OMG
These have been the most thrilling 48 hours in my SteemIt career. I’m still shaking... My account got hacked, I was locked out, while the hackers took my SBD, undid all my delegations and started powering down. It was a terrifying race against the clock to see if I could regain access to my account, and all my funds, before they managed to steal it all.
A Little Background Information
As you may or may not know, I started my SteemIt adventure with the username @mike314-005. Right, I don’t know what I was thinking signing up with that name. ;0)
By the time I had reached a reputation score of 51 and got around 500 followers, I decided I needed a different username if I wanted to get somewhere on this platform.
So I used Blocktrades to create a brand new account with the username @simplymike.
I didn’t close the old account, but decided to delegate all my SP to the new account. With that delegation, an extra investment and a lot of blood, sweat and tears, I managed to grow the @simplymike account to reach a reputation score of 53 in only 45 days.
I was pretty proud of this achievement, to be honest.
GrumpyCat
The day before yesterday, disaster struck...
I received a comment on one of my posts, in which was mentioned I received a GrumpyCat flag for using ‘the wrong bots’. I had seen these things around before, so I didn’t think much of it.
Please note that the @grumpycat account had nothing to do with the hack. The hackers simply imitated the comment, knowing people wouldn't be very suspicious because they had seen it before.
Since I had not paid for any bot, I replied to the comment, telling the posters they should reprogram their bot, because it was wrong.
I thought it would probably be a good idea to leave a comment on one of the poster’s articles instead of the flag-comment, so I clicked the ‘Learn More’ link.
SteemIt had been acting up these last couple of days, so I wasn’t really surprised when I was asked to log in after clicking the link. I did, and was redirected to a post by @grumpycat. Nothing weird about that...
They Tricked Me
I didn’t realize something was wrong until I tried to post a comment to the article. The system told me I had no permission to post.
Strange, but since SteemIt can be unpredictable sometimes, I still didn’t worry. I tried my phone... wouldn’t work. I tried my tablet... nope. When I tried to log in to Busy.org and that wouldn’t work either, I realized something was terribly wrong...
On top of that, I started to receive notifications through my Steemify app which indicated that my account was posting ‘GrumpyCat flag-comments’ on other accounts.
This was bad... really bad...
I Ran Home
I didn’t really know where to go, so I stopped by the Steemcleaners channel on Discord to notify them,and then to the one place I could think of: the #newbieresteemday Discord channel, which I, surprisingly or not, considered as ‘home’.
I was very fortunate I bumped into a couple of bulldogs there, you know, the kind of people who bite something and won’t let go until they’ve done everything they could to solve it... @deliberator, @penderis, @wilfredn, @bashadow, ... thanks for your help and support, I owe you!
Nuked
Suddenly, I saw my reputation score get back to -1. I was freaking out: I had worked so hard for that rep of 53...
Because the hackers were using my account to send out phishing comments, @guiltyparties had nuked it by flagging all those comments, just to make sure the comments would be hidden and the phising attack wouldn’t make more victims.
It was just a precaution measure...
Power Down
Meanwhile, the hackers had started to power down my account.
If it wasn’t for the SteemIt rule that a power down takes 7 days to be executed, I would have lost a lot of money in this.
Now, all the hackers got away with was a little over 14SBD, which is peanuts considering what it could have been.
Lessons Learned
It took a little less than 24 hours to regain control over my account, so this story has a happy ending.
It’s a bit unfortunate that it took such a dramatic event to learn some very important things.
I’ll be discussing everything I learned during this attack in my next couple of posts, but there is one thing I already want to share with you:
NEVER, EVER use your ‘Master Password’ for daily logins!!
Like @rycharde from the M-A-P channel stated:
The Password is your "ultra secret never to be revealed master key to the steem universe"
I did read the FAQ, but I managed to miss that part, and I’m pretty sure a lot of you have too.
Save your master password and keep it somewhere safe.
Only log into your account using the key with the appropriate permissions for what you are doing:
- Posting key for every day logins
- Active key when necessary for transfers, power ups, etc.
- Master password or owner key when changing the password
Again, save your master password and keep it safe! If logging in with your post key, make sure you don't overwrite or misplace your original master password.
I’ll be writing a more detailed guide soon, but I thought this was too important to leave out at this point.
If I had used my private posting key to log in, the hackers would only have been able to post the phising comments, but my money would have been save.
A Word Of Thanks
So, this story has a happy ending, but that was only thanks to the help of a lot of other people.
So, I’d like to put a couple of those in the spotlight below.
Thanks for jumping on and helping out, guys (and gals ;0) ). I couldn’t have done this without you!
Loads of thanks to
@deliberator, @penderis, @wilfredn, @bashadow from #newbieresteemday who jumped on it like a dog on a bone, supporting me all the way through.
@guiltyparties, @stresskiller and @pjau over at Steemcleaners for the info and @patrice for undoing all the flags, re-instating my precious rep score.
@drakos over at the help channel on SteemIt Chat for taking the time to reply and to tell the guys over at Blocktrades they needed to act! If it weren’t for you, @drakos, I would still be sending emails to them telling them they should be providing a way to recover my account.
Dan from @Blocktrades, for stepping up and initiating the recovery process.
@rycharde from #mapsters for all the useful info
@anupbose and @kobusu, for using their resteem service to get out the word about the phishing attack, by resteeming a message I created on my old account, even though I didn’t have any money in that account to pay them with.
The guys and gals over at the #alldutch community and of course @davemmccoy for the moral support.
And everyone else who supported me to get through this. There were moments I lost hope and wanted to quit and forget about SteemIt alltogether, but thanks to everyone who chipped in (like @mudcat36, who resteemed all my visible post to help me get back on my feet), I got through.
This was another example of how strong the SteemIt community really is, and a reminder why I love it so much.
This event allowed me to meet new community members, as well as get to know some members better. Together with the lessons I learned this has been a valuable experience, which fortunately turned out fine!
More Posts You Might Like
Help Put a Post to the Top of Trending, Without Vote Bots! Join The Minnow Votes Project!
What Would You Do With A 700SP Delegation?
Newbieresteemday-Week: The Curated Articles, The Winners & 2 Articles You Simply Nééd To Read
FIGHTING THE GOOD FIGHT ~ HOW YOU CAN DO YOUR PART IN THE BATTLE AGAINST REWARD POOL ABUSE
I'll Show You The One Thing You Need To Do To Never get Bitten By Cheetah Again!
Image Sources:
Pixabay
Giphy
Grumpycat screenshot taken from one of @grumpycat's comments
I was shocked and confused when I saw your rep in the negatives on one of our contests. I immediately started digging who was downvoting you. And it was then when I came to know that you were hacked. I wanted to reach out to you but had no idea how to go about it. Glad you are back!
May be you should share your story of how you got back your account and the process you had to go through. Just in case, someone else face the same issue they would know how to go about it and would take less time to recover.
Again, glad to have you back.
Thanks!
I am planning to, since I was surprised about how little I knew about the support system. I am glad other people knew more about it than I did.
I don’t hang out on Discord much, but I was very thankful it existed, because it gave me a way to reach out to people...
Wowzer. What a wild ride @simplymike!
Still learning about Steemit...
The trustee for stolen account recovery should always be a person to whom you can "prove" you are the real account owner. If you create an account via Steemit, they collect info to know who you are so that you can prove ownership later. If you create an account through BlockTrades while logged into your BlockTrades account, you can prove you are the account owner by showing you control the email account associated with your BlockTrades account. So the recovery agent is generally set to be whoever creates the account for you, since account creation often requires collecting info that can be later be used for proof-of-identity.
Note: if you buy a Steem account from BlockTrades when you are not logged into your BlockTrades account, then we don't collect proof-of-identity, and we can't help with stolen account recovery in such cases.
Thanks @blocktrades. That makes sense.
I'm interested in creating an account for my pastor.
Under Steem menu at the top of page, you should see option to "Create Steem Account". I recommend you first create an account on BlockTrades and login, so that the account can benefit from stolen account recovery feature, for example.
Just a thought: shouldn’t it be a precaution measure to not allow people to create a SteemIt account if they’re not logged into their Blocktrades account?
To be honest, I sometimes forget to check if I’m logged in when using the Blocktrades services...
Fortunately I was during the creation of my account or I would have lost a lot...
We're adding an additional warning about the recovery issue on the account creation page for cases where the user isn't logged in. We'll still allow it, but the warning will make sure the customer knows the risk of not logging into their BlockTrades account first.
👌
On Blocktrades, you can indeed choose to buy a Steem account. You can read more about it in this post.
I’m not 100% sure of the entire reason for having to go there, but one poknt for example is that if you go through the SteemIt account recovery process, you are asked for an email address thzt is attached to your account, while you don’t need an email address when buying an acccount through Blocktrades, so you can’t be sent recovery details
Aha!
it would've bit me haha
Your post was resteem by Whale ResteemService @booster007 & @boostupvote
Resteem Over 10,200+ Followers
Keep it up!
All the best!
Send 0.100 SBD/steem For resteem over 4300+ followers / send 0.200 SBD/steem resteem over 10,200+ Follwers Send your link in memo ! @boostupvote Attached !
Glad you got your account back. I too was mislead once in the beginning of my steemit life and was lucky to have found people to help me. @darkos definitely active on steem chat. Great ending there and happy you got most of you assets back.
Even now I think I can easily get tricked with links so always be vigilant. Thanks.
Thanks.
And I agree that it is easy to be tricked. It was only yesterday that I found out it is so easy to mis-read a username... you should be alert every second of the day
totally agreed. Even my own account when I login I sometimes mis spell it and think I got it stolen again. Sooner or later that may give me a heart attack. lol.
SO glad you had so many people helping you with this issue!
Terribly sad that people are preying on members too.
There’s a lot of money going around on SteemIt, which makes it a perfect target...
So true... if people would put all that energy into doing good and positive in the world versus stealing from others...
I agree, but I guess that’s not going to happen any time soon.... :0(
Spam is discouraged by the community, including comment spam.
Tips to avoid being flagged
Thank You! ⚜
Members Of Our Community Use Our Tag To Receive Minnow Support From The Community. Your Posts Are Spam Actually. Our Posts Are Requested By Members. Where your automated response is spamming things that may not be spam. lol
good to see that you are back in control Mike :) and within the 6 days of powerdown ;)
Fortunately :0)
Thanks for the support!
Glad that this story has a happy ending @simplymike =) We can now look back and say for sure that it's been an exciting journey, and I ended up actually putting into practice a few security measures for my account too after seeing what has happened.
Better now than later when your account is worth way more!
True.
I’m now like obsessed with security. I’m going to spend tomorrow finding out Hat else I can do to keep my account secure.
I have quite a lot of money invested in SteemIt, and while I’ve always been really focused on protecting my other crypto wallets, I now realize that security isn’t SteemIt’s strong point.
Why there’s not an option to protect your account with two-factor authentication is beyond me...
Cool, a post soon to share your findings about security? Yes, that's right. But, to be fair, there are lots of things that the platform needs now as well
True... SteemIt will need to step up on a lot of things, or I’m afraid it will go down because of its flaws
Thanks for your help @wilfredn
You're welcome @gracefavour!
Glad you were able to get your account recovered and that you could get the flags removed too! Sorry about the 14 SBD, but welcome back!
Thanks. I don’t really care about the 14SBD... if they had managed to power down it would have been 250 SBD, so I’m a very happy camper :0)
Happy you stuck it out and did not quit. I need the positive influence in Steemit you provide.
And Happy Girly day
Thank you, my dear stalker! ;0)
what can I say, stalking you makes it look like an admirable profession :)
oh check out my new blog on bots please
Wow, what a story. I can feel the pain this must have caused you. Maybe you can write a howto article for people who will be hacked in the future?
Glad to have you back :)
I’m planning to.
One if the things learned is that the help-system is not clear here on SteemIt. I simply didn’t know where to go. That shouldn’t be the case...
I am glad all is well. A post on how to get the help with recovery would be great. When you get it done, I am going to save it on my master post and name it something real long so I always carry it forward like all the Authors I like to read.
So glad it all got figured out and so quickly too! Thanks for putting the message out there for people to be careful. With this post Im sure youve helped many people from getting their accounts hacked as well. Upvoted and resteemed to spread the message! Thanks :)
Thanks!
I’m planning to get a couple of more posts out about the thingd I’ve learned from this
Great way to turn a dreadful situation into something positive! :)
Congrats from @anupbose to you for get back your account
Thanks. And thanks again for resteeming! That reminds me... I’ll send you the SBD right away :0)
No need to send sbd ..... We will be frnds and help each other to grow on steemit
too late :0D
Consider it a gift, then. From one friend to another
Sei stato fortunato
Si, sono stato molto fortunato
(Does that make sense? I used Google translate for that - lol)
Glad you got your account back
thanks. me too!
Glad i read this too keep in mind of some of the tricks they got on there
Oh my. How scary. Thank goodness you have such strong connections in the community. I wouldn't even know where to begin if that happened to me. But I have never logged in with my master keyword after seeing a video by Jerry Banfield on the subject a couple of days after I arrive here.
So happy to hear it all worked out for you in the end.
Sounds like you handled it brilliantly! Hats off to you @simplymike and all those wonderful people who stepped in and helped. 😊
You make me blush ;0)
I’m happy I decided to get a little more committed to the community in general and the #newbieresteemday community more specific.
In every day life, I’m not really a community-minded person - however, that changed a bit since I got caught up in the SteemIt community - and in my online life I’ve always been kind of a loner (by choice).
If I wouldn’t have made those connections, it would have been a lot harder...
I am so glad it had a happy ending
@simplymike .So sorry for everything you went through and the money you lost. Thanks to everyone who helped out.
The money isn’t even that important, it could have been a lot worse. I’m just hlad I’ve got my account back and they didn’t bother to erase or change my posts. That would have been a nightmare...
Wow that is some seriously scary stuff right there!
But you're right, never log into steemit wth the master password! I too didn't take this seriously for a while.. but after a while you have quite a lot to lose on here! Not just SBD and SP, but perhaps even more importantly: followers!
Glad you managed to get the account back in any case
Indeed, there’s quite a lot to lose.
I didn’t think of it up until just now, but it would have been a nightmare if they would have edited or erased my posts I worked so hard on... I should really start making backups...
Congratulations! This post has been upvoted from the communal account, @minnowsupport, by simplymike from the Minnow Support Project. It's a witness project run by aggroed, ausbitbank, teamsteem, theprophet0, someguy123, neoxian, followbtcnews, and netuoso. The goal is to help Steemit grow by supporting Minnows. Please find us at the Peace, Abundance, and Liberty Network (PALnet) Discord Channel. It's a completely public and open space to all members of the Steemit community who voluntarily choose to be there.
If you would like to delegate to the Minnow Support Project you can do so by clicking on the following links: 50SP, 100SP, 250SP, 500SP, 1000SP, 5000SP.
Be sure to leave at least 50SP undelegated on your account.
Wow what a story, I saw your reputation score the other day and my stomach went directly to my throat for you. I knew had to be shenanigans going on there's no reason you'd ever get flagged let alone that many times. I am very relieved for you that you now have this resolved and can keep doing the great stuff you do daily for so many people on steemit!
Thanks! I was shocked to see my rep go down so fast too, because I didn’t have a clue what was going on. Fortunately I found out quickly that all the comments had been flagged to protect other people, and that the flags would be taken away once I got my account back...
Congratulations! Your post has been upvoted by Reach Out, which is proudly sponsored by @eturnerx. Our goal is to support Nigerian minnows on Steemit. Join our discord group https://discord.gg/NWAkKfn1
I had a similar problem:) I know what it's like. (sad) Thanks for your advice from now I will only use my posting key! Hang on bro:) also thanks to @guiltyparties , he is doing good job by helping others. He is a great guy
I actually don’t know if @guiltyparties is a guy - lol
You were hacked too? Lost a lot?
Haha yeah I'm a guy. At least a lot of people are getting their accounts back now.
@guiltyparties Are there new victims coming in, or is the attack under control?
😁 You can never be sure - lol. Lots of people think I’m a guy too, and up until I talked to her 2 days ago, I even thought that @patrice was a guy (I don’t know why, ‘cos it’s a girls name 🙄)
It's not under control as the domain registrars refuse to delete the domains in question. I thought @patrice was a French guy too at first. I have no idea if you're a guy to be honest.
I'm not... Girl all the way :0)
I guess I should get more info on account security out fast...
I had no earnings, but followers, and friends there. When reputation reach 0 you can't upload any photos until rep10 so account is useless.
Did your reputation go down because the steemcleaners flagged all the comments? If so, ýou can ask them to unflag when you've edited the phishing commenrs, so you gét your rep back. That's what they did for me.
You did edit the comments, did you? What was your account?
Normally yes, but I've made mistake and deleted most of flagged posts and comments, so flag cannot be removed. Never mind, Begginers error :) It happened after few weeks sicnce my account was created . Thanks to this I will be more carefull in the future and I can tell the others what was my mistake. And yes I edited comment's which I couldn't delete:) I should only edit posts , Never delete!. I have this oportunity to learn from my mistakes.
True!
That’s the spirit of giving a positive Twist to a negative event.
For me too, this has been an important lesson. I’m glad I made it out ok, because I don’t think I would have started again from 0 for a third time...
I also heard there are hackers attacks on wi-fi, so I started to use VPN servers. Upvote, follow and wish you the best
Like a million other people I have been following your story for the last couple of days. Thanks for taking the time to record everything in a post so the rest of us can learn. Fwiw, because of your nasty experience I devised a much better system for saving my keys. I now have a flash drive near my workspace that I can pop in when I need the active and owner keys.
Good thinking!
Better be safe than sorry!! ;0)
There is a bounty out for a steemit focused anti phishing browser extension.
I have a tutorial over on my page that shows how to block individual phishing sites as you bevome aware of them and trend micro app lets you block on phones.
I’ll check it out
I had read a little about someone getting hacked but didn't realize it was you. That had to be scary. I'm glad it worked out and you didn't lose too much. Thanks for the info. Hope it never happens again to any one but we never know.
There were like 15 accounts, for as far as I know, maybe it were more.
All we can do is learn from this and be cautious in the future...
Oh my god. What a horrible experience. I also received a phising comment on my post a few days ago saying that my post won a curation token or something. Good thing I was still half awake when I saw it because when I checked it again after a few hours, steemcleaners already flagged it and that's when I realized it was probably a hacker trying to get my account. I almost clicked the link and probably logged in. Thank goodness I didn't.
Thanks for sharing your experience. I noticed there are a lot of hacking lately in steemit so everyone should be cautious.
Wow, it sounds like you have been really lucky. These were a couple of very smart hackers, using such comments to trick people. I’d almost think they are active members of the community, knowing so much about comments that regularly show up...
Ahhh, thank god you werre saved! I would not want to fall for this trap its super lame, I hope it can be taken down!
I’m not sure how far this has spread, not even if it still going on. I think warning people is the best thing we can do
id have to agree!
OH MAN I would have had a heart attack! I'm so glad it got straightened out!!
I was pretty close to heaving one :0)
Fortunately, it turned out okay
You just planted 0.06 tree(s)!
Thanks to @cryptkeeper17
We have planted already 4013.13 trees
out of 1,000,000
Let's save and restore Abongphen Highland Forest
in Cameroonian village Kedjom-Keku!
Plant trees with @treeplanter and get paid for it!
My Steem Power = 20718.45
Thanks a lot!
@martin.mikes coordinator of @kedjom-keku
@cryptkeeper17 Thanks!!
I've seen this happening alot this week. I have flagged a few of these phishing comments, but I can tell the accounts were hacked and I feel bad doing it, but it's so easy for people to get tricked by it I know it has to get hidden.
I'm glad you were able to get your account back, I would have been going crazy. 😔
@khacket
Thanks for helping to protect.
Could you do me a favour? Could you go check on those accounts you flagged, and see if they’ve edited the comment to make it harmless (that’s what I did after a tip from the people at Steemcleaners: I edited the phishing comments, so they now say ‘comment deleted’). If they did, please remove your flag, so they can can get their reputation restored?
When something like that happens in the future, maybe just head over to the Steemcleaners Discord chanel and tell them about it.
I did, and they instantly flagged all comments, then instructed me what to do (edit the comment). Once I had done that and the comments were harmless, they’ve removed all the flags again, making sure my rep score wasn’t damaged because of this...
I will absolutely go check and see if those accounts were reclaimed. I hate that this is happening to good people. 😔
👍
Good to hear you could get control over your account again.
You mentioned it in your post already - do you think you can write something like a manual what the best way to act is if something like this happens?
If possible for both situations:
I could not find a really good "manual" yet what to do if one gets hacked.
I will, soon.
I'll have to do a little digging on what the right procedure is, because I was like all over the place when it happened
I really appreciate that. Take your time. Thanks in advance.
I do hope the rest of the Steemit users will be alert about this thing it can ruin somebody hope to have something better from this platform...Thanks for sharing an important message
You’re welcome.
I indeed hope this will make people more careful using their keys...
Yikes! what a scare... I'm wondering what I'd do in a similar situation. There's a menu item in the top right drop-down menu that says "Stolen accounts recovery", would that be where I should go?
If you have created your account on SteemIt itself: yes,
If you’ve created your account through Blocktrades, you need to contact their support desk.
I still have to figure out about the other account creation services
You got a 33.33% upvote from @bearwards courtesy of @simplymike!
Hello @simplymike.
As you see my reputation is -1. two days ago it has been 41 before suddenly my password stopped working. few minutes later my SBD was transferred to another account. After two hours the phisher/spammer started comments on huge number of posts claiming they are in his blacklist for plagiarism. in few minutes my reputation turned -1.
I didn't click any link outside steemit and I never gave away my keys.
I used Stolen Account Recovery and recovered my account yesterday. since then I am trying to edit the spammer's comments but they don't respond while my other comments can be normally edited.
Can you advise on what to do to remove the comments and regain my reputation.
Important: do not delete the comments!
There are only edit and reply buttons, no delete. And there not even editable.
Have you visited the Steemcleaners Discord channel? They will guide you through.
https://discord.gg/aVJ5cGy
I can try....
You’ll have to efit the comments without being in full context view
To do this go to https://www.steemworld.org/@yourusername
Just a sec, and I’ll show you what worked for me
Go to Steemworld.org/@yourusername
Scroll down to ‘account operations’ and find the spam comments that have been posted from your account
Click them to reveal more info.
Then, click the permalink
This will bring you to the comment that was posted directly.
You should be able to edit the comment now. Replace the existing text with ‘comment deleted’
Once you’ve edited all comments, visit the steemcleaners Discord channel and tell them you’ve edited all the comments. They will then remove the flags (ask for @patrice or @guiltyparties, they’ll know what to do.) so you can get back your reputation score.
If you’ve received flags from others, contact hhese people, explain the situation, tell them the comment hzs been edited to make it harmless and ask them to take away the flag.
That should do it.
I’m sorry you fell victim of this too... hope you didn’t lose to much?
Will you Let me know if it worked or not?
I will update you for sure. :)
It works, I am editing them right now. Steamcleaners don't respond, do they take time?
Would the flag be removed if i deleted the comment, or the one who flagged me shall remove it hemslef?
It can take a while before they respond. With the different time zones we’re all living in...
They’re very friendly people. Once they see your post, you’ll definitely get a reply, and if the flags were their work (and there’s a big chance they were) they can take them away and give you back your rep
Get back to them when you’ve edited all the comments and tell them you did. It has been pretty quite over there today, but someone will drop in eventually and you’ll be fine
It is done, :), My reputation is back. the flags had been removed. It has been very confusing time. Thanks @simplymike for your genuine support. You did me a great favor. Thank you for being there.
You’re welcome. I’m glad they could take the flags away and you’ve got your rep score back ;0)
Man these hackers just make things crappy for people . It’s a good things steemit takes quick action and has precodures in place to slow the buggers down. Thanks fir this post , I’ll be weary of this phishing tactic. Glad you got your account back
True. I never like the idea of the 7-way waiting period whan powering down, but for this once, I was veey thankful the rule existed
Daaamn, i've been doing it wrong. Thanks for sharing
Glad I could help :0)
I only realised something was wrong when I saw @davemccoy ask if anyone had heard from you. It's bloody distressing to know this can happen when all we want to do is have some fun and earn some bucks. It's great that you are back in one piece and are writing about it, thanks for that. But I'm now confused about logging in ... I use the key which was emailed to me when I joined Steemit. It is not one of the keys which I find in the Permissions list (Posting, Active etc.).
Thanks. It is indeed a scary thought that it can happen all of a sudden.
To log in, I advice you to save the key you are using somewhere safe, and use your private posting key for your daily logins. I’m not sure what key SteemIt sends you when you sign up, but there’s a big chance it’s your master password.
It’s better to be safe than sorry, so better switch to your private posting key
Incredible story. What a stressful situation. I’m glad you stopped it when you did.
Thanks you for sharing your experiences and spreading the news on these hackers. Knowing is half the battle.
Appreciated you sharing this experience. The key to use can be a confusing thing for newer users.
This might be a really stupid question, but what's the difference between the master password, and private posting key?
There are no stupid questions ;0)
I can’t remember if it goes when you create your account through SteemIt, but if you create your account through Blocktrades, you’re initially sent a password that allows you to log in. (I believe it is the same for SteemIt accounts).
This password is the key to everything in your account. With it, you’re in full controle. For example, if you want to change your password, you need that password.
Your private posting key can be found under the ‘Permissions’ tab in your wallet (your Master Password can’t). This key allows you to post, upvote, resteem and comment, but it won’t allow you to send transactions or edit your settings
Congratulations! You were nominated for a TROPHY TOKEN award HERE by @simplymike Please comment your Bitshares address to receive your reward! You can also contact us on Discord @Trophy-Token. Thank you for being a great Steemian!