You are viewing a single comment's thread from:
RE: If Something Smells Phishy, It Most Likely Is!
The key system is the part that actually fails most.
People use the master key far to often, since that is the only key that always works. and the other keys, well i still have to figure most of that out myself. I think i'm using them correct most of the time, but there is no way to be sure. As often the very key that the login screen asks about simply fails to work, then only a 'more powerful' is the only solution, and people being people then just use the strongest key to get over the bloody login wall
Hi @bifilarcoil. The key system can be confusing to new users. Here is how I use the keys:
1.NEVER use the MASTER key. Save it offline, and don't use it unless your account has been hacked/compromised, and you would only use it to change the passwords, then never again.
2. POSTING key should be used for your daily activities on Steemit like posting and commenting. That's what I do.
3. ACTIVE key should only be used used for wallet transactions, or for logging on to dapp platforms like dlive and busy that requires the active key to use. I use busy to post, but I don't use it to browse since I have to log in with my active key. I prefer to use steemit with my posting key to do all my browsing and upvotes/comments. If I do use my active key on a wallet transaction, I will log off immediately after and go back to using my posting key.
There is also the memo key, which I am not too familar with. I know if you are sending money from an exchange, you give them the public memo key. I think the private memo key is used to send a private memo message via the wallet so others can't read the message, but I am not sure myself. Don't quote me on the memo key.
Main thing is to be careful with your keys and use the POSTING key as often as possible. Try not to use the ACTIVE key unless you need to make a transaction in your wallet. NEVER use the MASTER key unless your account is compromised, say you accidently posted your key in public and then you would use the master key to change all the passwords.
Yes, however,
It is never clear what the difference is between the Active and the master key.
the posting key often dos not work / is not accepted.
Then users go into 'aaaah fuck it mode' and just use the key that always works.
and there you have the plot to a disaster. :-)
I'm now on Busy and can't check the actual key names on steemit right away to make my point. As I forgot the exact reason why i get the keys messed up.
The thing is this, is people loose full access to their accounts that is proof that they use the main / master password key phrase or something with an even more interesting name. This is probably the main reason for the confusion since steemit uses a mix these words to describe the same key.
This is where the mess begins
I try to point out why people loose the main key due to the way steemit causes confusion and people just use the master key to get rid of the hassle.
Ahh, okay.
My understanding is that the MASTER key is your all-4-one key. You can post, use it for wallet transactions, and change the account password. The last part is important, master key can be used to change the account password!
As for the ACTIVE key, you can use it to post and for wallet transactions, but it can NOT be used to change the account password. So a user who is "phished" out of the active key could lose the steem/sbd in the account, but a hacker cannot change the password on the account. If lucky, the user could log back in immediately with the master key and change all the passwords and lock the hacker out of the account before funds are stolen.
I think the problem starts with Steemit Inc. giving users the master key as the password to use when starting their account. New users don't know that they are supposed to go grab all their passwords (posting, active, memo), and then store away the master key. Most probably are using the master key, and as a result, are giving hackers an all-4-one key to their account.
I just started using Busy, and I don't really like the fact that they require the user to use the active key to log on. I use busy to write a post, but then switch back to steemit which is safer since I only have to use my posting key. Dapps like busy that require users to log on with their active key doesn't help with the phishing issue because users are "accustomed" to using the active key to use the platform. As a result, when there is a phishing attack, the user is then giving the hacker their active key, which would result in stolen funds.
If I have some time, I'll try to write a post to help newbies clarify the different keys and how they should be used. I'm not an expert on the matter, but perhaps one or two users would find it helpful.
The master key should ONLY be able to change the 'key chain' (all the user keys) AND to request a fresh master key Yet it should NOT open all the locks including the master lock.
I hope that this is still making sense as it is hard not to confuse the key names that already are a bit mixed up. :-)
Good point, yet people would then ask MANY annoying questions right from the start. :-D
Ah , that explains why i could not log in with any other key LOL I thought it was due to my keys, but now i get it!
As steemit annoys me with a policy wall and 2 checkboxes that i need to click to get to 'MY' money that kinda pisses me off.
Even my bank would not do such a stupid thing. People should always be able to access their money regardless of policy changes. That they are used from the blog stuff thats probably not such a big issue. So i moved to Busy, as that does not lock me out with a BS policy wall. A website should first respect it's users, then users will eventually respect the policy BS if it is reasonable. This is why i never used facebook, and commited 'collective MySpace Suicide' This was a solution cooked up by people who could no-longer live with the policy changed that MySpace forced on people.
It deleted the 'friends list' and all the personal data before it deleted the account.
There are many guides out there already and they all add to the confusion
As the way the keys work is a bit weird. And the naming of the keys adds to the weirdness. It would be best if steemit would do something about that. And make it more intuitive and separate the master key from the 'functionality keys'
But i guess the developers would be a bit reluctant about making changes to the key system. :-D
Don't get me started. I went through the same thing with coinbase. Of course I relented though because they held my money hostage until I confirmed identity. At least you are able to log on to steem with other dapps! That's one good thing.
As for the keys..well, a complicated system require complicated keys! We all know it definitely is not simple on here. Nothing is ever black or white.
@bifilarcoil
And this one :D
Perhaps I will slowly creep back up the engagement league. Being somewhere in the middle ranking is a good starting point.😀