Will you see the best ways to keep our Steemit accounts safe because until today I was not practicing these myself? After researching the best practices for keeping my account secure, I started logging in a new way to Steemit today because I realize how easy it would be to lose access to my account and found an easy way to avoid this. That said, the most likely way for each of us to lose access to our account is to LOSE OUR OWN PASSWORD which I provide help with below the initial tutorial.
Just having a copy and paste text document or a piece of paper in our wallets or remembering passwords places us at risk of losing our own passwords and makes it easy for someone else to steal them. While any of these ways of keeping passwords are probably okay for logging into Steemit with posting and active private keys, we need something better for the account password. Having a secure and reliable password system in place is HIGHLY RECOMMENDED when using any cryptocurrency wallet online especially on Steemit for keeping the main password safe! LastPass is what I use because it allows me to have my passwords available on any device and generate new secure passwords automatically while remembering one ultra secure master password for the account and 2 factor authentication options making it challenging for anyone but me to sign in.
A simple trick for greater account security.
The easiest method to maintain greater Steemit account security is to log in with our POSTING PRIVATE KEY instead of using the account password. If anyone gets access to our password, they can immediately withdraw any Steem or Steem Dollars and begin powering down all Steem Power, and block us from signing back by setting a new password. Fortunately the recovery process gives a possibility to get the account back but why bother with the risk when there is a simple way to avoid it? Meanwhile, if the posting key is stolen the worst someone is going to do is blow all our voting power or follow a bunch of people we don't want to follow or make crazy posts with our account.
To make transfers, then we also use the ACTIVE PRIVATE KEY to sign the transaction instead of the password for our account because we cannot get locked out of our account just by losing the active key and we can immediately stop any active key theft transactions by changing the password which resets all the private and public keys. Today I tested using the active key for both and IT DID NOT WORK TO POST OR UPVOTE which was surprising because previous guides suggested it would.
Where are the private keys?
To find your private keys, you will need to be logged in with your password and then visit https://steemit.com/@jerrybanfield/permissions except switch your username in place of mine. It should look like this.
See that the posting key, the active key, and the memo key each have private keys along with public keys. To see all of these, log in with the master password and click Show private key or Log in to show. All public keys can be viewed on https://steemd.com/@jerrybanfield on any profile. The private keys are effectively lesser access passwords we can use to give limited access to our Steemit account which is extremely helpful to keep the account secure.
What does each key do?
- The Private Posting Key allows permission to create posts, vote, and follow other accounts meaning it handles most everyday activities. Ideally we stay logged in with the posting key and then need to use the active key for transfers ...
- The Active Private Key allows transferring, trading, powering up, powering down Steem Power, and voting for witnesses. Unlike what I read in previous guides, my active key today DOES NOT allow me to post which might have changed from how it was months ago. I tried and while logged in with the active key it would not even allow me to vote for a post. Thus, I log in by default with the posting key and then put the active key in when I need to take any of these actions.
- The Memo Private Key allows for private messaging. I am not sure if this feature is active now or not. I believe when it is working that anyone with my private memo key would be able to send me a message privately on Steemit. For today, I do not use this key.
- The Owner Private Key allows full access to everything EXCEPT changing the password. You will not see the option to view the owner private key in Steemit today because they removed it at some point. Now I believe you can only get it in the CLI wallet or with a script using the password. Ideally it would be good to grab a copy of the owner private key to help with recovery if needed. For simplicity, I suggest just focusing on the password because that has greater access than the owner key and as long as you have the last password, account recovery is possible. If you want to get your owner private key, try this guide https://steemit.com/steemhelp/@dantheman/get-your-private-key-from-your-steemit.
- The Signing Key is used by witnesses and unless you are going to be a witness as I am hoping to be soon, this key is not relevant for day to day activities and is not seen in the Steemit wallet.
For greater account security, log in with the private posting key by default and then sign in with the active key to make transfers.
This is what I am doing now because it is STUPID EASY when we are using the password every day to sign in to have a security breach. We could accidentally copy and paste the password when logging in with it on a daily basis. Several users recently posted their passwords into memo fields on transactions and one white hat hacker thankfully told them about it before a black hat hacker came along and locked them out of their accounts. It also seems not too difficult to hack wifi networks, let someone see your password when you sign in with it, or any of the other thousands of ways to end up letting the password slip out when using it every day. For example, I just finished a trip where I signed into Steemit on a hotel wifi using my password. Someone easily could have been monitoring it and got into my account that way. Now as I use the posting keys, the risk for all these drops a lot and the master password can be kept only for special occasions!
Without the need to use the Steemit account password for signing in each day, our Steemit wallet password can now be easily kept ultra safe using any method from a fire box at home to hiding it in a secret place to getting a safety deposit box to placing it in a password manager under a different name or one of any millions of other tricks you can think of it keep it safe. The one big problem with this is that the harder it is to find, the easier it might be to lose.
The #1 real security risk with our Steemit account is losing our own access to it.
Nearly any statistics of crime and any qualitative research into what makes our lives difficult consistently reveals one uncomfortable fact. We are the most likely ones to cause ourselves a problem. All crime combined is nothing compared to the amount of us that take our own lives directly and especially indirectly through overdoses and related accidents such as drunk driving. Nearly every bad thing in my life that has happened was a result of my own choices.
Therefore the surprising fact is that the main risk to losing access to our accounts is losing access to our own password. If you are using the keys to sign in as I suggest here, at least if the master password is lost you can still post and make transactions as long as you keep those keys. You might even be able to use them to recover your account depending on the evolution of Steemit account recovery. If you sign in with your password and NEVER PULL THE KEYS and LOSE YOUR PASSWORD, that is it! No more account access. If I had to guess, I would say at least 1,000 out of 200,000+ users already have lost their password and are locked out of their accounts.
Being locked out of our own accounts is almost completely preventable with using a password manager combined with some kind of offline backup. Lastpass is what I use because it makes it easy to generate, store, and use passwords on any device while giving me the chance to make one strong master password I remember to get to all of my other passwords.
Combining LastPass with an offline backup gives me an ideal solution for my passwords with ease of use daily and a fail safe in case something happens with LastPass. With using my posting and active keys to sign in now to Steemit, I now have the option to keep my Steemit password out of LastPass to help minimize the consequences of a LastPass security breach whereas before I had to have it in there to sign in each day.
What is challenging for many of us to understand is how easy it is to lose a password when we have so many accounts online that we often do not use for long periods of time. I have lost access to many passwords in the past but was always able to get back in using email. With Steemit, this option is not available if you signed up lately because account recovery via email is not an option as far as I see today. Other cryptocurrency wallets offer absolutely no hope of help making a password manager critical for security online today.
How and when to change the password?
Making a new password is a bit uncomfortable because if we mess it up, we are now locked out. A significant percentage of all my account troubles online have been right after changing the password. Ideally when we make new accounts we would store our generated password safely and use the posting and active keys daily to sign in which would minimize the need to change the password. However, if like me and you have been using it to sign in everywhere such as on different networks and devices every day, changing the password is probably a good idea before switching to using active and posting keys to login because if anyone got access to the password before without using it right away, it will be completely useless to them after 30 days from the change.
Here is what the change password looks like for me at https://steemit.com/@jerrybanfield/password. Change the username to see yours or just go into the wallet and select password from your profile picture at the top right.
Fortunately Steemit generates a password for us which should be copied and pasted into whatever password backup system we are using and then either copied and pasted back from it or manually typed in to the retype password field to change. When I tried to do mine, I got an error about the owner key permissions first and then it seemed to work the next time upon resubmitting again without refreshing or anything.
Thank you for reading this post because I hope it is helpful for you in keeping your Steemit account secure today! Thank you to @pfunk for his guide A User's Guide to the Different Steem Keys or Passwords at https://steemit.com/steemit-guides/@pfunk/a-user-s-guide-to-the-different-steem-keys-or-passwords because this was a starting point for my research today.
If you think this is a helpful post for Steemit users, would you please upvote this because it will help more of us see the simple tips for keeping our accounts secure that might help a lot of us avoid getting hacked?
Love,
Jerry Banfield
I was just looking for info on security.. thanks
The same thing for me here bro. Thanks Jerry thats really useful and great
I'm on the same boat thanks to @jerrybanfield my account is safe!
This is so great to know @Jerrybanfield because many users here are unaware of how much security is involved with a Steemit account. Its also great to know those keys because if for some reason Steemit's website is down you can still get your steem outside the application if you need them for reason like bills, trading etc. Cheers Jerry.
Mark
I really wish they had a 2FA option
Indeed. I suggested this as an improvement a while ago. They need to consider this as a MINIMUM.
I'm sure they are will have it in th near future!
Jerry you look really sad and serious.
I vote we get happy, manic Jerry back.
I love the way his expressions are in every post. All those expressions are as per post nature.
Thanks fir the info.
This is one great post. Security is my favorite topic.
BTW, I sent you msg yesterday on Twitter. Not response. I wonder if you got it?
Great post
Another security guy here🤓.
I like that we can use the posting key. More people need to know about this one
Your password should always be sensible and unique💡
literally I'm mesmerized by your article
You bring out some great stuff out of your sharf mind that no one does!!
Its need great dedication and great IQ power
Keep steeming
God bless you
Thanks Jerry! New to Steemit and you have been a great help! Thank you! 😀
yup.. its good to have each others backs when it comes to security! Way too much to deal with for one brain!
I'm guessing if you saw Jerry's Twitter messages you will be in triple digits of unread DM's! ;-)
I do not check Twitter would you comment here please?
follow me please i did it thanks alot!!....
good work
Do you have a twitter account?
I thought you may know one thing, which i can not find out for myself. Been looking here and there for quite some time. No luck.
Q:
What is the exact formula of the algorithm, at which the voting power is rebuilding up again (vs time), after it has been reduced by upvoting?
Is it up +20% per day from any given moment? Which would then be like this - after 100 upvotes ( in short time) power is down to 13,26% (1*0.98^100), and to rebuilcd this up to 100% it would take 266 hours, or 11 days. Is this how it goes? Or my understanding is wrong.? Where? And where i could find described this rebuilding algorithm in detail?
follow me please i did it thanks alot!!....
good work
You have impeccable timing Jerry, thanks a ton.
follow me please i did it thanks alot!!....
good work
Thanks, this was very helpful.
Gmail, Dropbox and Wordpress can be secured with a Trezor hardware wallet. This can be made possible for Steemit too!
https://steemit.com/hardwarewallet/@michiel/hardware-wallets-new-and-incredible-interesting-devices-idea-for-steemit
follow me please i did it thanks alot!!....
good work
Great info. I didn't want to log into my work computer for security reasons, but I can just login with the posting key.
A good method to discourage people from trying to hack you is to have your funds in Steem Power. That way even if they managed to get in, they wouldn't be able to withdraw right away.
They can power it down mate
They can, but that takes longer than the 3 days it takes to be able to withdraw from savings which is supposed to exist for security.
Thank you for the info, will implement this right away :D
This is a great idea! I was also thinking why not have a 2FA when you login? Only thing I can think of is that too many people use the site too much and it'd be annoying having to do that 4-5 times per day? Thanks for the research!
Essential information! Thank you for this guide.
@jerrybanfield This is a fantastically informative post and glad to see someone writing about this so recently since old sources of news may be unreliable.
Thanks so much for putting the time into writing this post and making everything so clear.
Finally someone has addressed this issue, I have been wanting to invest in steem but it never felt safe enough for me to do so, thanks @jerrybanfield
I am seeing jerry even more active and helping this last week. He will do more helping post in coming week as well.
Extremely important post for new users to this crypto world. You can't remind people enough about the importance of a good password and a secure place to keep it.
Thanks for the detailed explenation Jerry! Makes it easier for me to just show my friends this post :)
never a dull post for you, is there?
Thank you jerrybanfield I have been searching for this info. Do you think Steemit will introduce 2 factor authentication in the future?
I hope so with 2FA recovery as well!
Let´s hope so!!
some really great tips here for beginners when it comes to properly securing their passwords. Keep that Master PW offline as much as possible! Thanks for sharing @jerrybanfield!
@jerrybanfield thank you! I definitely fall into the category of that person who forgot their password. Also, come to think of it, I dont really remember setting one up. DANG!
2 factor is a must! I liked your simple trick to better security didn't think of that one before.
@jeerbanfield the BOMB! Always got good content and supports the community! :)
I was thinking about your online safety, since you’re so public about earnings, though we love to know what’s possible with this platform, among others. I’ve been pretty carefree with my passwords before. Just signed up to LassPass.
that is very usefull! tanks!
Is there any way to recover my password if I were to lose it?
You can go to account recovery but it might not be possible to get back in!
How is he even on the account ?
Your stuff is always so informative. I never knew what to do with all the keys lol. Thanks for info
Thanks @jerrybanfield for sharing these incredibly important security advice, learnt a lot from this post.
Awesome tutorials. Your articles are just amazing. Upvote follow or resteem all done man (y) Good Luck for next articles @jerrybangield
Amazing , i was just wondering how to do that myself and you come up with the answer.
Hey Jerry, thanks so much for teaching me about all this. I'm getting so wrapped up in my excitement for steem (buying power etc) that I hadn't yet taken enough measures to ensure that if/when steem does blow up, I'll have a safe and accessible account.
That has been corrected!
Security is very important, thanks for the blog post.
Very nice tutorial thank you! :)
hi plwase follow me right now i'm following yoy. https://steemit.com/@sabresaad
Very Useful... Might have to change mine soon :)
Again thank you for a very helpful post!
another great post, always posting useful info.
Great post again Jerry! Never loose your private keys
Very interesting post Thank you so much
A very good post from you, as security is the key to being safe online. Thanks for your post and keep it up
I was just thinking about this today after the post I wrote about SP delegation. Glad I listened to my friend @freetissues and followed you yesterday.
Great post! I'm going to put some of these tips into action immediately.
Thanks for the article! Thats some good information, especially if you put lots of money into your account. upvoted :)
Thanks jerry for the advice, one month on steemit and I was always using my password,now I'll be loging in with my posting key, thanks to you !! :D
nice post!!!
(upvoted)
great info Jerry. thanks for sharing this.
Thanks for all the information! Being new to steemit, it's nice to get such informative posts.
@jerrybanfield i hate asking for help but i need right now :( i believe in steemit community https://steemit.com/job/@tookas/help-just-lost-my-job-and-need-to-pay-my-bills
You're a life saver
hi plwase follow me right now i'm following yoy. https://steemit.com/@sabresaad
I am in hurry to secure my account
Thank you so much
@prabhat.chugh @shivek
Check this out man , it will help us all
Yeah you're right
Thank you sir...!! I was also looking for account security tips ... :)