POCKET Day 4: Security

Pocket is up to 695 Genesis claims. There have been several attempts of people wanting to buy and sell tokens; I urge people to take caution in these trades. Make sure you trust the person you're trading with, or use an escrow partner that you both trust. As always, you can see offers by looking for new Pocket posts here.

Security

As designed, Pocket tokens are strictly less secure than STEEM tokens. This is because each Steem account has a couple different permission levels; the two relevant ones are called Posting and Active. When you submit a post or vote, you're using your Posting permissions. When you send STEEM or SBD or start a power down, you're using your Active permissions.

In order to make it easy to interact with Pocket on steemit.com, I made it so that Pocket only uses your Posting permission. This was a design choice that I made specifically to keep the protocol as simple as possible, but it has the unfortunate effect of reducing the security of your tokens.

Why are Posting permissions less secure than Active? If you haven't given anybody your Posting permissions (posting key), then they're not less secure. However, there are several services (including @steemvoter) which require you to give them your Posting key. @streemian is another example; it works in a different way, but it's the same idea: you give @streemian Posting permissions on your account.

So please keep in mind: Anyone who has Posting permissions on your account has full control of your POCKET tokens! It would be theft for them to take them, but it would be really really easy theft.

What are my options for securing my Pocket tokens?

1. Don't give out Posting permissions. If you have given them out, revoke them by changing your Steemit.com password (but always make sure to keep a copy of your old password!). This answer is really unhelpful for those of you who like @steemvoter and friends.
2. Use two separate Steem accounts; one to store your Pocket tokens and one to do voting and posting. This answer is really unhelpful for those of you who don't have the means to create new accounts.
3. Trust the people who have Posting permissions on your account. Cryptocurrencies are not supposed to require trust, but you nearly always have to trust someone. Make your trust count.

For more information

• Pocket Genesis Post (Resteem to claim your stake)
• Pocket Protocol Specification
• Pocket Announcement Post
• @biophil's Pocket Confirmer Github
• My meta-subchain post
• Dan's original post on subchains