Security Online Is Hard

Along with my business partner, I run an ecommerce API company which is responsible for securing credit card data. That's like putting a big fat sign up for hackers saying, "There's money here! Come and get it!" Security is really, really hard. It's actually one of the primary services we provide for our users. We're PCI (Payment Card Industry) Compliant at level 1 because of the volume of transactions we manage for the thousands of stores on our platform. That means we have detailed annual reviews which include on-site audits, penetration testing, extensive documentation review, and process analysis.

In 2011, I purchased something online from a vendor which didn't get this right and $1,100 was taken out of my account. (You can read the whole story on my old blog here.) Surprisngly, few companies get this right, but I think Steemit is one of those.

After the XSS hack, I knew most active Steemit accounts were compromised (including, potentially, my own). I wasn't alarmed because of the ingenious multi-key security design Steemit uses. I only used my posting password (which I now considered compromised) and knew my owner password was secure. I changed all my passwords, stored them in 1Password, and helped my wife @corinnestokes do the same. Then I posted this on Steemit:

Upvote if you changed your Owner Password, Active Password, Posting Password, and Memo Password

I was sure that would be Steemit gold! I was going to rocket to the trending homepage as every user on the system updated their passwords, saw my post, and congratulated themselves on their cyber security know-how!

Yes, at times I'm stupidly optimistic.

I got 15 votes and $2.23.

As more accounts were being defaced, people began to understand the nature of the original hack and how so many passwords were at risk. @arhag wrote a really great piece that did hit the home page, and I'm sure helped a lot of people ($8,693.02 is a pretty nice payout! Well done!). I felt some vindication because the image I found online was used in @arhag's post because they had read mine. The need for a password manager was becoming well-known!

@robinhood pointed out the problem was bigger than a single hack. He changed 500 user passwords to prove his point (and was rewarded $5,818.19 for posting about it). The problem was beyond server or protocol security (which Steemit was working around the clock to improve). The problem was a PEBKAC.

Problem Exists Between Keyboard and Chair

People were not using securely generated passwords. In the Third Update to July 14th Security Announcement, Steemit reminded people to use a password manager. Some people still aren't paying attention.

How can you create an idiot-proof website when the world keeps creating better idiots?

I kid, but many in the cyber security space feel this way. Amazing tools exist, but few have the time or expertise to figure them out.

And here's where Steemit continues to amaze me. They stepped up their game yet again because when I logged in this morning, I saw this:

They also followed up with a password policy update and a note about how they generate secure passwords. When they reopened the site for new signups, Ned included this:

If you have not updated your password to a randomly generated password, then we recommend you change your password immediately.

Steemit gets it. They get how hard public/private key encryption is for everyday Internet users. They understand people are lazy and will create terrible passwords. They even developed a groundbreaking account recovery solution.

Steemit built the killer app for blockchain mass user adoption, and they are working hard to secure it.

That, to me, is not only awesome, but it gives me a warm, fuzzy, secure feeling inside. If you still don't have a password manager installed or you have questions about online security or password management in general, please comment below and together we can figure it out.

Steem on (securely).