When you sign up to Steemit you are presented with this:
The first rule of Steemit is: Do not lose your password.
The second rule of Steemit is: Do not lose your password.
The third rule of Steemit is: We cannot recover your password.
The fourth rule: If you can remember the password, it's not secure.
The fifth rule: Use only randomly-generated passwords.
The sixth rule: Do not tell anyone your password.
The seventh rule: Always back up your password.
This is 100% true. The Steem blockchain is not like any other platform you are used to on the internet.
You can't press a button that says 'forgot your password? ' and expect that it will be mailed to you. (like any other website).
You are 100% responsible for your own actions here. The blockchain is decentralized. There is no third party to help you out.
Make sure you have your security in order straight from the start.
The best time to do it is when you just created your account. Your account won't have much value and in case you do make a mistake it's not the end of the world.
You don't want to learn about these things once your account is worth thousands. It's a lot scarier then I can tell you that from experience.
Don't ever log in with your master key (the one you got when you created your account).
There are 3 keys you need to know about. The posting key, the active key, and the master key.
You can log in with each of these keys.
With the posting key, you can only post, comment and upvote. (not transfer funds).
With the active key, you can post, comment, upvote, and transfer funds.
With the master key, you can change all the keys, including the master key.
There is not a single reason why under normal circumstances you want to log in with your Master key, so don't do it!
Always log in with your posting key. You can find it here. Only login with your active key if you intend to transfer funds.
Steempower is the best security.
In case your account is compromised (the active key was stolen). Steempower offers another security barrier. Because it takes a week to power down 1/13th of your STEEMPOWER to liquid STEEM (that can be transferred).
It gives you therefor a whole week to fix the situation and undo the hack.
This is where your master key comes in. And the only time you should use it.
With the master key, you can change all the other keys. Locking out any hacker and undo the power down.
I talk about it more in my vlog.
Starts @ 1.35
I am a witness with our developer group 
for the Steem blockchain. If you want to support us I would appreciate your vote here.
We build Steemify a notification app for your Steemit account for iOS.
Get it Here:
▶️ DTube
▶️ IPFS