Disable recovery account change if password changed within 30 days

[guiltyparties]

Proposal

Hackers have been attempting to figure out how to change the recovery account on phished accounts for some time and finally succeeded. These accounts are being set to accounts owned by the hackers.

Once the recovery account is changed, the user cannot recover the account.

Solution

Changing the recovery account should be disabled for a period of 30 days following a password change.

ie. Password changed on day 1. Change recovery account possible after day 31. Day 1-30 no change permitted.

Benefits

This would prevent hackers from changing the recovery account and locking users out within the password recovery period (30 days) / recovery account change period (30 days).

Mockups / Examples

From source:

if ( account_to_recover.recovery_account.length() )   // Make sure recovery matches expected recovery account
      FC_ASSERT( account_to_recover.recovery_account == o.recovery_account, "Cannot recover an account that does not have you as there recovery partner." );
   else                                                  // Empty string recovery account defaults to top witness
      FC_ASSERT( _db.get_index< witness_index >().indices().get< by_vote_name >().begin()->owner == o.recovery_account, "Top witness must recover an account with no recovery partner." );

steem assert exception:account_to_recover.recovery_account == o.recovery_account: cannot recover an account that does not have you as there recovery partner.

User @ximeta is a phishing victim whose account is now irretrievable. It's recovery account has been set to @receive.steem, the hacker.

---

Like what we're doing? Support us as a Witness. Go to https://steemit.com/~witnesses At the bottom, type in guiltyparties Click VOTE

Comments

[fow]

Very sensible idea. Don’t see a reason why it shouldn’t be implemented.

[d-zero]

Great suggestion. But don't you think 45 days would be enough? I hope the devs would see your suggestion.

[guiltyparties]

Typo. It should be 30. I changed it to 60 for a few minutes earlier while reconsidering it but then swapped it back. The idea is to not make account recovery overcomplicated or impossible.

[azyref]

writing is very useful ... for us beginners and who still need a lot of information to learn.

I just joined the SGG, I hope my help and suggestions for the better. thanks for sharing @guiltyparties

[samhamou]

Hi @guiltyparties thank you for contributing through utopian

i am sorry we cant approve your contribution , we received many suggestions that can solve this problem ,

also other people already opened an issue about this on the steemit github repository and they are suggesting something similar to what you are suggesting here : https://github.com/steemit/steem/issues/240

---

Need help? Write a ticket on https://support.utopian.io.
Chat with us on Discord.

[utopian-moderator]

[guiltyparties]

That's a different issue predating the current situation. It's also by Dan, the person who designed the blockchain in the first place.

[rigaronib]

There are days that I wonder just how low a person can get...

[polarbeats]

That sucks for the guy hope he still gets in steemit after all that

[mariannewest]

Sounds like a good solution. Can't stand hackers...