Update On streemian issue

dber (66)in #steemit • 7 years ago (edited)

First, after looking at the blockchain for my account it appears fairly unequivocal that streemian did do as it said and used the active code only to add themselves as a posting authority. Confirming this, with two password changes, leaves me confident funds cannot be accessed

To @xeroc 's credit he responded below in detail, even while on vacation, which I appreciate. Moreover, Streemian does not appear to have done anything untoward or unasked for to my account.

As expounded upon in the comments below, i think, for new users especially, the initial language on the streemian registration app is a bit misleading - really just enough to confuse and then frighten a person, like myself, who didn't really understand what the active key was. Secondarily, the permission removal webapp is currently down.

@xeroc offered alternative solutions to removing the posting permissions - piston and a similar tool - but I think for the technically uninclined that might prove fairly difficult. There's a tutorial here to begin with.

Long and short of it though I'm downgrading this from crisis to mistaken crisis. For other new users, read this before you hand out a key to anyone for any purpose.

Then you can avoid annoying a guy on his vacation and having a bloody ulcer.

#security #steemhelp #steem-help

7 years ago in #steemit by dber (66)

$13.83

Sort:

Trending

[-]

xeroc (70) 7 years ago

Since you seem to not be able to read the whole page, let me quote from there:

Your password authorizes you to post with this account.
In order to let us use your account, this app will install the streemian account into the posting permission.
This gives us posting and voting permission for your account
You can remove the streemian account at any time using this app

Why do people expect a response in under 48hours for a free-to-use service?

Btw, you can use the same page to remove the posting permission for streemian. Its not my fault the steemit.com still doesnt support that feature..

$101.40

[-]

dber (66) 7 years ago (edited)

I have since read the whole page - and you did post, as far as I can tell, only put permissions into the posting account.

However:

The active key is still being input in order to get only posting authority. Your website says you will only use it for posting authority - but we're still handing over the active password. The first thing you say is the code will not allow you to reach our finances. That isn't true about the active password.

I admit freely, I acted in ignorance just handing out the password to you guys without reading further. However, you still placed what seems to be a direct misrepresentation about the power of the active password at the front end.

Your permission removal page is not working, and there are others on the #streemian chat room who are seeking to remove permissions and cannot.

As long as you're quoting your page let me screenshot it

This is the language at the very top of the page where your active wif is requested. You indicate you cannot access finances, however this is not technically true anytime the active wif is known to you. What you're really saying is "we promise we won't use you active wif to interact with your finance." But that isn't the same thing -and to a new user it is a confusing distinction that can engender an undue sense of security.

$0.00

1 vote

[-]

xeroc (70) 7 years ago

Its good that you take care of your funds and be extra cautious.
Let me clear some dust:

The active key is required in order to add the streemian account to your posting permission
this account update happens in the browser and your active key is only use to do that and is not stored. You can see that from any block explorer.
Instead os using the unlock-app pf streemien, you can also use any other steem-compatible app that allows to add an account to permissions ... like piston, or busy.
once the account is updated, streemian can only post and vote and the owner of the account can remove that permission at any time
it is unfortunate, but i cannot change the fact that this feature isnt exposed on steemit.com properly.

$0.00

[-]

dber (66) 7 years ago

Look - it does appear based on a look at the blockchain that only the posting permission was authorized. Which is to say, streemian appears to be acting in trustworthy way.

I appreciate you're taking the time to respond in some detail - I think to avoid further confusion it might make sense to clarify what's happening on your registration page. I imagine you must get a lot of newer users and confusion is easy to come by.

Is the esteemapp also associated with you guys - i thought i only gave the active key to you but both of you got posting permission at the same time.

$3.49

14 votes

[-]

xeroc (70) 7 years ago

No relation to esteemapp.
I am currently on vacation and pretty busy with some other project right now. Need to look on how to handle streemian in the future. Until then, i am running it on a best-effort basis.

$0.00

[-]

digimad (49) 7 years ago

I just signed up to Streemian and found this post searching for help on this subject... I was going to see if I could just give it my posting key only.

Fortunately (or unfortunately) for me Streemian is jammed before this point, eternally 'waiting for account name'.

$0.00

1 vote

[-]

dber (66) 7 years ago

My experience was that the posting key did not work and they specificlally requested the active key

$0.00

1 vote

[-]

rpalusz (32) 7 years ago

I too was signing up for Streemian and when it came to the part about entering my active private key I stopped and looked for more info. I understand everything seems to be on the up and up but I don't think I want to post my private active key someplace.

$0.00

[-]