SCAM ALERT: No witness will ever ask you for your passwords or keys!

All those who vote for me (and read my posts) should already know that they should never, ever reveal their keys to anyone!

I will never ever pay for votes.
Vote for witnesses that are worth it, not because they promise you something in exchange.
Well, except that I promise to do my best for platform security and reliability.

Do not enter your password or keys on sites you don’t trust.
Always check the address bar to make sure that you are loading the correct website.
Scammers can make their sites look exactly same as a page you expect to see.
Again:

Always check the address bar to make sure that you are loading the correct website.

If you have any doubts, you shouldn’t use the website.

Make sure the users you contact are who they say they are.
My account name is @gtg, but I also use the account @gandalf on Steem and steem.chat.
But even if I would tell you to enter your password somewhere or send me some funds.
Do not. It's not me.

If you already have made that mistake, change your password immediately.

If you are not sure about it, change your password immediately.

^{Treasure your passwords /パスワードを大切に by @fukako}

SteemConnect

Of course, there are sites other than https://steemit.com where you can use your keys, such as Busy or DTube but you should always decide if you want to provide your key to such websites.
In a perfect world, a website should only use your key to sign the transactions that you are willing to make within your browser - in other words, your key never leaves your machine.

There’s a project called SteemConnect that was designed to help the developers with all that hassle with regarding keys and passwords. It is a preferred way of handling user authentication and authorization.

But even when you use SteemConnect, you should be careful and always check what your keys will be used for. Here are some examples:

If you’re voting for me as a witness, you see:

You can clearly see what operation will be performed. Also make sure that your address is what you expect it to be. Even if only one letter is different in the domain name, this means that something is wrong.
It should be exactly https://steemconnect.com/. In this case, the full address will be:
https://steemconnect.com/sign/account-witness-vote?witness=gtg&approve=1

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SteemConnect reminds you to check it.

In order to transfer funds or vote for witnesses, you need your Active Posting Key, but you should be VERY careful whenever you use this key.
Use the least powerful key possible instead of using your Master Password. For example if you simply want to post or upvote content, all you need is your Private Posting Key.

Also, instead of using a single operation, such sites as Busy or DTube might want you to authorize certain types of operations - read what they say very carefully and check if the application is what you expect:

Even though such authorization will use your posting authority to Vote, Comment, etc. it will require you to enter your Active Private Key to confirm such authorization.

I will write it again: confirm that you are on steemconnect.com site before entering your password and that you are authorizing actions that you really want to perform.

---

^{If you believe I can be of value to Steem, please vote for me (gtg) as a witness on Steemit's Witnesses List or set (gtg) as a proxy that will vote for witnesses for you.
Your vote does matter!
You can contact me directly on steem.chat, as Gandalf}

Steem On