This guide is to help Steemians understand what's behind the process of using recovery accounts on STEEM Blockchain.

What's a Recovery Account?

Basically it's similar to what you call a recovery Gmail account. Someone else account (that can also be under your control or not) will be able to authorize a swap of your OWNER key for another one referenced by you. So, basically you will entrust that account "super powers" to swap your OWNER key for you but only if and in case you Accept it! Yes, that account can't really do anything until you accept the request of it (so don't freak out, just yet).

(it's assumed people will not accept requests for Public OWNER keys that they do not hold the corresponding private key). 😁

Can I change it?

If you create an account via Steemit, then the default recovery account will be @steem. If you allow someone else to create an account for you, or use any already claimed account to generate a new one, then it will default to the account creating the new one.

On our previous service announcement a user inquired about the handling of account recovery, that in this case will default to @forykw (since we are using his claimed accounts).

The service policy was updated on that post to clarify this.

Requirements

To change the Recovery Account you need the owner private key of your current account and a new valid account to switch the Recovery Account to. You also need to have some STEEM POWER (very little) to execute this.

As an example, @lovesteemdemo was created to demonstrate how this happens, and with 10SP delegated, it consumed less than 1% of RC (Resource Credits).

You can change it at any time as many times you need (as long you have SP to execute the change). Beware that it takes 30 days for the change to take effect (during this time, only the previous recovery account can receive recovery requests).

Recovering an account

The official process and FAQ is here, but I will give my own version of it and difference compared with, when you are asking someone else to recover your account (in case your Recovery Account is not @steem).

Requirements

Only accounts to which the master password was changed, at least once, can be recovered. If you never changed you master password and suspect someone is using your keys, please change your password immediately (no recovery will be required if you do this with success).

If @steem is your Recovery Account

Then you simple follow the https://steemit.com website instructions. Copying th FAQ above:

How does the stolen account recovery process work?

If your password has been changed without your consent, then the account designated as your recovery account can generate a new owner key for the account. The account recovery must be completed within 30 days of the password being changed, and you must supply a recent owner key that was valid within the last 30 days.

Steemit Inc. owns the default recovery account (@steem) for all users who sign up using steemit.com. Steemit can only identify users by their original email, Facebook, or Reddit logins that were used to signup via steemit.com.

If you don’t have the master password or owner key that was valid the past 30 days, or are unable to prove that you are the original owner of the account, then your account will be unrecoverable.

The stolen account recovery process can only restore ownership of the account. It is not possible to recover funds that were stolen.

For other Accounts

You basically need to generate a new Owner Key (the new key needs to be bound to the account you are recovering) and then contact your current Recovery Account user (and provide the NEW OWNER PUBLIC KEY) that can request an account recovery process using the new owner PUBLIC Key you just generated. Then you will receive a request of Recovery Account to accept withing 24 hours (otherwise it expires and a new one has to be submitted if desired).

To complete the process of acceptance you will need BOTH NEW and OLD OWNER Keys (private and public) of your account, so ALWAYS KEEP safely stored somewhere.

After the account is recovered, your master password still needs to be changed (it would be currently set to the one changed by the "attacker"/"hacker". You will need to wait 1 hour before being able to do this.

During this 1 Hour!

The attacker can still log with the master password, but can't use any of the previous keys (basically can't do anything with your account) or see the new OWNER Key you used to recover. The attacker can only try to contact the Recovery Account and ask for a request using his OWNER Key. Therefore it's important that during this hour you monitor your account transactions and have close relationship (if possible) with your Recovery Account user. This way, the attacker will not falsely attempt to recover the account again. This 1 hour also can play on the reverse point of view, which is if your Recovery Account was hacked at the same time yours is (will be very rare and potentially an organized attack). In this case you have 1 hour to sort things on both sides.

After 1 hour...

The process completes once you change the master password using your new OWNER Key, which will change all your keys again (including the owner key again). After this, the attacker will not be able to use the previous master password anymore.

NOTE: In case you use the same master password that generated your new OWNER Key above, then you will still have the same owner key. There is nothing wrong with this.

Special Thanks!

Nothing off this would be as easy to explain and test as it was, if it wasn't for https://steemworld.org created by @steemchiller. So, thank you so much for creating this amazing and useful tool. I would encourage everyone to check it out and support it if you can.

Love❤️Steem Account

Disclaimer: @lovesteemaccount is a free service and does not charge any fees from ANY interactions. Users donations to the account will be used (as form of delegation) to support new users accounts initial activity. The policy or service details might be subject to change in any extent and without notice. At the creation of this post, @forykw is the only owner and executor of the service, which might change or not in the future.