It’s been 2 weeks since @noisy posted his text about not-hacking 11 Steemit accounts. It was the top 1 trending post for a week and I think at some point everyone saw it. And they probably did.

Private memo keys

First let me quote @noisy:

There are 4 pairs of keys: active, owner, posting and memo. Every pair has public key and private key. Under any circumstances, you should never expose any of your private keys.

As I wrote in a post, right now exposing a private memo key is not very dangerous. But it was said few times, that in the future memo-keys will be used to encrypt and decrypt private messages. So basically every your conversation encrypted with your memo-key would be basically public for everyone who poses your private memo key.

Also... even right now everyone with your private memo key could try do some kind of social-engineering attack, by pretending that attacker is you (because technically speaking only you should be able to sign message with your private key).

So... no, your account was not hacked right now, but with private memo key exposed, your account could be attacked in a moment when private-memo-keys would gain some new role in Steem ecosystem.

But many users, like @dollarvigilante, didn’t take it seriously.

And those users didn’t change their keys. No reason why.

Not in blockchain?

I have found one setting which is not stored in blockchain. So it means it can be changed in the user’s profile with ANY private key. This setting is viewing the Not safe for work (NSFW) content.

To show you how it works I have found user with NSFW content (one post without any images - https://steemit.com/@hungrylilkitten) and I will use @dollarvigilante private memo key as an example.

So are you still going to wait with changing private keys for something worse to happen?

A lot of memo keys

You might think there are only a few of those private memo keys so no need to worry. Let me surprise you - there are dozens of them.

Let’s have a look at the number of posted private memo keys (end date is 2017-06-19 17:27:12).

First, I’m going to divide it into two categories: Keys posted and changed some time later by user OR keys posted with no response from user till now.

Let’s set a point in time called POST. POST is a date when @noisy published his text. Data shown above will be divided into more categories:

Posted before POST and changed before POST

Table sorted in ascending order of memo key posted:

Table sorted in ascending order of key changed after:

Posted before POST and changed after POST

Table sorted in ascending order of memo key posted:

Table sorted in ascending order of key changed after:

Posted after POST and changed after POST

Table sorted in ascending order of memo key posted:

Table sorted in ascending order of key changed after:

Posted before POST and not changed

Table sorted in ascending order of memo key posted:

Posted after POST and not changed

Table sorted in ascending order of memo key posted:

Can I help?

After publishing this post I’m going to send every user with not changed key a minimal SBD transfer with a link to this text and information CHANGE YOUR PASSWORD. I hope this will work and at least some of those users will change their keys.

I’m going to keep an eye on keys updates and after a week or two data will be gathered to create new statistics.

What is Memo?

But there is also a second issue that I would like to talk about. Public keys and how users use them as a habit in the wrong places. By wrong places I mean mostly Memo Fields when withdrawing Steem and SBD from markets to Steemit.

I’m going to use Bittrex as an example. I was sending 1 SBD to my Steemit account.

And I received it like this (problem with apostrophe):

I did it to show you that every Memo Field is public. All that info can be found in your Wallet. If you write something in Memo Field during transfer from market to Steemit it will stay in blockchain forever. And sooner or later somebody is going to see that and maybe even use against you.

BECAUSE MEMO FIELD IS NOT THE SAME AS MEMO KEY.

Memo Field is a place for any information you want. It’s a place to write something like My daily update 2017-06-21 or Gift from aunt Betty. This field is for you.

All keys can be found in your Wallet and then Permissions. Those long strings of characters should stay in that place if you don’t know what you can do with them. And Memo key, as you can see, is used to create and read memos.

Public keys

I’m talking about all of this because if somebody used at least once a public key in Memo Field, there is a possibility that next time maybe for mistake user will paste private key. And that’s not good.

There are a lot of tutorials on Steemit with incorrect information. People read them and they make the same mistakes. Here are some the most popular posts that can be found using Google:

You know how many users used public key at least once to transfer Steem and SDB?

A lot of them. And there are more than 300 transfers between users!

The best part - many people after the first transfer with public key assume it’s the only good way and they duplicate this error over and over again.

And here comes bigger numbers:

THIS IS FULL BLACK LIST: IF YOU CAN FIND YOURSELF ON IT THAN YOU COULD BE THE ONE WITH PRIVATE KEY POSTED INSTEAD - REMEMBER THAT!

If you want to know more about public and private KEYS on Steemit - look at @noisy profile.

If you like this text - please follow me!