POCKET Day 4: Security

in #pocket7 years ago


Pocket is up to 695 Genesis claims. There have been several attempts of people wanting to buy and sell tokens; I urge people to take caution in these trades. Make sure you trust the person you're trading with, or use an escrow partner that you both trust. As always, you can see offers by looking for new Pocket posts here.

Security

As designed, Pocket tokens are strictly less secure than STEEM tokens. This is because each Steem account has a couple different permission levels; the two relevant ones are called Posting and Active. When you submit a post or vote, you're using your Posting permissions. When you send STEEM or SBD or start a power down, you're using your Active permissions.

In order to make it easy to interact with Pocket on steemit.com, I made it so that Pocket only uses your Posting permission. This was a design choice that I made specifically to keep the protocol as simple as possible, but it has the unfortunate effect of reducing the security of your tokens.

Why are Posting permissions less secure than Active? If you haven't given anybody your Posting permissions (posting key), then they're not less secure. However, there are several services (including @steemvoter) which require you to give them your Posting key. @streemian is another example; it works in a different way, but it's the same idea: you give @streemian Posting permissions on your account.

So please keep in mind: Anyone who has Posting permissions on your account has full control of your POCKET tokens! It would be theft for them to take them, but it would be really really easy theft.

What are my options for securing my Pocket tokens?

  1. Don't give out Posting permissions. If you have given them out, revoke them by changing your Steemit.com password (but always make sure to keep a copy of your old password!). This answer is really unhelpful for those of you who like @steemvoter and friends.
  2. Use two separate Steem accounts; one to store your Pocket tokens and one to do voting and posting. This answer is really unhelpful for those of you who don't have the means to create new accounts.
  3. Trust the people who have Posting permissions on your account. Cryptocurrencies are not supposed to require trust, but you nearly always have to trust someone. Make your trust count.

For more information

Sort:  

The other night I was lying in bed thinking about making a text adventure game (ThePocketGame maybe?) using Pocket Tokens. It could be a bot that replies with challenges related to blockchain stuff as well as adventure items for purchase using Pocket Gold which could be obtained via Pocket tokens... if I had more time in the world, I'll seriously consider building it out. Might be fun to interact with a text adventure game on Steemit via comments. Could possibly even take it a step further and make it multiplayer where more than one person could reply on a thread and agree to team up together. So many possibilities.

Heh, love it. When I was first putting together my ideas for pocket a few months ago, I thought about making a game subchain. I never ended up coming up with a good game that wouldn't just turn into bot wars, so I went with the simple token instead.

So many possibilities.

Exactly.

pocketsend:100@lukestokes

Successful Send of 100
Sending Account: wekkel
Receiving Account: lukestokes
New sending account balance: 996799
New receiving account balance: 999999
Fee: 1
Steem trxid: bdafcf34e31fe93ba372ba6d7f507090e35f1166
Thanks for using POCKET! I am running this confirmer code.

Successful Send of 100
Sending Account: wekkel
Receiving Account: lukestokes
New sending account balance: 996799
New receiving account balance: 999999
Fee: 1
Steem trxid: bdafcf34e31fe93ba372ba6d7f507090e35f1166
I am the-tech-guy's POCKET bot. Currently running this code (develop branch).

Successful Send of 100
Sending Account: wekkel
Receiving Account: lukestokes
New sending account balance: 996799
New receiving account balance: 999999
Fee: 1
Steem trxid: bdafcf34e31fe93ba372ba6d7f507090e35f1166
Thanks for using POCKET! I am running this confirmer code.

Security is extremely important when it comes to protecting your investments! Thank you for doing a helpful breakdown of tips for securing your account @biophil!

The weak link in every security system is user of this system.
Good advices, @biophil. Thank you!

The weak link in every security system is user of this system.

Ain't that the truth. And if the user doesn't have all the information, he's in trouble.

Can we hope that someday we will have a POCKET wallet?

I'd like that! But I can't promise it. At the very least, I want to wait till Genesis is complete and we've assessed the fairness of the token distribution.

It will be very interesting to see how much POCKET tokens system will emmite.
Near 2 billions I think. May be more a little.
11th of September is a big and important date for all of us :)

I'd settle for a billion :)

Thats 1000 users. I wonder if pocket could be more fun if the group of holders would then distribute the tokens out further? Would that inspire someone to create a use for them? I would be happy to dole out my pocket tokens as a part of the experiment.

This is indeed very important info.. were there Any reports yet of stolen tokens?

No, none yet.

Good post 😄👍🏼🎼🎶🎈🎉

👍👍👍👍

i guess also that if anyone tried to send our tokens using the posting code it would be well documented on the blockchain and so not good for them to do so ,:)

Yes, it would be documented. Hopefully that's enough deterrent!

i think it would be :)

Why do you say to ''always make sure to keep a copy of your old password''?

When you change your password, your private keys are erased and replaced with new ones. Occasionally it's useful to have your old keys for some reason. This happened on Bitshares recently when Peerplays launched; Bitshares private keys could then be used to claim a balance on Peerplays. Anybody who had replaced their old Bitshares keys would lose the opportunity to claim free Peerplays.

Good to know. Thanks!

My friend resteemed the genesis post and commented as "confirm", but he didn't get the POCKET.
https://steemit.com/pocket/@biophil/genesis-pocket#@torosan/re-biophil-genesis-pocket-20170831t160523328z
Before that, he posted more than 5 times (1 story and 5 comments) on Steemit.
Could you confirm it?

Hi, sorry about your friend: @torosan is not eligible for the genesis stake, as the 5-comment threshold had to be met before I first published the genesis post.

Ok, I understand. Thank you!

Thanks a lot my friend @biophil for this info.

What are your thoughts on voting bots in general? I'm willing to give up my steemvoter relationship, but I remain torn on the issue of bots.

I've made decent money operating voting bots for curation rewards, so my opinions are at least a little biased. I think they play into my whole philosophy of incentives: everything has consequences, and it's not always obvious what those consequences are going to be.

My take is practical: we should design our systems and incentives to try to maximize fairness (and whatever else we want to maximize), while recognizing that when there's money on the table, people will take it. If people can take that money using automation, they'll do it. We're going to have bots -- so the question needs to be something like "how do we design our systems to incentivize the least-harmful bots possible?"

Curation rewards are a great example: should we or shouldn't we pay curation rewards? With curation rewards, you get lots of bots chasing curation rewards (like mine); without curation rewards, we'd get a massive explosion of these new pay-to-vote bots that everybody loves and/or hates (the randowhales, bellyrubs, selfgoat-whatever bots).

I am thinking about giving some pocket token to my commentors who comment something worthwhile on my posts. I always upvote my good commentors to encourage them. But my votes are of very less value. I think I can complement my upvotes with these tokens. What do you think?
I just had 2 questions:

  1. Is it possible to withdraw these coins in future.
  2. Can you give me a short list of the basic commands for pocket tokens like send, check balance etc. Maybe you can mention these commands in your footer as well.

pocketsend:100@siddartha

Successful Send of 100
Sending Account: wekkel
Receiving Account: siddartha
New sending account balance: 996699
New receiving account balance: 1000198
Fee: 1
Steem trxid: 61cda337f0f08fa42f1f6a6520ac13ebf22de932
Thanks for using POCKET! I am running this confirmer code.

Successful Send of 100
Sending Account: wekkel
Receiving Account: siddartha
New sending account balance: 996699
New receiving account balance: 1000198
Fee: 1
Steem trxid: 61cda337f0f08fa42f1f6a6520ac13ebf22de932
I am the-tech-guy's POCKET bot. Currently running this code (develop branch).

Successful Send of 100
Sending Account: wekkel
Receiving Account: siddartha
New sending account balance: 996699
New receiving account balance: 1000198
Fee: 1
Steem trxid: 61cda337f0f08fa42f1f6a6520ac13ebf22de932
Thanks for using POCKET! I am running this confirmer code.

  1. That will depend on whether an exchange is interested in listing them.
  2. You can do everything with pocketsend. Just start a comment with pocketsend:<amount>@<account>, <optional memo>.

So to check @siddartha's balance, I'd write
pocketsend:1@siddartha
and then a bot will give a confirmation of my balance and your balance. This costs a 1-token fee.

If you want to send some to someone, obviously just increase the amount.

Thanks for the info!

pocketsend:100@siddartha, Here, have some Pocket to start with...

Successful Send of 100
Sending Account: wekkel
Receiving Account: siddartha
New sending account balance: 999700
New receiving account balance: 1000099
Fee: 1
Steem trxid: c1bf11caa72434c86324aa0e441f8a33ef7eeb0e
Thanks for using POCKET! I am running this confirmer code.

Hey thanks Wekkel!! I really appreciate your gift!

Successful Send of 100
Sending Account: wekkel
Receiving Account: siddartha
New sending account balance: 999700
New receiving account balance: 1000099
Fee: 1
Steem trxid: c1bf11caa72434c86324aa0e441f8a33ef7eeb0e
Thanks for using POCKET! I am running this confirmer code.

 7 years ago  Reveal Comment