PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

[jackbox]

Thank you, I will do that. It just seems strange that there is no option to turn of the "feature" completely. There are a lot of people who don't browse the different forum sections and simply don't know about the issue. I won't forget it anymore though  

There is.

Leave both fields blank in the secret question section.

It will disable it.


~BCX~

I understand that you can have it turned off, I actually had it turned off before, but thought I'd improve the security. I ment it's strange that the possibility of adding a secret question is still in there, if the feature is bugged and gets people locked out (for months).

Unfortunately it is not a bug. A while back the user database of the forum was hacked. Logins were compromised. Theymos did it so the hackers could not get the password via the reset option. And they purposely kept it secret so the hackers would not know about it. They won't be turning it off. Just need to know or once you do it and get your account reinstated you will never do it again. But someone who did have a BTC address six months prior in a post or signature has no chance of recovering the account.

[BitcoinEXpress]

I am not sure how robust of a solution this is. Not everyone is going to see this warning (or even visit Meta on any kind of regular basis), so they will not know to remove their security question and to not attempt to use it to reset their password to their account.

I was originally set to display red text "You have a secret question set, this is not recommended" if there was a secret question set.

If no secret question is set, you will not see this warning.



~BCX~

[muleroaa]

I am not sure how robust of a solution this is. Not everyone is going to see this warning (or even visit Meta on any kind of regular basis), so they will not know to remove their security question and to not attempt to use it to reset their password to their account.

I originally set it to display red text "You have a secret question set, this is not recommended" if there was a secret question set.

If no secret question is set, you will not see this warning.



~BCX~

BitcoinEXpress, cheeky question: Since you are able to make changes to the forum, are you also able to unlock accounts?

[BitcoinEXpress]

I am not sure how robust of a solution this is. Not everyone is going to see this warning (or even visit Meta on any kind of regular basis), so they will not know to remove their security question and to not attempt to use it to reset their password to their account.

I originally set it to display red text "You have a secret question set, this is not recommended" if there was a secret question set.

If no secret question is set, you will not see this warning.



~BCX~

BitcoinEXpress, cheeky question: Since you are able to make changes to the forum, are you also able to unlock accounts?

Unfortunate typo as English is not my primary language.

I meant to say


It was originally set to display red text "You have a secret question set, this is not recommended" if there was a secret question set.



Only Theymos and BadBear have the technical abilities to unlock accounts.


I'm just a regular member.



~BCX~

[FFrankie]

Is this why I can not make a secret question? I would assume so, but I figured I would ask anyway I did not see it in this thread anywhere

[jackbox]

Is this why I can not make a secret question? I would assume so, but I figured I would ask anyway I did not see it in this thread anywhere

You do not want to set a secret question. If you use it to recover your password your account will be immediately frozen.

[ndnh]

Is this why I can not make a secret question? I would assume so, but I figured I would ask anyway I did not see it in this thread anywhere

You can (can't you??). But you probably should not.

It will make your account vulnerable. (which is why the account gets locked to protect account theft when that is used to recover account)

Using this feature is not recommended. Anyone who guesses your secret answer will have access to your account.

[minifrij]

It will make your account vulnerable. (which is why the account gets locked to protect account theft when that is used to recover account)

Using this feature is not recommended. Anyone who guesses your secret answer will have access to your account.

It won't anymore, it will just be useless considering the account would just be locked if it were used.

What that quote is saying is about secret questions in general. Accounts only began to be locked after the forum was last compromised, as the secret questions and answers were leaked and could be decrypted to hack into accounts.

[notlist3d]

Is this why I can not make a secret question? I would assume so, but I figured I would ask anyway I did not see it in this thread anywhere

You can (can't you??). But you probably should not.

It will make your account vulnerable. (which is why the account gets locked to protect account theft when that is used to recover account)

Using this feature is not recommended. Anyone who guesses your secret answer will have access to your account.

If you made it now it is not that the question would make it vulnerable.  It is that there was a past security breach where the ones at that time were compromised.   So a security question in itself is not really making it vulnerable, but the problem is account's that have same security question now as time of breach.    It also becomes even harder with inactive accounts as chances of changing security question are none.

So the security question now locks to prevent compromise.   It is a pain for those who hit it but it is considered known now, and we really have a LOT less using security questions now then we did say in October of 2015.  If you look back there was quite a few more then say today it has went down drastically that more users know it locks account's.

[GazetaBitcoin]

Hello achow101!

Please be aware that AOBT started translating this topic of yours. Sadly, not all users are aware about the issue qith the secret question, so having this information shared inside local boards can be helpful.

We will make at least 10 translations. Two translations are done already:

- Russian translation, by zasad@
- Urdu translation, by snowpega

Cheers!

[GazetaBitcoin]

Hello again,

AOBT made 2 more translations for this topic:

- Romanian translation, by myself
- Spanish translation, by Porf

Cheers!

[GazetaBitcoin]

Hello again,

AOBT made 8 more translations for this topic:

- Filipino translation, by fullfitlarry
- German translation, by cygan
- Turkish translation, by mindrust
- Pidgin translation, by Chilwell
- Ukrainian translation, by DrBeer
- Hindi translation, by M47AK16
- Indonesian translation, by AakZaki
- Bangla translation, by DYING_S0UL

Cheers!

[AVE5]

This is a Public Service Announcement:

If you lose your password, DO NOT USE THE SECRET QUESTION TO RECOVER THE ACCOUNT. It will result in your account being locked. Please use the email recovery option to recover the account.
The reason that the accounts are locked is because the May 2015 hack leaked Bitcointalk's database which did not securely secure the Secret Question and Answer. To prevent people from guessing the answers, theymos made it so that accounts that are recovered using the secret question are automatically locked when the option is attempted. This is to prevent hackers who may be able to guess the answers from the leaked database.

Thanks for the information Op. With regards of how crucial the information maybe which I see to be necessary for every user's in the platform for both new and old members, I'd had suggested this thread to be pinned so as to keep the update more visible for user's.
Who knows if I'd had fallen victim to use the so called secret questions on my account recovery at when need arises because, anyone that haven't come across this information can vulnerable to fall victim.
How smart decision Theymos made there though because, there's also tendencies that a third party MIGHT rightly guess the user's secret questions and could gain access to the accounts.
Indeed using the email for the recovery process feel very safe because you've to be confirmed through the address you applied for your recovery backups.

[DYING_S0UL]

I'm already aware of this secret question locking situation, but I still had a few questions/confusions, and I would really appreciate if OP or any other knowledgeable person clears it up.

1. Once locked via the secret question, is the account still recoverable? Or is it locked forever to the point of no return !? (imagine you can still sign message from previously staked address). Even with that?

2. Does it show up in BPIP? If yes, what exactly does it says? For the locked accounts, and when one successfuly resets the pass or in failed attempts.

3. I'm assuming that if one repeatedly guesses the wrong answer, the account gets locked! Right? But what if the user answers the question correctly?

Will the password gets reset with right answer? Or do you still get locked, no matter whether right or wrong! More like a trap, where you are meant to fail, no matter what you do.

@LoyceV, sorry for the mention, but I believe you know the answers to it all.  

Later edit: Ok I did some diggings, and while translating the topic, I got answers to question 1 and 3 (partially). It seems locked account can be recovered, but it's a lengthy process, and has a couple of conditions like signing message, emailing and those stuff. But I'm unsure of the "right answer, wrong answer - question no 3).

[hosemary]

1. Once locked via the secret question, is the account still recoverable? Or is it locked forever to the point of no return !? (imagine you can still sign message from previously staked address). Even with that?

You will be able to recover your account if you prove your ownership.
I just created a test account, set a secret question, and then reset my password using that secret question.

Here is what I see now after logging in to the account.

2. Does it show up in BPIP? If yes, what exactly does it says? For the locked accounts, and when one successfuly resets the pass or in failed attempts.

Yes.


https://bpip.org/Profile?id=3772098

3. I'm assuming that if one repeatedly guesses the wrong answer, the account gets locked! Right? But what if the user answers the question correctly?

The account will be locked only if you answer the secret question correctly.
Nothing will happen if your answer is incorrect.

[LoyceV]

3. I'm assuming that if one repeatedly guesses the wrong answer, the account gets locked! Right? But what if the user answers the question correctly?

The account will be locked only if you answer the secret question correctly.
Nothing will happen if your answer is incorrect.

I've always thought of "secret questions" as a social engineering risk: "What's the dog's name?" > "Max" (kudos if you know the movie reference). So I always answer them by randomly hitting the keyboard a few times, and storing that information in my password manager just in case.
That explains why answering it incorrectly doesn't matter: feel free to try to brute-force my "secret answer". It's not going to work. But if you guess it right, something's seriously wrong and the account should get locked.