Yesterday I went into the HiveDevs channel to ask a few questions.
Now that @steem is no longer a trustworthy source for account recovery, my account is at risk. I'm on a mission to change my recovery account using an offline device so I know the transition is 100% secure (but mostly because it's a good dev exercise). Once I figure that out it should be pretty easy to change my keys in the same way. After everything is said and done I should have an account that is 100% secure against all malicious attacks that don't involve a home invasion (and maybe even then when recovery is accounted for).
I never wrote down the Owner key for my account.
I only wrote down the master key as I never understood what the owner key was for. Apparently I've come to find out that it's actually the master key that really doesn't do anything except generate the other keys. You have to sign transactions with those other keys. Therefore, I need my owner key if I want to change my recovery account or if I want to change my keys.
var key = dsteem.PrivateKey.fromLogin('username', 'password', 'posting')
I found this little morsel in the dsteem documentation and it ended up working. By replacing 'username' with 'edicted' and 'password' with my master key and 'posting' with 'owner' I'll be able to derive my owner key from an offline device.
<script src="https://unpkg.com/dsteem@^0.10.0/dist/dsteem.js"></script>
However...
This is the code I've been using in all my scripts to utilize dsteem. Everytime I run a Hive script it imports the code from unpkg.com... obviously if I'm doing this stuff on an offline device this will not be possible. Therefore, I finally figured out how to get a physical copy of the dsteem code from GitHub and import it locally to my machine. In the end all it required was downloading a file called dsteem.js and dsteem.js.map from the source code.
<script src="dsteem.js"></script>
By putting this source code into the same folder as my scripts I can now run it without connecting to the unpkg.com website. Sorted. Although I couldn't find version 10 and the physical copy that I'm using is version 9, I'm sure that doesn't matter considering I'm only doing the bare-bones basics.
Making accounts for your friends/family.
This is what I really wanted to talk about. I realized the other day (from the master key generator function and by using SteemWorld account creation) that the name of your account plays a part in how your keys are generated.
var key = dsteem.PrivateKey.fromLogin('username', 'password', 'posting')
This is really cool because it solves a problem that I've been having. The people who I told to make Steem accounts have all lost their passwords (except for the ones that I specifically saved for them). They all just assumed they could recover their accounts using a centralized service. Then they got mad and blamed our platform for being bad (lol go figure). This happens all the time and it will keep happening. We need to centralize the security of low-value accounts so noobs stop losing them.
How does this feature help?
Well, now every time I create an account for someone, I can use the same master password to generate the keys for dozens of accounts, and none of those accounts will have the same keys or know what master password was used to create them. If anyone I create an account for loses their keys, I can regenerate their keys knowing it's all centralized to the same master password.
Obviously this kind of centralization is a security risk. What if someone gets a hold on my master password and steals dozens of accounts? However, the combined value of all these accounts will be very low, so it's not a big deal. Also, I will instruct anyone I create an account for about how insecure their account is and they need to take security more seriously if their account ever becomes worth a significant amount.
The majesty of recovery accounts.
Even in a situation where I became malicious and tried to steal the accounts I created with the master key, I would not be able to steal the accounts I created if the recovery account points to someone else. Again, this is another super valuable feature of Steem. I would have full access to ALL the private keys of dozens of accounts, yet I would not be able to steal any of those powered up funds (or even coins locked in the bank account for 3 days). How many other platforms can boast such powerful security? Only Graphene-based ones.
Example
I make an account for my friend with my master key. My friend powers up 100k Hive but never changes his keys. My friend sleeps with my wife. I try to steal his account; I change his keys and start a powerdown. My ex-friend contacts his recovery account and changes the owner key back under his control. Even when I had access to everything (except the recovery account) I could not steal his money. This is truly amazing.
Conclusion
The Graphene platform is really complicated but I'm slowly learning the ropes.
I see Hive as a network that I could learn and develop on for life as a career.
These are just the opening moves of something much greater.
I have a question: if you generate the private keys for your ex-friend with your master password that are (owner,active,posting and memo). Does it means that the new account doesn't have a own master password? Do I understand well?
Edit: That's strange I definitely didn't understand..ops :)
Yes, basically.
The master password would be the one you used,
and you wouldn't tell them what it was because you use it for multiple accounts.
So they'd have a master password but they wouldn't know it (or need it)
They can always change all their keys later (including the master) with the owner key.
Rather, they'd generate a random Master Key on their own and then sign it with the old owner key to make it official and change all their keys.
ahhhh ok so they are like some child account created by one. I didn't know that.
So they have to guard all their keys...(I mean recently I changed my recovery account and I didn't have my owner key so I use my master pass to see it on Peakd), otherwise they will tell you to give their keys again.
Anyway thanks for the explanation, and good luck with your script, I think it is a cool thing!
Bye
Eeep! This stuff is so complicated for us non-techy folks!! I need to update my recovery account as it's currently Steem or Steemit. But, i don't know who or how to set up the recovery account to a new one. Argh! An offline device....that sounds really complex! So much to learn.
With all this said hive and steem will never get to the mass adoption. Average Joes and Janes will never grasp this.
Posted Using LeoFinance