Bitcoin Forum

Why would a small image be this important to you? It doesn't really mean anything.
Eventually the feature will be brought back.

Think it won't be brought back till the new forum appears

Why would a small image be this important to you? It doesn't really mean anything.
Eventually the feature will be brought back.

It's not like it's SOOOO important but it's cool.

Why can't they simply turn them back on.is there some issue?

And why hasn't the forum been upgraded and fixed yet. Are the 1000s of Bitcoin donated to Theymos not enough to cover it?

I would love avatars to come back. Don't see why they were taken away in the first place.

It was because bitcointalk got hacked back in 2013 and they needed to disable them

On October 3, it was discovered that an attacker inserted some JavaScript into forum pages. The forum was shut down soon afterward so that the issue could be investigated carefully. After investigation, I determined that the attacker most likely had the ability to execute arbitrary PHP code. Therefore, the attacker probably could have accessed personal messages, email addresses, and password hashes, though it is unknown whether he actually did so.

Passwords were hashed very strongly. Each password is hashed with 7500 rounds of sha256crypt and a 12-byte random salt (per password). Each password would need to be individually attacked in order to retrieve the password. However, even fairly strong passwords may be crackable after a long period of time, and weak passwords (especially ones composed of only a few dictionary words) may still be cracked quickly, so it is recommended that you change your password here and anywhere else you used the password.

The attacker may have modified posts, PMs, signatures, and registered Bitcoin addresses. It isn't practical for me to check all of these things for everyone, so you should double-check your own stuff and report any irregularities to me.

How the attack was done

I believe that this is how the attack was done: After the 2011 hack of the forum, the attacker inserted some backdoors. These were removed by Mark Karpelles in his post-hack code audit, but a short time later, the attacker used the password hashes he obtained from the database in order to take control of an admin account and insert the backdoors back in. (There is a flaw in stock SMF allowing you to login as someone using only their password hash. No bruteforcing is required. This was fixed on this forum when the password system was overhauled over a year ago.) The backdoors were in obscure locations, so they weren't noticed until I did a complete code audit yesterday.

After I found the backdoors, I saw that someone (presumably the attacker) independently posted about his attack method with matching details. So it seems very likely that this was the attack method.

Because the backdoors were first planted in late 2011, the database could have been secretly accessed any time since then.

It was initially suspected by many that the attack was done by exploiting a flaw in SMF which allows you to upload any file to the user avatars directory, and then using a misconfiguration in nginx to execute this file as a PHP script. However, this attack method seems impossible if PHP's security.limit_extensions is set.

It was because bitcointalk got hacked back in 2013 and they needed to disable them

For those interested, you can refer to the thread https://bitcointalk.org/index.php?topic=306878.0

Good point will contribute a video of it in practice as well since a picture says a 1000 words and a video is a play by play :)
http://www.youtube.com/watch?v=LKrOHAfMdxI

That said did Theymos finally review the 1XX script the hack was way back in 2013 so there should have been sufficient time to see if the problem was with avatars.

It seems your quotes didn't work very well. ;)

I would also like to get avatars back and why they were disabled , for what reason?

For those interested, you can refer to the thread https://bitcointalk.org/index.php?topic=306878.0

and also return "move topic" and "make thread self moderated" to the options please.  No reason to remove them, not having them in there just creates more work for mods.

Guys please stop creating threads like this, you won't be able to change your avatar until the forum software upgrade.

This thread is not new (created in Apr), but it gets bumped...

This thread is not new (created in Apr), but it gets bumped...

It's in development now. There's an entire subforum dedicated to it: https://bitcointalk.org/index.php?board=167.0

What development needs to be done. All they need to do is enable it.

What development needs to be done. All they need to do is enable it.

Changing avatars is disabled because of a security problem. They won't enable it until the new forum software.

I would also love to finally be able to have an avatar. :)

Why did they get disabled anyway?

What security problems arise from that?

Why did they get disabled anyway?

There's no point waiting for avatars until the new forum is complete. A new forum is going to replace this forum regardless.

If security is priority number one, then a security audit will surely need to be put into place upon logo reactivation. More money spent.

This is the first forum when avatars are disabled for security reasons. And I don't get it why, really. So big and popular forum without avatars? It is time to bring them back imo.

Pleassssseeeee.

I want to get rid of this ugly Litecoin logo in my avatar.  :D

If not re-enabling avatars, please at least allow us to delete our old ones.

Bitcoin 4 life

whats an avatar?