I would understand if you said “more convenient”, @gadrian, but… Why it would one password on SteemConnect be more secure than four different level passwords at Steemit security management? What if user exposes this one password to the smartphone data thieves?
Why not leave the option just for posting password for those who want to live dangerously? Like we did do it on Steemit.com? Why not let people decide on their own what is more secure for them?
Why it would one password on SteemConnect be more secure than four different level passwords at Steemit security management?
The private keys are encrypted on your own device. Someone needs access to your device, and nobody is crazy enough to even bother trying to break the encryption. That's why the most common attack vector is phishing or hunting user errors.
Plus, if you would have read my guide you would know on SteemConnect only private posting key are stored, not any of the others.
Why not let people decide on their own what is more secure for them?
Most people don't give importance to security until they lose their accounts and it may be too late for them.
The most dangerous thing to a user's account is the user himself.
If you want to live dangerously, be my guest, but overall an application has to take a responsible approach.
The private keys are encrypted on your own device. Someone needs access to your device, and nobody is crazy enough to even bother trying to break the encryption.
He doesn’t need to bother with encryption if he gets the SteemConnect password. Are we talking about the same things?
Maybe you mistaken the SteemConnect password with your account's master password.
That indeed is a very sensitive password and in my opinion never to be used, because, if leaked, it allows everything on your account, including changing the owner of the account.
Because that's not safe/recommended.
I would understand if you said “more convenient”, @gadrian, but… Why it would one password on SteemConnect be more secure than four different level passwords at Steemit security management? What if user exposes this one password to the smartphone data thieves?
Why not leave the option just for posting password for those who want to live dangerously? Like we did do it on Steemit.com? Why not let people decide on their own what is more secure for them?
The private keys are encrypted on your own device. Someone needs access to your device, and nobody is crazy enough to even bother trying to break the encryption. That's why the most common attack vector is phishing or hunting user errors.
Plus, if you would have read my guide you would know on SteemConnect only private posting key are stored, not any of the others.
Most people don't give importance to security until they lose their accounts and it may be too late for them.
The most dangerous thing to a user's account is the user himself.
If you want to live dangerously, be my guest, but overall an application has to take a responsible approach.
He doesn’t need to bother with encryption if he gets the SteemConnect password. Are we talking about the same things?
Yes we are talking about the same things.
The SteemConnect password is a way to unlock access to verify the private key that is stored. But the private key is stored encrypted.
OK, just one more step: When someone gets your SteemConnect password, he has a full access to your account, right?
Nope.
Without the private keys, the password is useless. That doesn't mean one should broadcast it in the open. It's an additional security step.
The same password unlocking protection is used by Steem Keychain, and by some of the most powerful password management tools existent online.
Maybe you mistaken the SteemConnect password with your account's master password.
That indeed is a very sensitive password and in my opinion never to be used, because, if leaked, it allows everything on your account, including changing the owner of the account.