don't already know that

Was getting an email to confirm your trade not enough?

Also I don't use an Android or iOS phone. Downloading some shady .apk would be pretty ironic in this situation.

should point out: geel already has a C# lib for the mobile auth, and someone's already working on a desktop program for it with him

https://www.reddit.com/r/tf2/comments/3uc1va/ive_made_a_c_library_to_easily_enablemanageuse/

this means that the escrow's one job (a final fool-proof wall against scammers) is easily bypassable, since if you can get some twit to confirm their email trade, then you can get them to download a program

https://www.reddit.com/r/tf2/comments/3ug38r/introducing_the_steam_desktop_authenticator_beta/

actually, this might be a teensy bit worse, since now I feel like kids will see that, think "oh, I just need something that can take an SMS? alright, I'll go google it" and then their verification will be on one of the shady free sms receiver sites, of which anyone will be able to publicly view their auth

valve underestimates how dumb teens can be

worth mentioning that you get a community market discount for a few days when you switch over to the phone verification:

the problem was/is

how many people have steam on a computer and their email on a separate one?

most of these hacks are through taking over the users computer, and once that happens you can't assume email is safe

the only stupid part here is requiring SMS and all the old auth options, if it was just a requirement to have a second device it'd be fine

Exactly what I was thinking
say I person doesnt own a Andriod or iOS phone for whatever reason and they need the phone verification what are they gonna do if they want a trade ?

you get

followed by going through one of these. ofc, this means that you're now putting your fancy two-step security and invalidating one of those steps altogether, but it's still a way to bypass this regardless