Over the past week, my ears caught wind that two people close to me had their STEEM accounts hacked (cracked is the real term but we'll save semantics for another day). I met these two through STEEM communities on Discord.
So today, we are going to walk through how to keep our STEEM accounts safe from hackers. The more we understand what all the keys are and how to create good passphrases instead of lousy passwords, the safer we will be. It crossed my mind that we talked about passphrases in the past.
It turned out that we only touched on it lightly. The content at length was in podcast form from before I began posting to STEEM regularly. It is very important that all of us understand how to keep our accounts as secure as we can. When money is involved, the incentive for hackers rises.
Passphrases Not Passwords
This is an important distinction. The term 'password' indicates a single word instead of multiple words. The longer a passphrase is, the better. This is because each new character adds more entropy. Entropy is what makes the passphrase hard to guess by both computers and people.
The best method to form a passphrase is to use a system that has no ties to us. A passphrase that has our school name, birth month, and the name of our first pet may be long, but these days information is bought and sold. It does not take long for someone to learn such information about us.
Dice Lists
This is where dice lists are the most useful. A dice list is a list of thousands of words next to numbers. Search online for "EFF Diceware List" and download the file. To use this list to make a strong passphrase we take five dice and roll them. Write down the numbers and roll again. Do this five or six times.
Now those numbers we wrote down correspond to words on the list. What we get is a passphrase that looks something like this:
ramble-chowtime-modified-twins-flyable-brutishly
A string of random words that have no relation to us at all. Since it is words, it is easy for us to memorize, but due to its length it is extremely hard to guess.
Crack-ability
Look at it this way: if we can assume that any one hacker can run one trillion guesses per second, how long will it take to guess the passphrase above?
3,505 years!
That's some good odds in our favor. But let's see how fast passphrases with one less word can be cracked at one trillion guesses per second.
165 days
See how big a difference one word makes! Now keep in mind that we cannot be expected to remember a passphrase like this for every site we use. However, we need to use a different passphrase on every site. Enter password managers.
Password Managers
A password manager is a program that encrypts and stores your passwords for every site you visit. Most of them will even make a secure and random password for you. The one I use is called LastPass, and I hear good things about OnePass.
The dice-generated passphrase you make should only ever be used to log into LastPass. Never use it anywhere else or the chances that it gets stolen greatly increase.
How This All Works With STEEM
We had to cover all of that so that we can make logging into STEEM as secure as possible. We need to use LastPass or another manager to help us be sure that we are on Steemit or Busy. It is much easier for a hacker to make a fake STEEM site and steal our keys.
Once we sign up for LastPass and install the browser extension we can create the login. To do this, click on the extension icon and then click "Open my Vault." Once the page loads there is a small red circle with a + in the middle. Hover the mouse pointer over that and the + will change to a new icon; click the new icon. It should say "Add Site" off to the left, as well.
Now we see a blank version of the image below.
image from the LastPass App
- Add
https://steemit.comhere (or whatever site you use). - Enter your STEEM username.
- Copy and paste your STEEM master password here (we want to keep it safe for when we need it).
- Paste your private posting key here.
Grabbing the Keys
In order to get the keys and add them to LastPass, we need to log in with the master password or the active key (if the master password is already safe).
image from steemit.com
- Click wallet
- Click permissions
- Click "Show Private Key"
The private posting key then replaces the public key. Copy the private key and use it in Step 4 above. If you never plan on logging in with your master key, it is good to save your active private key as we did in Step 3 of LastPass.
Before we test everything out, double check all the keys and make sure there are no mistakes. The most reasonable way to do this is to make sure the first five characters of the pasted keys match what is shown on Steemit. Do the same for the last five characters in each key, as well.
It is well worth our time and effort to make sure this is all in place. Logging it with the master or active key every time is a big security risk. The day may come when we enter our key on a fake Steemit site, and then all is lost.
There is some reprieve if we are only logging in with our posting key. Then, at least, the worst the attacker can do is make posts, comments, and upvotes as us. That still is less than ideal and that is why we use LastPass. If the site is not really Steemit.com, then LastPass will not show our login options. It's a security must for all Steemians.
Bonus Tip
You can set each key as it's own login on LastPass. Then when you go to log in you can choose which to use. Just follow the steps above as we mentioned.
Thanks for reading!
If you have any questions please ask and I will do my best to get you the answer. If you have input that may make something in this post more clear please share!
Hey @jrswab thanks againg for such a good article.
the techniques that you point in this article are really good.
I was wondering why steemit is not implementng 2FA to increase the security level of the accounts? I think, it could add an extra security layer. Because if the hacker install a keylogger or use fishing in the victim computer he will be able to know the password, but if the victim is using two factor authentication, the raw password will be useless.
I think 2FA will be well appreciated here :D
All the best and keep rocking!
2fa is always a good idea in my mind! :D
We should submit a request to steemit :D
This is one of very important and instructive post I hace come across on steemit. Thanks so very much.
You are welcome <3
Well done here, this is a great summary. I'll have to make the leap into properly managed passwords and keys. At least I have this to refer to now, so it's less scary.
yes do it! It is always better to be safe than sorry
@jrswab thanks for educating the community in this.
Anytime! If you ever see a need for me to cover a topic please let me know <3
This gem of a post was discovered by the OCD Team!
Reply to this comment if you accept, and are willing to let us share your gem of a post! By accepting this, you have a chance to receive extra rewards and one of your photos in this article may be used in our compilation post!
You can follow @ocd – learn more about the project and see other Gems! We strive for transparency.
You got my permission! Thank for adding me to the pool <3
My friends are constantly asking what is a good way to manage all the keys we have on steemit. Now I can share this and they will be able to see how to. Thank you.
welcome! It is good to stay safe and maintain control of this new system.
Resteemed and bookmarked for future reference and to share with all of my friends. This is a vital post for all people to see!!! Thank you for creating such awesome and educational posts all the time!
You are welcome! The more we all know the better off we become. There has not been a blogging platform that needs use to be as cautious till now.
I find Lastpass to be a trusted Password manager I have been using for many years.
More info:
https://lastpass.com/support.php?cmd=showfaq&id=9752Yes me too. Out of at the ways to protect data and create hard to guess passwords LastPass has a great track record. It is great for everyday users only since the effort is low but the returned security is huge compared to the average user.
I just followed your steps! So easy to do. Thanks for this information.
Thanks brother and welcome to the steem blockchain! Let me know if you need anything <3
I'm always afraid if I make changes I'll lock myself out of my own account! Thanks for the step by step directions!
Anytime! Please feel free to connect on discord if you have any questions about the process.
I will, thanks. And I'll try not to put off doing it for too long!
This was incredibly easy to understand - and that's coming from someone who is still on their first cup of coffee this morning... LOL! Thanks so much for explaining this so well - I've bookmarked this post, and I plan to follow the steps you laid out later today. Thanks again!
That is great to hear! Often us nerds have trouble making this kind of stuff easy to follow. Thank you for reading and please share this wit anyone how needs it.
I'm a bit of a geek myself, but even still I thought it was well explained for the non-techheads. grin Oh, and I definitely point people in this direction when the topic comes up. 😎
Many thanks <3
Very informative and important post. I also heard someone's account being get hacked here. It's high time we make use of these new methods to improve the account security.
It becomes more and more important as the price of STEEM rises.
This is really awesome, I would love to feature this information for the minnowuniversity. Will chat with you offline about doing a lesson. Thanks for this awesome post.
I'm honored! The more people know the better off we will be as a community.
I agree with my fellow commentors. You have a nicely organized piece. Thanks.
For those advanced steemians: I keep my master password out of Lastpass even. I store it in a Veracrypt volume on USB drive offline. Lastpass only has my Posting key in the password field and my Active key in the notes field.
Cheers @jrswab
That is the best approach for storing your master key. LastPass does encrypt everything, even our login password, that is why I did not bring up this advanced messure. I actually have my master key encrypted and then stored in lastpass.
:rofl:
However, I go out of my way with to stay secure. The goal with this post is to get people away from their trash practices and this method allows for 90% of the security without much hassle.
Thanks for reading and commenting <3
Absolutely! Thanks for getting folks on board.
Cheers. 🍺
Thanks for the much needed tip @jrswab
welcome! Thanks for reading <3
I must start using all these....been taking many things for granted.
Yes please do!
Good tips! We need to protect our steem!
You know it! Keep that hard work safe <3
Thank for your posting mr @jrswab it is very comfortable for me to be better in steemit
Visit me at @arfandin
Super helpful! Thumbs up!
Glad to be of service mate!