A few days ago I posted an article on the difference between your master password and your various permission keys:
https://steemit.com/steemithelp/@communitybank/what-are-all-these-keys
One safety tip that I would add on is the following:
Try to use your master password as little as possible, but obviously keep it in a place where you will never forget or lose it. It is your only lifeline to changing all of the other permissions keys.
That said, get into the habit of signing in using your posting key in order to minimize your security risk. If someone were to get a hold of it (or sadly if you accidentally paste this into a post), the worse that would occur would be that someone else would try to earn more for you by posting under your name. You can still collect rewards and most everyday routines can be handled using this permission key.
When it comes to transferring funds or selling SBD for Steem on the internal market, your active key is the most ideal key to use for such financial transactions. Naturally be much more protective about this key as anyone with access to it can steal your liquid funds at ease. But even if this were to get stolen, the fact you did not use your master password gives you the ability to salvage your account by changing the passwords using your master password.
Bear in mind that Steemit remains one of the most safest crypto platforms available because of this tiered access system. This is compounded by the Steem Power concept, in which withdrawals occur over a 13-week period. Because of this delayed process, someone who hijacks your account would still be coerced to endure a lengthy power down process before they can fully tap your account's potential. This helps to give plenty of time and notice when your account is compromised to adjust accordingly.
So with that said remember this simple thought:
