RE: Important Changes to Steemit.com and Wallet

You are viewing a single comment's thread from:

RE: Important Changes to Steemit.com and Wallet

whatsup in #steem • 6 years ago

The security was fine for 3 years.
So, it wasn't about security, it was about the ads which is fine as long as you aren't disingenuous about it.

Really what could have been handled better was the preparations.

A notice of when it was going to drop and help on the UI's of both screens would have helped a lot. Many users aren't on discord and don't read many of the updates posted since they are written in tech talk and don't speak to exactly the audience that you needed to reach.

Anyway, what is done is done it's about Damage control now. Par for the course.

6 years ago in #steem by whatsup

0.00 BPC

Sort:

Trending

[-]

smooth 6 years ago (edited)

The security was fine for 3 years

Nah, it really wasn't. There was a massive (relative to the size of the site at least) hack three years ago specifically because of keys being the browser. The mechanism was changed a bit and might be a little better but the fundamental vulnerability remains. It is good that Steemit is being pro-active on this instead of waiting for another incident.

0.00 BPC

12 votes

[-]

whatsup 6 years ago (edited)

You do realize the accounts that were negatively impacted are mainstream users who are using the Internet exactly the way they use pretty much every site they go to.

Most of them have no idea what key they saved and why they have 4 of them.

In addition... you anal security freaks. They have very small accounts and don't yet have to be concerned. Just as my knowledge grew, so did my understanding of how and why I should protect my account.

If you webstie requires a half an hour training course to log in you might be failing. :)

For one site to decide to sacrifice user experience without the slightest thought on impact shows why crypto in general is not ready for mainstream and how Steem is moving away from being mainstream friendly and away from being an onboarding or gateway platform.

The timing and the fact I had ads 2 seconds after they dropped the code is a pretty clear indicator of why they choose to do this now.

0.00 BPC

11 votes

[-]

stevesmithagain 6 years ago

I’m one of those who still haven’t got a handle on the whole key thing.
What a cluster pluck I had. Fortunately, the nice folks who run this place let me start over. This time I took photos and copied and pasted the damn keys all over.
So now, if I want to log in on another machine,...... I don’t even bother trying. It never seems to work. But that’s okay. I’m taking a Lion’s Mane supplement these days so I expect to be smarter any time now.

I said the first time I joined Steemit that I wasn’t here to make money. It’s the whole freedom and no censorship thing that appeals to me.

So, basically I agree with you.

0.00 BPC

3 votes

[-]

ourfreesociety 6 years ago

And this is why a few weeks aback I decided Steemit isn't for me & I haven't been back since until today.

Instead of me making an effort, I will only come on here when I have something written up on another site & just copy it over to here.

After I tried to get over 200 people leaving FB to come here & join & not ONE of them did, I realized Steemit doesn't really care at all, & this is a site purely for the geeks, NOT for regular lay people.

A shame.

I'm trying to make an effort on MeWe, but they are no longer responding to my e-mails & I think all the spammers went over there since I got almost 100 fake profiles trying to add me as a friend within 3 days.

0.00 BPC

[-]

roadscape 6 years ago (edited)

Master password needs to be phased out for several reasons, one of which is that it derives to the owner key (which is meant to be entirely offline) yet many users continue to use it for logging in to Steemit.com, as well as a number of other apps. So this change had to happen at any rate. We did step up our communication for the rollout (many posts over the last few months) but it's evident it was not enough. While we don't anticipate any changes as big as this one anytime soon, we will keep all the feedback in mind as we proceed. The benefits of limiting the social site to posting key only are numerous. There are many other features we've had to postpone or reject due to security concerns. This change allows us to move faster, safely, and add more features that users expect from a social network.

0.00 BPC

6 votes

[-]

eddard 6 years ago

Why not 2-FA
And a password that could be remembered would be so much easier

0.00 BPC

3 votes

[-]

roadscape 6 years ago

2FA+password could be a solution in the future but it's much more complex from an engineering standpoint. Initially on Steemit.com you could simply set your own password, but we had to disable this. Many users had guessable passwords like password and got compromised. Then we raised the requirement to 16 characters; users were not happy, and it still wasn't enough. E.g. passwordpassword. Generally speaking, if you can remember your private key (password), then it's not secure.

0.00 BPC

2 votes

[-]

amethystmidnight 6 years ago

In my honest opinion, if users are stupid enough to make easily guessable passwords, then they should get compromised. Teach people a damn lesson to do things for themselves and be smart.

0.00 BPC

2 votes

[-]

tntdabomb 6 years ago

I still can't distinguish the differences between a master password and the owner key. Too many keys, but it does make me feel safer to have all these options.

0.00 BPC

1 vote

[-]

woodywood143 6 years ago

Take a look at the 3rd party tracking cookies your picking up from all these ads, might make you reconsider that statement.

0.00 BPC

1 vote