Security: Watch out, this is Steem by tarazkp

View this thread on: hive.blog | peakd.com | ecency.com

security · @tarazkp · Sep 19 '18 (edited)

$28.40

Security: Watch out, this is Steem

There is another phishing attack ongoing and unfortunately @surfermarly, one of the most experienced members of the community was caught out. Thankfully, she has control of her account back from one of the assholes who do these kinds of things. You can can see details of this particular phishing approach [here in a post](https://steemit.com/steemit/@arcange/phishing-attempts-are-running-and-use-fake-comments-with-images) by @arcange. Sadly, everyone must remain vigilant at all times because big or small, due to the value in wallets, we are all targets.

![20180918_204902.jpg](https://cdn.steemitimages.com/DQma2khkAgSKrQ4YLn4So48kkRGn8eoaiiAY5GuMVcJuxnn/20180918_204902.jpg)

However, this should also send more alarm bells ringing than vigilance because of it can happen to an experienced user, it can happen to anyone and often does.

Most people aren't used to having to protect keys in this way and they aren't used to bring on a decentralised system where recovery isn't easy. Most are also not accustomed to being direct targets and very few on earth are used to being targeted openly and publicly.

This is Steem and *all* of crypto it seems and is an obvious drawback of allowing close to total anonymity. But something must be done on Steem *if* we are going to ever mainstream this community.

The system is complex in itself but I am sure there are many people who do not understand their keys and why and where to use them. The amount of people who lose their master is very high which is a symptom (and risk) of being used to having a centralised authority to message behind a *"lost password?"* link.

In Steem there is a lot more responsibility put on the individual than on other platforms and no clear guidelines of how best to organise security maintenance. Keep your keys safe and offline is good advice but considering people are accessing their accounts from multiple points as well as mobile devices, very impractical.

From my understanding (I have recently heard), 2FA is not possible for some reason, but there must be other ways that can be used to protect an account even in the event of a lost key.

The problem is that mass adoption means many people coming onto the platform who are a lot less security conscience than the average crypto enthusiast and on an immutable blockchain, the number of stolen and dead accounts is going to grow rapidly. It is going to be a tough sell to keep explaining why we can do nothing about theft and we offer no real preventative protection against it for the *average* user.

There is a high learning curve here already but is it wise to have the idea of security and watch out for bad actors the first lesson learned coming into a community? If the experienced struggle with this, what hope do the newbies have? Not everyone should have to learn the hard way when it comes to account security and their should be some clear advice and solutions available that even the most basic user can understand considering this is a global community.

I am unsure what is in the pipeline for security measures but in my opinion, a lot more needs to be developed to both simplify account management and complicate account theft before a million more people come I and lose their keys to a phishing attack in their first week and have their account turned into one of the soldiers in a bot army.

Online security is a difficult area because often it requires some level of centralisation which becomes a weak and contentious point in a decentralised community. There is some kind of *lesser of two evils* concept at play but I am unsure which is the larger evil of the two.

Until something is in place though, everyone has to remain on guard at all times and of something seems out of place like a login screen, it probably is it of place and should be treated with extreme caution. There are always going to be bad actors on Steem and in the world and this is why having a healthy and supportive community inherently provides some measure of security to protect its members.

*All for one, one for all.*

What are your thoughts on security on Steem and do you have any good advice or trusted tools to maintain security across devices?

Taraz
[ a Steem original ]
<sub>(posted from phone)</sub>

👍 pharesim, v4vapid, anomadsoul, tashidelek, tarazkp, nonameslefttouse, steem-ua, ngc, centerlink, mattclarke, fulltimebot45, fulltimebot69, fulltimebot68, fulltimebot65, abh12345, sorin.cristescu, suomibotti, helpie, alexdory, galenkp, ladyrebecca, surfermarly, arcange, toofasteddie, markkujantunen, crimsonclad, fknmayhem, enjoywithtroy, wolfhart, castleberry, gotmeens, akipponn, isaria, cryptoandcoffee, mindtrap, benleemusic, thecyclist, truthbot, blewitt, nelyp, not-a-bird, largelyuseless, sbi7, pipurilla, berniesanders, bart2305, clayboyn, infamousit, carrieallen, eugenekul, donkeyslayer, minismallholding, evilest-fiend, musicvoter, rodneysreviews, randomthoughts, raphaelle, jk6276, eonwarped, lordbutterfly, blessed-girl, teamaustralia, insaneworks, lillywilton, and 78 others

`author`	tarazkp
`permlink`	security-watch-out-this-is-steem
`category`	security
`json_metadata`	{"tags":["security","steem","phishing","community","future"],"users":["surfermarly","arcange"],"image":["https://cdn.steemitimages.com/DQma2khkAgSKrQ4YLn4So48kkRGn8eoaiiAY5GuMVcJuxnn/20180918_204902.jpg"],"links":["https://steemit.com/steemit/@arcange/phishing-attempts-are-running-and-use-fake-comments-with-images"],"app":"steemit/0.1","format":"markdown"}
`created`	2018-09-18 18:43:39
`last_update`	2018-09-19 08:15:54
`depth`	0
`children`	42
`last_payout`	2018-09-25 18:43:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	21.899 HBD
`curator_payout_value`	6.496 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	4,266
`author_reputation`	5,837,594,903,387,606
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,608,424
`net_rshares`	22,103,783,919,681
`author_curate_reward`	""

properties (23)vote details (142)

voter	rshares	pct
berniesanders	4,826,195,747	0.75%
pharesim	10,924,982,758,004	100%
nextgencrypto	1,244,089,139	0.75%
daan	514,488,160	1%
arcange	31,955,103,905	5%
raphaelle	2,896,161,904	5%
akipponn	13,188,044,175	100%
surfermarly	35,110,063,578	100%
elamental	265,030,176	1%
anarcho-andrei	749,530,122	1.5%
mattclarke	141,197,479,893	20%
thecyclist	11,810,205,186	0.75%
abh12345	88,470,517,488	10%
votehumanity	175,365,210	0.5%
nelyp	8,685,195,097	20%
largelyuseless	6,011,152,682	100%
clayboyn	4,532,801,611	5%
cardinalkennedy	545,422,589	20%
nonameslefttouse	462,002,672,648	50%
engagement	416,530,131	0.75%
v4vapid	3,899,234,277,663	29%
iflagtrash	155,526,314	0.75%
tarazkp	669,267,539,077	100%
markkujantunen	30,158,644,228	44%
randomthoughts	2,908,817,445	0.75%
bart2305	4,640,269,320	3%
anomadsoul	2,058,304,938,353	20%
pipurilla	5,413,312,961	12%
enjoywithtroy	25,314,573,387	37%
momogrow	1,092,543,573	2.5%
gohba.handcrafts	1,397,159,705	5%
isaria	13,087,016,994	5%
ladyrebecca	41,765,124,884	100%
galenkp	47,496,895,618	100%
crimsonclad	29,968,515,744	10%
teamaustralia	2,196,391,169	3%
centerlink	143,299,928,870	20%
jonmagnusson	252,721,780	0.5%
jayna	381,747,244	0.75%
thedelegator	1,394,734,797	0.75%
toofasteddie	31,467,370,771	31%
amymya	210,431,601	0.2%
redrica	337,323,925	1.1%
avesa	278,301,421	0.33%
minismallholding	3,501,122,848	10%
djlethalskillz	1,327,248,051	2%
kiriatjrb	77,531,439	5%
trevorpetrie	801,716,537	5%
torico	335,356,211	0.4%
diantbi	1,428,127,519	10%
sorin.cristescu	78,947,317,709	50%
carrieallen	3,977,551,518	10%
melavie	131,603,418	1%
infamousit	4,493,474,669	25%
gotmeens	21,219,842,416	100%
art-mess	76,276,887	2.5%
castleberry	21,872,109,712	100%
ngc	151,195,007,112	0.75%
rogeviolinista	89,864,698	5%
fknmayhem	26,671,149,089	70%
socent	495,709,807	15%
eonwarped	2,755,589,084	1%
karolisp	112,720,484	1%
not-a-bird	7,923,483,811	50%
pechichemena	218,148,745	1%
evilest-fiend	3,464,715,083	100%
steemobserver	147,643,574	59.5%
helpie	58,443,742,600	5%
markaustin	211,344,918	5%
luisferchav	215,278,107	2.5%
not-a-cat	1,436,906,557	100%
soulturtle	134,139,048	1%
mountainjewel	273,919,347	0.5%
notoriousrebel	481,228,684	100%
carpedimus	85,131,994	2.5%
abdulqayyum9585	483,001,893	100%
rhmi90	188,487,292	5%
sixdorks	421,422,239	52.5%
fieryfootprints	967,407,940	100%
grizzle	197,524,273	1%
heajin	104,582,877	20%
hazem91	173,048,285	1.25%
verhp11	178,596,853	0.5%
atomcollector	963,837,499	3%
alexdory	56,616,721,025	100%
kryptoe	129,716,711	0.33%
benleemusic	12,320,895,878	5%
eugenekul	3,771,444,362	100%
jbrrd	158,789,131	11%
suomibotti	60,019,771,416	25%
mindtrap	12,964,662,737	20%
wandairawan	146,305,785	100%
spawnband	97,179,976	1%
foxyspirit	218,548,540	1%
grayarty	96,307,101	5%
theturtleproject	198,548,966	5%
hlezama	1,371,141,437	100%
rognel2904	60,735,455	10%
derangedvisions	654,002,671	1%
wolfhart	25,079,587,701	50%
blessed-girl	2,481,379,567	100%
lordbutterfly	2,571,709,826	10%
veckinon	150,041,664	2.5%
archaimusic	258,640,633	10%
musicvoter	3,156,041,588	1%
thexreposts	211,650,782	10%
educatie	208,505,947	100%
musicvoter2	147,347,334	10%
cryptoandcoffee	13,041,279,157	40%
insaneworks	1,777,611,928	100%
ghost2	465,011,870	100%
sp33dygonzales	172,764,687	50%
medicnet	602,358,050	100%
communityisyou	602,358,050	100%
lordofreward	237,940,582	1.5%
honshu	623,693,236	100%
blewitt	9,400,330,830	4%
dinoromanelli	87,031,260	1%
mrart	65,625,045	10%
tashidelek	1,917,550,888,588	100%
lillywilton	1,688,096,795	20%
jk6276	2,786,066,510	50%
sbi7	5,627,738,175	3%
filletsslither	561,544,121	100%
steemcontesting	596,369,814	100%
emsteemians	524,625,208	10%
donkeyslayer	3,738,586,530	100%
rodneysreviews	3,042,875,550	100%
hornetmusic	172,141,997	50%
fulltimebot45	122,949,679,782	100%
truthbot	10,137,304,069	100%
fulltimebot65	122,571,972,250	100%
fulltimebot68	122,608,344,694	100%
fulltimebot69	122,616,329,956	100%
steem-ua	305,735,632,770	1.2%
lovepreet2511	1,560,670,031	100%
manoldonchev	627,929,927	100%
steemitbuzz	90,706,261	50%
hdu	221,504,678	2%
curbot	1,516,873,503	5%
spotlit	260,208,783	100%
prince23	606,323,645	100%

@cryptoandcoffee · Sep 18 '18

$0.03

We have to keep an eye out for everyone as it happens. I wish there was some other barrier of security that could be found. I know the power down takes 13 weeks but when Steem rockets this place would be like hitting a bank. It will become more serious than a few thousand dollars as we are talking in some cases millions.

👍 tarazkp

`author`	cryptoandcoffee
`permlink`	re-tarazkp-security-watch-out-this-is-steem-20180918t185218697z
`category`	security
`json_metadata`	{"tags":["security"],"app":"steemit/0.1"}
`created`	2018-09-18 18:52:21
`last_update`	2018-09-18 18:52:21
`depth`	1
`children`	3
`last_payout`	2018-09-25 18:52:21
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.028 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	322
`author_reputation`	3,573,385,714,783,742
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,608,952
`net_rshares`	28,601,176,883
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
tarazkp	0 B		28,601,176,883	4%

@tarazkp · Sep 18 '18

$0.02

people can have Steem sitting in their wallet liquid too and sometimes, that is quite a lot. I am not sure what solutions are available but even a simple secondary pin with 3 attempts might be enough for most cases. Re-login would need master and come with an additional warning that the pin was inputted wrongly and to change the keys if it wasn't you.

👍 milky-concrete, cryptoandcoffee

`author`	tarazkp
`permlink`	re-cryptoandcoffee-re-tarazkp-security-watch-out-this-is-steem-20180918t185809230z
`category`	security
`json_metadata`	{"tags":["security"],"app":"steemit/0.1"}
`created`	2018-09-18 18:58:03
`last_update`	2018-09-18 18:58:03
`depth`	2
`children`	2
`last_payout`	2018-09-25 18:58:03
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.020 HBD
`curator_payout_value`	0.003 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	353
`author_reputation`	5,837,594,903,387,606
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,609,278
`net_rshares`	21,133,424,463
`author_curate_reward`	""

properties (23)vote details (2)

voter	weight	wgt%	rshares	pct	time
cryptoandcoffee	0 B		10,392,269,328	32%
milky-concrete	0 B		10,741,155,135	19.35%

@cryptoandcoffee · Sep 18 '18

Just don't understand. If you are not going to power up then stick it into savings. It doesn't matter if it is going to take 3 days to get it out, better safe than sorry.

`author`	empress-eremmy
`permlink`	re-tarazkp-security-watch-out-this-is-steem-20180918t215950565z
`category`	security
`json_metadata`	{"tags":["security"],"app":"steemit/0.1"}
`created`	2018-09-18 22:00:09
`last_update`	2018-09-18 22:00:09
`depth`	1
`children`	0
`last_payout`	2018-09-25 22:00:09
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.028 HBD
`curator_payout_value`	0.008 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	94
`author_reputation`	537,410,962,648,252
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,620,129
`net_rshares`	28,697,302,520
`author_curate_reward`	""

`author`	por500bolos
`permlink`	re-tarazkp-re-enjoywithtroy-re-tarazkp-security-watch-out-this-is-steem-20180919t014311610z
`category`	security
`json_metadata`	{"tags":["security"],"image":["https://cdn.steemitimages.com/DQmcwjwoMtbtfFsDaKEH6BN2JhkM8T2YoH1iAuGjjJrtupM/Security_Check.jpg"],"app":"steemit/0.1"}
`created`	2018-09-19 01:43:12
`last_update`	2018-09-19 01:43:12
`depth`	3
`children`	0
`last_payout`	2018-09-26 01:43:12
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.029 HBD
`curator_payout_value`	0.008 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	222
`author_reputation`	14,975,733,879,671
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,632,084
`net_rshares`	28,697,302,520
`author_curate_reward`	""

`author`	lauram
`permlink`	re-tarazkp-security-watch-out-this-is-steem-20180918t185955353z
`category`	security
`json_metadata`	{"tags":["security"],"users":["tarazkp"],"app":"steemit/0.1"}
`created`	2018-09-18 18:59:51
`last_update`	2018-09-18 18:59:51
`depth`	1
`children`	0
`last_payout`	2018-09-25 18:59:51
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	125
`author_reputation`	1,921,696,906,491
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,609,397
`net_rshares`	0

voter	rshares	pct
tobixen	161,338,471,454	62%
abh12345	31,224,888,525	3%
tarazkp	62,922,589,144	9%
minismallholding	3,501,122,848	10%
gansekirock	717,170,862	100%

`author`	tezmel
`permlink`	tezmel-re-tarazkp-security-watch-out-this-is-steem-20180918t210151883z
`category`	security
`json_metadata`	{"app":"partiko"}
`created`	2018-09-18 21:01:51
`last_update`	2018-09-18 21:01:51
`depth`	1
`children`	2
`last_payout`	2018-09-25 21:01:51
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.022 HBD
`curator_payout_value`	0.007 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	256
`author_reputation`	111,344,076,038,127
`root_title`	"Security: Watch out, this is Steem"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	71,616,607
`net_rshares`	22,889,452,067
`author_curate_reward`	""