Bitcoin Forum

What is the situation with being unable to change the profile avatar at this time?

Not only at this time, but for over a year - there was an exploit associated with it, so that feature was disabled. As soon as the new forum software is up and running, perhaps later this month, we should have that option back again.

I think not this time. Wait until new forum software release ;D
Only old accounts can put an avatar.

I see. It's been a while. I made a stupid mistake, and used the same password for my account here as on an altcoin mining pool and someone fuck-tard stole my account. Was like screw it! and left until now. Now I'm even more pissed I lost that account!

Thanks for the info!

Please check this : https://bitcointalk.org/index.php?topic=497545.0 (https://bitcointalk.org/index.php?topic=497545.0)
maybe your account can be recovered :)

If you have a Bitcoin address or PGP key associated with that account, either through posts, PMs, or info on the account's profile, you might still be able to recover it - check the following thread by theymos: https://bitcointalk.org/index.php?topic=497545.0 (https://bitcointalk.org/index.php?topic=497545.0) (Recovering hacked accounts or accounts with lost passwords).

EDIT: Jombrangs beat me to it, it seems. ;)

I've been told that it will be back within the next few weeks!!! The forum is workin' on a new layout!!! Good Luck!!!

Will wait for this..
Hope a new forum will carried a better protection and more function

The feature was removed due to an exploit involving avatars. Only older users (such as myself) have them.

Can't a modification be made to the code to avoid that exploit ?

Well it could but it was just decided not to bother for whatever reasons. Avatars aren't really a priority and they'll be back with the new forum anyway.

According to mprep, the code was indeed modified to avoid the exploit:


He didn't go on to say why the feature was not re-enabled in that post but, perhaps that was not done out of concern there could be other related vulnerabilities, as well as that being a low priority feature and the work being put towards the new forum software instead, as hilariousandco mentioned.

I thought he was talking about just fixing it so avatars could be re-enabled.

Hmm, that was my impression as well. :)

I just went on to say that they did supposedly fix the issue, but that, in addition to the reasons you stated, they probably weren't really too sure everything was indeed working as intended, thus chose not to take the risk of re-enabling it - did I miss something? :D

There was a post i read not long ago where som member had written a code or similar that alowed users to modify it and then put that in there personal text spot.
After doing this you would have a piture where your personal text would be.
I will try find a link and edit this post, i do remember b!z did it and confirmed.

No you can put it only in the signature space, not in the personal message.  This is the thread : https://bitcointalk.org/index.php?topic=914173.0

Think he's talking about this: https://bitcointalk.org/index.php?topic=914176.0

Yes, just in your signature so not really an avatar though it is pretty cool.

Yep, thats the one.
I've read so many posts since then i guess i kinda got mixed up.
Still if ya desperate.

Hmm, I wait for a long time, I hope they can update asap, I really need to change my avatar, I don't like my current one(feathercoin logo)  ;D

Where can I see how that exploit worked? I'm interested because I don't want the same happening to me when I develop a web platform.

This is the payload :

https://gist.githubusercontent.com/super3/6802808/raw/4af8de8037a7079d30236c608e1247370849f585/gistfile1.txt

and this is the video :

https://www.youtube.com/watch?v=LKrOHAfMdxI

and here an article :

http://www.coindesk.com/bitcointalk-forum-hacked-hole-seekers/

So, if I insert this file using an <img> tag, will I get all these flashy things? I don't seem to understand.

No , I don't think.  (I think)The hacker/s have inject the code into an image and after uploaded this image as avatar.

OK, but how was this “image” run, then?

I dont see why is it important at all?
Avatar is just a picture which represents nothing.
As it is a serioius forum I think that avatar is not good idea as anyone can upload picture by its own choice which can be rude, nude or sick. And banning a preson because of avatar is funny too. Thats why there is no avatar.

I have argued in other thread that avatars make easier to identify different people, since our brains process images faster than text.

I've find a great thread here in the forum : https://bitcointalk.org/index.php?topic=306878.0

This is true, though scammers could capitalise on this and that's why it might be a good idea limiting avatars to higher ranks than Newbies. NSFW avatars likely won't be allowed though.

Thanks, this is very helpful.

You are welcome, I hope to see again the possibility to upload :D or better use an avatar in the new forum software.