Sort:  
  1. they are "Keys"
  2. There is only 1 password, it makes keys
    There are 4 x public (start with STMxxx) & 2 x private keys (start 5Jxxxxx).
    I said 5 as the memo one is redundant ATM & 5 makes people LOOK for the 2 private ones!
    the private ones should remain just that!

Yes Yes Yes Yes >> For some reason that TOTALLY stumps me, the DEFAULT is to log new users in with their master key.....talk about dumb dumb dumb (IMHO)

So yes by default new users are "exposed" from day 1!
please follow steps...

  1. ensure you saved your password (or make a new one & gen new keys if you think you have stuffed up and save that / them)
  2. save all keys to a notepad file
  3. save that file on an offline USB etc
  4. log out & back in using the POSTING key