A story about keys, dumb actions, and a ghost

Using private keys scares me. I don't like to even touch them. Yet, sometimes it's necessary.

If you're unsure, as I was for years, about Hive's keys (posting, active, owner, memo, master), this post by @thekittygirl is about as clear as it gets. It's worth a look.

I like stories. I'll share a recent incident (i.e., goof up on my part) to illustrate good and bad key use and to serve as a reminder that it's wholesome to periodically double-check your Hive account security. (I'm speaking to myself here.)

Thanks to great tools like Hive Keychain by @stoodkev and Hive Authentication Services (HiveAuth) by @arcange, dealing with Hive keys has become pretty easy. These Hive superheroes have made things almost idiot-proof and this helps me. This is good. Once set up, you really don't think about keys much anymore, until you do.

My past private key "Oh shoot!" moment

Several months after the Hive fork from the old chain, I was checking my private keys for some reason. A dump truck ran over me...my Hive keys were the same as my Steem and Tron keys! Wait! What?

This is bad. Not sure why this surprised me, it shouldn't have, but it was a moment of reality biting me.

I thought then to myself: Steem, and whomever is running it now, and Tron and whomever is running it now, are sharing my Hive keys?! This is not okay. This is bad. I'm not sure if they're actually able to access my keys, maybe not, probably not. But, I won't sleep soundly with a maybe or probably. Gotta change my keys.

Changing private keys is scary. This is bad. I thought, "What if I screw up, which I'm prone to do, and I'm locked out forever?"

Deep breath. Double check that I've saved the old keys as a txt file, then proceed.

Thankfully, smart Hive people have made changing your private keys also rather idiot-proof. This is good. I was able to find instructions and get my keys changed without any problem. In terms of keys, I was now totally divorced from Steem. Ahh, relief. This is, indeed, good.

Fast forward until yesterday...

My recent private key "Oh shoot!" moment - A ghost story

The ghost of Justin Sun came back to haunt me. I still had a small bit of STEEM over there. I figured, "It's far past time to get that out, move it over to Hive, and do something productive with it." So, I head to https://hive-engine.com and hit wallet and deposit and choose STEEM and copy the deposit-to address and the custom memo.

Back over on the steemitwallet I enter the info for a small test transfer. (Why does that interface look so old now?)

It asks for the active or owner or master key. I entered the active key, the least powerful of those three. The ghost of Justin Sun told me, "No success..."

Hmm. Try again.

I tried again, this time using my owner key. Again, the ghost told me, "Fail."

Hmm.

Think, ponder, kick something. Hmm.

Oh shoot! moment number 2

After separating my Hive private keys from Steem, I'd stored my Hive keys close by to my old Steem and Tron keys.

Yesterday, when trying to send from Steemit over to Hive-Engine, I mistakenly copied my separated Hive private keys and tried to enter them into the Steemit chain! Nooooooo!

Are you kidding me?!
I just maybe sent my Hive active key to Steem?! Then, worse...
I just maybe sent my Hive owner key to Steem?!

Ahhhhh!

This is bad. Really bad.

Again, I don't know if they could actually see or access my keys, but I know that I just tried to sign a transaction with my Hive private keys. That's unsettling. I won't sleep well unless I change them.

Time, to change my keys. Again.
Same fear, second time...how to change my keys without screwing up and getting locked out? This is bad.

After a quick search, I used this tutorial by @ajaycapital. It's clear and simple. This is good. I was able to [1] change my keys, [2] get logged back in, [3] do this without losing anything. This is very good.

I really can't improve on what @ajaycapital wrote. See that post with its images. But, I'll try to super-summarize:

• Login to https://peakd.com
• Click your username and then "Wallet"
• Choose "Account Action" and then "Keys & Permissions"
• Choose "Change Password"
• Read, agree (if you do agree)
• Enter your current/old owner key and choose "Generate new keys"
• A page with your new private keys will appear
• Number 1 thing: download and save your new keys!

Again, save those new private keys!

Personally, I held onto my old keys also as a double-double safety check. I'm almost 100% certain they're worthless now, but, why not just keep that little .txt file anyway?

As stated by @ajaycapital in the article, you'll need to update Hive Keychain (or PeakLock or maybe HiveSigner if you use those). Do a search if you're unsure as to how (or ask in a comment below and you'll get help).

With that done, you're done. This is good.

May as well check my/your Hive account security

Since we're on the topic of security, we may as well look things over more fully.

Check your "Authorities" in PeakD. (Note: https://ecency.com may have similar options, and I like ecency, I'm just less familiar with its interface.) On PeakD, go back to "Wallet" and then "Account Actions", and then "Keys & Permissions." By choosing "Authorities" you can review sites/dapps that have posting (or more?) permission. This means they can post under your account. If you trust them, leave the permission, if you're unsure or don't recognize it, you might wish to remove the permission.

Lastly...while on the "Keys & Permissions" page, check your Recovery Account.

A recovery account has to do with this question, "What happens if I'm totally locked out? Or, what if someone takes over my entire Hive account because I did something dumb and maybe revealed my private keys like @crrdlx did?"

It was a year or so ago, that the nuisance ghost of Justin Sun came to first haunt me. While stumbling around, I noticed that my recovery account was set to a steem-something-or-other account. That evidently was the account that started my account back pre-fork. This meant that, if things went badly for my Hive account, only steem-something-or-other might be able to help me. Worse, maybe steem-something-or-other could see my keys right then! This is bad.

That's when I initially changed my keys from Steem over to Hive alone.

Check your current recovery account on the PeakD page above. You want it to be another account that you really, really trust. Maybe a spouse's account, maybe? Maybe your another account that you control (although that may not be ideal because of disability or death)? Personally, I have my recovery accounts set to the Hive Account Recovery service, again by @arcange. It's automated...there are other no people involved. Read about it here.

Summary

• Be careful handling private keys
• It's not difficult to change private keys if you feel it necessary
• Check your authorizations
• Check your recovery account
• Ghost-be-gone

Written by @crrdlx
About

---

_{Not on Hive? The top benefits of the Hive blockchain: (1) no ONE person/group runs it, (2) YOU own and control your content, and (3) YOU earn the rewards that your content generates. Learn more or consider using my referral link to get your free account here and I'll support you as you begin. Alternately, you can see other options here.}

Posted Using LeoFinance ^Beta