Right on, Commander!

Some very talented people have come up with a way to dump the Steam clientregistry.blob file onto a website and are stealing account credentials after decrypting the clientregistry.blob file.

The problem is caused by the fact IE explicitly trusts the local zone and since MOTD files can be stored in a file that is transferred to the client and opened locally, it's able to do a lot of things without any dialogs.

Steam uses the IE active X control for displaying MOTDs, powered by frame windows and as such and they happen to be using server MOTDs to steal the credentials.

My current recommendation is to disable Steam's storing of passwords, in theory the password information should not be stored anymore in clientregistry.blob.

My second recommendation is to set the trusted zone in Internet Explorer's settings to prompt on most actions that it would automatic accept normally.

Further discussion can be found here,
http://ash-fox.livejournal.com/35540.html