Forum account: security, privacy, and recovery

[OcTradism]

My main concerns is security and privacy and the weekend I have time to learn more about them. The thread is born this way, in the weekend.



Table of Contents

• Security
• Privacy
• Recovery

Account security
You can visit the page in 2 ways:

• Profile - Account Related Settings (for password, secret question) / Forum Profile Information (for birthday, location, gender)
• Use the link

Password
On the forum, there is a reminder that emphasizes the importance to set up a strong password. Copy and paste the link: https://bitcointalk.org/index.php?action=profile;sa=account. You will see the reminder.

Choose password:
For best security, you should use six or more characters with a combination of letters, numbers, and symbols.

Do you actually set up yours as strong as guided? If you have not yet set it up like that, change yours to a stronger one. If you are still confusing how to set up a good and strong password, I found that topic for you: [GUIDE] How to Create a Strong/Secure Password

Secret question
It is for the past (before data breach in 2015). Now, you should not use it because PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT
and Removing Secret Question already with an answer. Like this user: Busminer account locked, please help to unlock

The forum has its reminder to not use secret question!

Secret Question:
To help retrieve your password, enter a question here with an answer that only you know. Using this feature is not recommended. Anyone who guesses your secret answer will have access to your account. It's like a second password.
   
Answer:
Choose carefully, you wouldn't want someone guessing your answer!

Captcha bypass
Captcha bypass
If you care about your privacy, you would use Tor but there is annoying problem with Tor: You will have annoying captcha problems. The admin creates the captcha bypass code for each of you. It gives you more convenience to keep using Tor (for your privacy) while don't violate your comfortableness here. You can use the code to surpass captcha issues and log in as without Tor.

Get your code by clicking on the link: https://bitcointalk.org/captcha_code.php

Disadvantage

If someone else gains access to your unique captcha-bypass link, then they could try to brute-force your password. In that case, you should reset it:

You see the risk so please make sure to secure your captcha bypass code (store it offline).


Your personal info leak by yourself
What you can leak by yourself?

• Email
• Location
• Birthday
• Gender

See the following example and avoid doing the same. When you need help (account locked, banned, etc.), you can create a topic to ask for guide to do next from community. In this process, remember don't post full details of yours. Replace your email address, and other personal info by xxxxxxx, or blur them by Paint, Photoshop, etc.
Such info is needed and can be required by forum admins to recover your account. As vital rules, don't leak your real info on online space.

Risks:
Leak them (email, ie.) will put you under attacks of phishing sites, spam emails, etc. It results in risks not only on your forum account but also on your other things (bank accounts, exchange accounts, personal secret things, etc.)

Or how to return account access to this mail xxxxxxxxxxx?

Your Bitcoin Forum ([Suspicious link removed] to xxxxxxxx by IP address xxxxxxxxxxx.

Birthday: set it up and have a birthday cake each year but you should not set it up or if you set it up, you should not use your real birthday. The same rule for location and gender.

Where to set it up?
There: copy and paste the link: https://bitcointalk.org/index.php?action=profile;sa=account
https://bitcointalk.org/index.php?action=profile;u=mysuerid;sa=account, replace myuserid to your userid.

(I took the birthday cake image from Bodykeepers


Stake an address
Stake your address to use it as proof of account ownership later.

Which address is used to stake?

• Bitcoin (first priority)
• Ethereum (don't think of it if you can sign a message with Bitcoin wallet).

Ethereum address can be used too but you should always prioritise Bitcoin for your signed message. Additionally, backup that wallet and secure your backup. In future, if your account is hacked, sign a message to prove ownership (from that wallet) is a good evidence to recover your account.

How to sign a message? See following guides
Stake your Bitcoin address here
How to sign a message?


Check seclog and myips pages frequently
https://bitcointalk.org/seclog.php (stores data each 7 days and will be overwritten with new data)
https://bitcointalk.org/myips.php (it does not make sense if you always use Tor)



Account privacy
Your logged IPs for the last 30 days: https://bitcointalk.org/privacy.php

Choose the Limit IP retention for your personal favorite privacy level. Read the About privacy to have more guide details.

. If you choose it, your Full IP will be stored up to 6 months.
Limit IP retention:
Reduce the retention of your future logged IP addresses. This will make it far more difficult to recover your account if it is ever stolen; make sure that your email address is correct and that you have staked a public key.

Account recovery
Please bookmark those threads and read them at least once to have knowledge on how recovery process works. And use them just in case your account is locked, hacked, frozen, etc. Follow those guides to recover your account and you have to be patient.

• Account recoveries are moving again
• Recovering hacked/lost accounts
• FYI: "ownership change queued"
• Cryptios (the recovery team can help you).

[1715416006]

1715416006

[1715416006]

1715416006

[Pmalek]

Which address is used to stake?

• Bitcoin (first priority)
• Ethereum (don't think of it if you can sign a message with Bitcoin wallet).

I don't think admins or the recovery team will consider signed Ethereum addresses when proving ownership and recovering accounts. They could, but in that case people will start asking to sign messages from other altcoins as well.

According to theymos:

Typically, the only acceptable method of proving ownership is by signing a message (including current date and desired new email address) using a Bitcoin address or PGP key associated with the account. A Bitcoin address or PGP key is associated with the account only if the account posted the key/address, sent it in a PM, or if it is still listed in the account's profile.

I very rarely recover accounts if you can't prove ownership as described above.

One might ask, what those rare situations are. But it doesn't cost anything to sign a message with a Bitcoin address so there is no sense in experimenting with alternatives. 
 

[Latviand]

This is really helpful for those people who are wondering about the security of their account in this forum.
It is really not that easy to recover an account once its lost, you really need to undergo a lot of process which is very hassle.

Thank you for this @OcTradism, this could help a lot of users here.

One question. Is it much better to recover an account if the email that you used in your lost account is your personal email? Is it enough to prove your ownership?

[OcTradism]

The best should be a mix of:
 Email was used to register account.
A Bitcoin signed message that was quoted or staked before.
And maybe more things, secret questions, IP addresses, some more things that admins, Cryptios team can ask you to prove account ownership.

[Upgrade00]

One question. Is it much better to recover an account if the email that you used in your lost account is your personal email? Is it enough to prove your ownership?

• I'm not sure I got your question, but recovering accounts involves sending a mail to the recovery address and it's preferable if it can be sent from the accounts email address;.

If your account was hacked

Email recoveries...@bitcointalk.org, ideally from the account's email address. Include your username and a brief description of the details of how/when the account was hacked.

• It's is not always enough, a signed message is the preferred proof of ownership, but depending on the situation it may not be required;

Additionally, we will be somewhat more lenient in recovering accounts without signatures, though signatures often will still be required, depending on the situation.

[OcTradism]

This post from Welsh is very good for your forum account's sensitive data in PMs. I think everyone should spend time to read Welsh's post and check PMs and delete PMs that have sensitive information.

If your account unfortunately is compromised, you will not lose your sensitive data in PMs if you delete them. PMs will be only deleted all if sender and all receivers delete them all. It is difficult to ask receivers delete PMs in their conversations with you but you must do it from your side.

Probably the best thing to do if you're communicating without any sort of encryption. Delete any private/sensitive data just in case of a compromised account. I'd assume that this is sort of a unwritten rule with a lot of people who have done trades on here. A while back I started to delete all conversations unless they were important enough to warrant staying there, but those that are important are few, and far between. I ultimately stopped when it became quite tedious.

Nowadays, if I were in a trade, and someone had to give me their PO box, or address, maybe even their email address I'd probably delete them; same with names etc. However, keeping the trade details or the back, and forth conversation is probably a good idea as long as it doesn't have any sensitive data. At least, that's now my approach. I sort of have a spring cleaning every so often, where I will go through, and delete any PMS of outdated questions, or conversations which aren't related to a trade.

I don't there's anything worth saving outside of the forum for my own personal records though. Unless, I wanted to delete certain PMS on the forum, and only have a local copy to free up my inbox, but for me I don't see any particular gain from that except a nicer looking personal message section.

[erikoy]

Yes, that is a good idea to secure account here in btc but for us low ranks would not mind doing it for now because anyone can rank up to member. Getting merits seem to be ready and available witg merit source around. There are merit giveaways too so whenever low rank account gets compromised then one could start again by registering another account. But, whenever one reaches full member to legendary then securing account should be a good practice. Anyway, I see that bct has strong security features and that only few account gets compromised by being unmindful acts of a certain user that lead to disclosure of his account important details like email and password.

[icopress]

If you care about your privacy, you would use Tor but there is annoying problem with Tor

The Brave browser also has "Tor mode", you can add it to the description if you like.

[OcTradism]

If you care about your privacy, you would use Tor but there is annoying problem with Tor

The Brave browser also has "Tor mode", you can add it to the description if you like.

Brave browser is not good as they have claimed to be since their start. They arbitrarily require KYC and implement shady things. Their reputation is damaged from their shady developments. I don't recommend Brave browser. If need privacy protection, do it by using Tor browser (the best) or FireFox.

Brave browser hijacking links and affiliate codes!
[SCAM]Archive.is has stopped supporting Brave Browser

[ABCbits]

If you care about your privacy, you would use Tor but there is annoying problem with Tor

The Brave browser also has "Tor mode", you can add it to the description if you like.

Brave browser is not good as they have claimed to be since their start. They arbitrarily require KYC and implement shady things. Their reputation is damaged from their shady developments. I don't recommend Brave browser. If need privacy protection, do it by using Tor browser (the best) or FireFox.

Brave browser hijacking links and affiliate codes!
[SCAM]Archive.is has stopped supporting Brave Browser

Good point, but IMO it's still better than Chrome when you need to visit website that only works properly with Google Chrome, if you disable ALL annoying feature (BAT reward, exchange widget, etc.).
But i would use another browser based on Chromium such as https://github.com/Eloston/ungoogled-chromium.

If you care about your privacy, you would use Tor but there is annoying problem with Tor

The Brave browser also has "Tor mode", you can add it to the description if you like.

If you plan to use Tor, you better use Tor Browser.

[Welsh]

Brave browser is not good as they have claimed to be since their start. They arbitrarily require KYC and implement shady things. Their reputation is damaged from their shady developments. I don't recommend Brave browser. If need privacy protection, do it by using Tor browser (the best) or FireFox.

Brave browser hijacking links and affiliate codes!
[SCAM]Archive.is has stopped supporting Brave Browser

I'll highly recommend against using Brave, and personally I would probably only recommend Firefox. For one they aren't owned by Google, which I consider a privacy breach in its own right, but in my experience have been the stand out guys from a security point. There's a reason why Tor Browser is built inside of Firefox.

I'd also always recommend using a offline, local password manager rather than those built inside extensions, or the browser itself. In fact, I'd avoid installing extensions almost all together. The exceptions would probably be; No script security suite, https everywhere, and an ad blocker like Ublock Origin.

[lovesmayfamilis]

I'll highly recommend against using Brave, and personally I would probably only recommend Firefox.

I agree with you about the Brave browser.
But also, for those who can and want to figure out all the privacy settings on their own, I would like to offer this guide for configuring the Firefox browser.
I have been looking for an up-to-date guide for a long time, with a more detailed description of all the actions that are proposed to be performed for the browser to become the most secure safe browser. And in my opinion, this is one of the complete and detailed tutorials.

https://12bytes.org/articles/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs/

[Onuohakk]

It's quite necessary to set up your forum account privacy and security in such a way it won't get temper upon.
It's painful to lose an account after years of building it.

Are there ways to set up your forum account by getting notification of every new post that comes in this forum through an email address?

[OcTradism]

It's quite necessary to set up your forum account privacy and security in such a way it won't get temper upon.
It's painful to lose an account after years of building it.

You can recover your account if you stake a bitcoin address or your bitcoin address was posted and quoted and you can sign a message from it after the hack of your account.

Are there ways to set up your forum account by getting notification of every new post that comes in this forum through an email address?

You will receive email notification from the forum if your posts are deleted as spam, zero value, off topic but you won't receive notification if the thread in which you post is moved by moderators to trashcan.

Your email will be flooded with notifications (3 to 4 thousands of notifications each day: https://btctalk.live/today/) and I don't think you need them. You can edit your Watch List, Watch board with https://bitcointalk.org/index.php?action=watchlist

[shield132]

OcTradism
You should encrypt sensitive messages. As you know, we also use cloudflare, so, this is a must.

Btw since the secret answer is no longer considered and is even play with death, why do we still have it and why wasn't it changed? Despite the fact that I highly agree and confirm that it's our responsibility to take care of our accounts and there is no need to blame others for your mistakes, I think additional security wouldn't be a bad, especially for those who are very sensitive regarding this and prefer an extra layer of protection.

But first of all we should integrate this rule: Don't Bring Me Problems, Bring Me Solutions. This applies to me at the moment but I'll think around it and maybe publish my opinion.

[Welsh]

Also worth noting, the majority of the time security breaches are because of the person behind the screen, and not the software. Since, usually its easier for a attacker to target someone who has weaknesses, and only one mind, than to attack software which has been out for years, tested by thousands, and being actively developed. I'm not saying that software isn't targeted because it most certainly is. This is especially true, when it comes to privacy. There's a lot of software which is specifically designed to keep your privacy in tact, but its usually the end user which compromises it by misusing the software, or simply by making a mistake.

So, although its always best to take security seriously, and follow the advice of the experts, you should be taking precautions against your mistakes that can creep in through complacency, which is something privacy, anti virus software, and security measures can induce by giving an illusion of safety.  

Btw since the secret answer is no longer considered and is even play with death, why do we still have it and why wasn't it changed? Despite the fact that I highly agree and confirm that it's our responsibility to take care of our accounts and there is no need to blame others for your mistakes, I think additional security wouldn't be a bad, especially for those who are very sensitive regarding this and prefer an extra layer of protection.

Finding the balance between security, and user experience is difficult. Depending on your user base, some might require strict security practices, where others may find convenient ways of retrieving their accounts beneficial if they so happen to lose the account. Without being too stereotypical, this is quite common in the older generations, where they become forgetful of their credentials, or simply don't want to go through all the security protocols to retrieve their data. As far as I'm concerned a security question is a flawed design, because of the way its presented. A lot of websites do it far worse, and make you choose between a predefined question, which means its usually asking a personalized question such as "what was your first pets name", now you could do a random answer length should be treated just as important as a password though), but usually people find this convenient to remember, and put in their actual data, which is usually easily found out with social engineering. Especially, of the age of social media where pretty much everyone documents their life, sometimes without even realizing the data they're presenting to the world.

[OcTradism]

Key principle to keep identities and accounts away from threats is store those details offline.

It does not make any sense if you set up a very strong password (long and complicated) but you save its details on Google Drive, Dropbox or on the devices you use with Internet connection every day.

If want to store those details on digital devices and digital files, do it on offline devices (as less connection to Internet as possible) and encrypt the file with strong passwords.

Some password managers can help:
https://keepass.info/
https://play.google.com/store/apps/details?hl=en&id=com.android.keepass
https://pwsafe.org/

[GUIDE] How to Create a Strong/Secure Password
https://protonmail.com/blog/protonmail-com-blog-password-vs-passphrase/
Good topics on security and privacy (no password managers or softwares can protect you if you have bad websurfing practices)

[Pmalek]

No sensitive information should be displayed or be obtainable by anyone visiting your profile link. Skype or emails connected to your real name. Even a website link that leads to your personal website where you might have posted about yourself, where you live, work, or a photograph of yourself, your house, etc. Links to social media can obviously also be abused if someone targets you.

[OcTradism]

No sensitive information should be displayed or be obtainable by anyone visiting your profile link. Skype or emails connected to your real name. Even a website link that leads to your personal website where you might have posted about yourself, where you live, work, or a photograph of yourself, your house, etc. Links to social media can obviously also be abused if someone targets you.

It is. I don't catch people thoughts that how they thought and made decisions to leave all information in one place. Here, on profile page. Facebook, with their real names, phone numbers, locations, and more things.

Some people leave their bitcoin address on their profile page or personal text and I won't surprise that they reuse that address many times.