Reset Accounts

avatar

learnblockchain.png

Hive/Steem have recovery accounts

You know this.
I know this.
Everyone knows this.
Right?

Recovery accounts set our network above the rest.

Even if your keys get stolen you can still get your account back.

Amazing!

Even more amazing is that the recovery process does not compromise security in any way.
It only adds security to the network.
There is no added attack vector for the recovery account to steal your account.
It's actually quite genius when you look under the hood.

t1.png

But did you know we actually also have RESET ACCOUNTS?

Like many others here, I've seen this variable dozens of times. I always assumed it meant my account had never been reset. I always assumed if one day I needed to recover my account that this reset variable would just store the date that my account was recovered or something like that.

NOPE!

Turns out my reset account being set to @null means I'm not using this feature.

And neither are you!

So yeah I was snooping around on the dsteem API the other day and stumbled across this:

t2.png

SAY WHAT?

What does the reset_account_operation do?

t1.png

Okay, so I have to assume this is a typo.

Clearly it should say reset_account and not recovery_account.
If this was true it would mean that any account that goes inactive for 60 days could be stolen by the recovery account... that doesn't sound right.

t3.png

However when I check the official condenser API documentation (not dsteem) it says the same damn thing. Is this really a typo or can the recovery_account actually change the owner key of 60+ day inactive accounts.

This would have insane ramifications to the platform,
the biggest glaring one relating to the @darthknight/@bittrix debacle.

t3.png

If the recovery account really can act as the reset account, this implies that Steemit Inc has access to these funds and can simply change the owner key of @bittrix because it has been inactive for years. @darthknight would easily be able to sue Steemit Inc and get the money back.

Still, I have to assume that this documentation is incorrect,
but I will still have to test it myself with my alt accounts.

Master key magic making

Do you guys remember this post? I discussed in depth why it would be so cool to create multiple accounts with the same master key so if anyone loses their keys you could recover it for them easily.

This reset_account feature blows that idea out of the water. All one has to do is change the reset_account from @null to whoever and that person would be able to change the keys after the 60 days of inactively went by.

Is anyone using this feature?

Seriously, go check https://hivebuzz.me/ranking

Accountreset_account
@freedom@null
@blocktrades@null
@darthknight@null
@jamesc@null
@theycallmedan@null
@ranchorelaxo@null
@pharesim@null
@roadscape@null
@likwid@null
@michael-b@null

Literally no one is using this feature!

This is fucking mind-blowing.
This is free security!

What happens if you die?

Wouldn't it be nice if someone you trust could recover your account?
Maybe even the lawyer handling your estate in such an event?
What if you simply lose your keys for whatever reason?

Not a typo?

Let's say the documentation is not a typo, and in the event of the reset_account being @null that makes the recovery_account the default reset_account.

This would actually be really bad, because there is an attack vector here that no one is talking about. It would obviously be much smarter for the recovery_account and the reset_account to be different accounts. This way if the reset_account stole the account in question after 60 days, the true owner could still recover said account with the help of the recovery_account.

Why didn't Steemit Inc tell us about this?

I can think of a few reasons. The main one is that a recovery account is a feature that only adds security. The reset_account provides an attack vector to steal accounts that go inactive. This would be an obvious reason to not use reset accounts.

Another reason not to use them would be because if Steemit Inc set themselves as the reset account, they could theoretically become liable for the accounts that went inactive. Technically those accounts would fall under their control, and the legality of certain situations resulting from that dynamic would be highly questionable.

Conclusion

I'm learning more about Hive every day.
It's pretty crazy.
We've all been told that accounts can not be recovered if you lose the keys.
Apparently, even this is a lie.
With reset accounts, we actually can recover accounts that lost their keys.
And no one seems to be using this feature... mind blowing.
I'll be testing this more in the days to come.

recovery reset steem hive palnet leo
0
0
0.000
33 comments
avatar
(Edited)

Solid observation. Thanks for the note.
Bookmarked.
Will have to check this out.

0
0
0.000
Reply
avatar

He said, 'Stop doing wrong things and turn back to God! The kingdom of heaven is almost here.'(Matthew 3:2)

Question from the Bible, What is the proper way of praying to God? [Part 3 of 3]

Watch the Video below to know the Answer...
(Sorry for sending this comment. We are not looking for our self profit, our intentions is to preach the words of God in any means possible.)


Comment what you understand of our Youtube Video to receive our full votes. We have 30,000 #HivePower, It's our little way to Thank you, our beloved friend.
Check our Discord Chat
Join our Official Community: https://peakd.com/c/hive-182074/created

0
0
0.000
Reply
avatar

Like you, I was confused by the process when I was looking to change my recovery account. I wanted to look it up but lack of time has been a challenge. What you’ve come up with is definitely interesting, knowing Ned I’m not entirely sure it was a legal thing. Guy was a snake I bet it was a steal your shit kind of thing.

Dan though, I would be interested to see if he brought this same thing over to EOS.

0
0
0.000
Reply
avatar

This feature happened on HF11,
I'm not sure what the timelines are here.
When did @dan leave?

0
0
0.000
Reply
avatar

That was before my time, I have no idea. If it was something introduced, that's suspicious! It's a thin line of being great but also being insidious.

Have you figured out how to set a reset account?

0
0
0.000
Reply
avatar

Hf16 or 17, I think.

0
0
0.000
Reply
avatar

You can see in one of the pics I posted the documentation says HF11...

Oh... you mean dan left at HF16?
Didn't realize he stuck around that long.

0
0
0.000
Reply
avatar
(Edited)

He was still here when I got here, and I got here just before 16.
I think he may have left over the changes in 17, but my memory slips some.

That would be a great feature, I got some lost accounts.

0
0
0.000
Reply
avatar

Very interested to see what the results of your investigation yield.

Will this be an enormous uncovering? Could be.

The accounts that were frozen, might be able to use the reset to get around what Sun did.

Posted Using LeoFinance

0
0
0.000
Reply
avatar

I was thinking the same thing... although I don't think that will work because changing the owner key doesn't really stop the network from freezing the account in question.

I think the only option is for the frozen accounts to sue Steemit Inc.
Steem will be deemed a security.
It's going to get ugly.

0
0
0.000
Reply
avatar
(Edited)

Steem is indeed a security by the same criterion Ethereum was not deemed a security by the SEC. Ethereum is decentralized. (Steem is not) Some high-ranking official of the SEC, Hinkley or something, said it in an interview.

All the shit Sun is pulling on Steem could come and bit him in the ass in the future...

0
0
0.000
Reply
avatar

I agree, and when everyone realizes it's possible for him to do all those things on Tron, Tron will be ruled a security as well. He's going to get double jacked.

0
0
0.000
Reply
avatar

He's going to get double jacked.

I'd love to see that midget tyrant's empire collapse under its own weight! 😁

0
0
0.000
Reply
avatar

I intrepret this a little differently.

after 60 days inactivity, the recovery account can set your account ownership to the reset account. In this case it is null. So null will own you lr account.

However, I assume setting it to null means the feature is disabled.

it could be useful if you accidentally lose your keys and were fortunate to choose someone competent and trustworthy to help.

0
0
0.000
Reply
avatar

I do not interpret it this way.

The Owner Authority is being changed to a new Owner Authority.
This means the Owner key is being changed.
If what you said is true you wouldn't need to generate a new key,
yet the documentation clearly states the need for an AuthorityType (this is a key)

t1.png

0
0
0.000
Reply
avatar

Well if that is correct, it is much too dangerous to use unless you are your own recovery account which eliminates most use cases anyway. However, there is still a need for a new key and it would work similar to account recovery, except recent owner key wouldn't be necessary.

To clarify, the way I think it should work is if inactive for 6 months, 'owner key' change is permissible by 'reset account' with confirmation from 'recovery account'. 'reset account' would send 'recovery account' a 'public owner key', however unlike recovery account procedure, an existing 'private owner key' that was valid within past 30 days wouldn't be required.

The reason why the recovery account would be required to provide confirmation is if the inactive account was reported as stolen. Also, the recovery account could at least try and contact the inactive person to see if they are alive and agree.

0
0
0.000
Reply
avatar

Using the reset account on an alt account would work very well.
You could even save the owner key of the alt account on the cloud.
If you ever lost your keys you could recover your main account with the dummy alt account.

0
0
0.000
Reply
avatar

that's a good idea. I'd probably want to share this with a close relative, too. Or there is a service with google that emails various people if you go inactive there. I've set it up with some instructions, but nothing too risky like a private key.

0
0
0.000
Reply
avatar

At the same time, this does open up to business opportunities.

0
0
0.000
Reply
avatar

Indeed, all of the frontends that create accounts (like Splinterlands) can now offer full-fledged account recovery even if the keys are lost.

0
0
0.000
Reply
avatar

Does any of this help? From the Steem source code:

https://github.com/steemit/steem/blob/eba6e9103b8b123224fcbc4f56bc4ef6e58dbff0/libraries/protocol/include/steem/protocol/steem_operations.hpp#L904-L915

   /**
    *  This operation allows recovery_accoutn to change account_to_reset's owner authority to
    *  new_owner_authority after 60 days of inactivity.
    */
   struct reset_account_operation : public base_operation {
      account_name_type reset_account;
      account_name_type account_to_reset;
      authority         new_owner_authority;

      void get_required_active_authorities( flat_set<account_name_type>& a )const { a.insert( reset_account ); }
      void validate()const;
   };

It might be disabled as per https://github.com/steemit/steem/blob/ff9b801615ba8c347a0c3f534ad06adc551b58e5/libraries/chain/steem_evaluator.cpp#L3519-L3521

void reset_account_evaluator::do_apply( const reset_account_operation& op )
{
   FC_ASSERT( false, "Reset Account Operation is currently disabled." );
0
0
0.000
Reply
avatar

Quote by @vandenberg in https://github.com/steemit/steem/issues/240#issuecomment-247119249:

Someone can disable account reset by setting their reset account to "null". But they shouldn't be forced into disabling the very useful owner recovery feature as well. Reset privileges are a more serious risk to their account than recovery privileges, because the latter requires cooperation with someone who has a recent owner key, while the former does not. And the privilege disparity is even greater if only the reset account is allowed to do an owner challenge of the account.

Looks to be disabled since 2016 as per https://github.com/steemit/steem/commit/4f2dfd619df7e7c7914cb54c8cf96fa6f74f5f1a.

0
0
0.000
Reply
avatar

Seems weird that they would completely disable a function that clearly has value.
Let users opt into it if they want...
Although it could completely blindside noobies if the frontend that created their account didn't tell them about it and then that entity goes rogue. Seems like a niche situation though.

0
0
0.000
Reply
avatar

That would certainly explain the error I got when trying to change mine.

t1.png

0
0
0.000
Reply
avatar

i look forward to your test results. I wonder if after a reset would the post still be there, or would they be gone? Common sense says they would still be there, but one never knows with hidden tools.

0
0
0.000
Reply
avatar

In literally mind blown after reading all of this 🤯
You are digging deep.

0
0
0.000
Reply
avatar

Wow amazing, we all need to look into this

0
0
0.000
Reply
avatar

It was announced in this post as road map for Fork 0.15:

Lost Password Recovery
Any account can nominate another account as a lost password recovery agent. This agent will have the power to request a reset the owner key after at least 60 days of account inactivity. If the account is still inactive 30 days after the password reset is requested, then it will take effect.

Users must opt-in to this feature. By default the recovery agent will be @null. A user can opt-out of the feature at any time by changing the agent back to @null.

Seems it was never implemented fully...

0
0
0.000
Reply
avatar

Great insight mate and I must say I didn't know how the recovery account would work and now to hear there is also reset account. This says that HIVE has good bones and is for us to make the most of it!

0
0
0.000
Reply
avatar

pretty amazing and strange as well that no one is using this feature and every one is just believing what the platforms are saying even though this feature to recover the account is provided by these platforms, thanks buddy keep research on hive and steem and plz do share with us like you have shared this, following you is really very useful for me

0
0
0.000
Reply