Was talking about this with jshackles earlier on IRC, but here's how I think Valve could help avoid people being defrauded on the secondary key market.
- Create a private, rate-limited API for resale platforms to verify key status.
- The API takes the following arguments: 1) an API key, 2) a steam key, 3) an app id, 4) optionally, a small number of 5-6 user ids.
- If the API key is not provided or invalid, the request is rejected. Multiple rejections and you get blocked.
- If the API key has been used by any unauthorized IP address, the request is rejected, so end users cannot use the API key and sites cannot have the end-user do it client side. Multiple rejections and you get blocked.
- Valve checks the status of the Steam key you provide.
- If it's an invalid steam key or the steam key does not match the app id, you get a {"status": "invalid"} response. If you submit more than <x> invalid requests a day, you are cut off, where <x> is very low. Get cut off a few times and you get blocked. So it is not viable to use this in parallel to scan the key space--also, requiring the app id verification makes it exponentially more difficult to bruteforce keys.
- If it's a valid steam key that matches the app id, you either get {"status": "redeemed"} or {"status": "unredeemed"} responses.
- If the status is redeemed, and you provided a user id that matches the user id that redeemed it, you get a {"redeemedby": userid} response. If you try to check more than, say, 10 unique user ids through this API per day, you are cut off. Get cut off multiple times and you get blocked.
This would:
a) Not have an excessive server burden
b) Not be a security risk
c) Give people peace of mind in secondary resale
d) Empower stores to investigate fraud cases effectively
e) Empower devs to investigate chargeback cases effectively
f) Empower Valve to track the secondary market more effectively.
And they already have a more burdensome version of this by letting you put in a key, see that it's already redeemed, and trigger the nonsense "who redeemed this" email. So actually, this would lower the resources they need to expend on that feature.