Don't use your bitcointalk account password on other websites

[Mahdirakib]

Most of the people are aware of this issue. And there might be few topics about this matter before. I just want to share my experience with you all and hope it will be helpful for those who aren't aware of it.

Firstly my intention was to earn bitcoin from faucets. But slowly slowly the forum introduced me with other crypto related things (like gambling, mining, trading, investing). I started to engage myself with those platform and created account at most of the new sites that I have found in this forum. I used the same password, email and username at most other sites which I have used in my forum account. It was my fault. Hacker got my password from any of those site(phishing) and accessed my account.

Though he didn't made any post or spam from my account. But he changed my account password on 9th July, 2018. On 12th July I came back and found that my password was changed, was unable to login. So I reset my password via mail. Within two weeks my account get locked for security reason.


Finally I took step to get back my account in May this year. And recovered it on 5th June.
I'm not the alone victim of the hacker. The hacker just used my sMerit and send it to someone in this reply
I think that user is also a victim of the hacker. There are few more user in the list.

• Danglen1010
• ChardsElican28
• bgpsq
• peter0425

Maybe there are more victim of this. First three people are banned now. The 4th user peter0425 has recovered his account and created a topic about the hacked issue. Check it here.

Hacker just used sMerit from these account during that time and sent one to another. If you notice those user security log at bpip.org you can realize it.

Check this topic to realize the importance of account password & how to secure it.
Prevent your bitcointalk account from hacker- prevention is better then cure.

As a newbie all should stay aware of this matter. For your account safety don't use the same password at other sites. Every website isn't going to be legit what you will see in this forum. Stay aware of phishing sites.[/list]

[CucakRowo]

Or :
1. Always make your email in your profile account "hidden"
2. Use different email (not the email you used when registering at BTT) when you follow bounty. Coz usually your email exposed when following bounty. You guys can use proton mail or mailfence services if there is a bounty where one of the requirements is to include an emaill.
3. Always use browser that support your privacy (firefox or tor browser).
4. Use VPN always in your daily internet activities.

[Coyster]

Some users complain it's not that easy to always create a strong new password all the time, so for users like that who find it difficult to create strong and unique passwords across many of their accounts/profiles, learn how to create a strong/secure password here, the instructions in that thread will help you, not only to secure your btt forum account, but any account you own.

[pixie85]

This is pretty much the most basic thing in your Internet security.

You should never use any password more than once because if you use it for more a single database leak will compromise you on multiple levels.

If you use the same password in your bitcointalk and email and the hacker somehow phishes the bitcointalk password he will also know the email and its password. Through the email he can find other sites you have used in the past because people rarely remove spam or clean trash on email accounts and all your "thank you for registering" emails can be found there.

One site - one password.

[notblox1]

It is good that you learned something about passwords and to never reuse them on more than one website.
People are doing exact same thing not only for websites and loging details, but also for crypto wallets.
Yes it seems easy at first, but you will pay high price in the end.

[OcTradism]

1. Always make your email in your profile account "hidden"
2. Use different email (not the email you used when registering at BTT) when you follow bounty. Coz usually your email exposed when following bounty. You guys can use proton mail or mailfence services if there is a bounty where one of the requirements is to include an emaill.
3. Always use browser that support your privacy (firefox or tor browser).

Forum account: security, privacy, and recovery
and you can check my list to get more if you are wanting to get more tutorials for security, privacy protections with Good topics on security and privacy

4. Use VPN always in your daily internet activities.

It is only when you need to hide your privacy (of course you should).

[blue Snow]

^
1. For remember, don't ticking "Always stay logged in" if using public pc



2. Don't click auto save login and password in browser
3. If you mobile and always have urgent situation, prepare your USB stick and download portable browser.

[Anwar151]

2. Use different email (not the email you used when registering at BTT) when you follow bounty. Coz usually your email exposed when following bounty.

And activate the 2FA feature on the email for additional security.

[erikoy]

Phishing only happens when you are unaware that the attack is happening, I agree that you should use different password but also make sure to sweep your devices because the phishing attacks are mostly trojans.

Yes, usually hacker will attack the user unaware and there are process on how to phished accounts specifically financial related accounts. One must know should know why phishing exist and how it became rampant. Other information about information about phishing is how it will be done(methodology).

Anyone can check my post For your ready reference on phishing and see what are the methods that hacker use to make them successful. Nowadays, we should be knowledgeable so that we can at least avoid being a victim of phishing. I think it is better to expose the phishing activity help other prospect victim of phishing usually those users verified with good financial records publicly or not knowingly it was been exposed to hacker and eventually one will become a target for phishing.

For evaluation purposes, one can check this reply  and learn how hacker make sophisticated fake sites or websites which purpose is to ask you to disclose important details of any of your account may it non-financial or financial aspect that means that one can create a fake site even for bitcointalk.org.

[libert19]

I looked at title and was like, wow this is common sense then realized I was making same mistake as when I was new to the Internet.

[hatshepsut93]

^
1. For remember, don't ticking "Always stay logged in" if using public pc

2. Don't click auto save login and password in browser
3. If you mobile and always have urgent situation, prepare your USB stick and download portable browser.

1. Using public computer is already a good method to lose your accounts, they can easily have installed keyloggers that will steal all accounts.

2. Why not? If it's because of malware, then there's a ton of other ways your account will get stolen if it's in your system. Your credentials won't be autofilled on phishing sites, since they have different domains.

3. Again, don't login into anything on machines that you don't trust. Bringing your own browser won't change anything.

[Findingnemo]

Better learn how to avoid the phishing attacks which might save us from future phishing attempts.Some simple steps can save us from lot of phishing like

1. Avoid installing unknown extensions to your browser

2. Stop using online password manager applications

3. Don't use Gmail.

4. Don't install any applications from the third-party websites ( both for smartphones and PC)

5. Finally don't use simple passwords

[reliable]

I looked at title and was like, wow this is common sense then realized I was making same mistake as when I was new to the Internet.

People learn from their mistake and so experience is what counts. So, users who have gone through and made some mistakes are sharing it and how it could be easily avoided by new users. So, it is important for users to check out such threads and see if they are doing same mistake then start correcting it.

[Shimmiry]

It's probably the laziness of the user to use strong passwords that isn't already used. Most of the time, people tend to just use the password that they already used on other websites for the reason that this is the best way they can remember their passwords. But it is highly not advisable.

As much as possible use different passwords on different websites.

[GreatArkansas]

In terms of using such strong passwords,
this thread may help for creating a strong password that will help us in our different accounts: [GUIDE] How to Create a Strong/Secure Password
I already experienced this kind of scenario before, especially in one of the exchanges I am using before, I really don't have an idea why they were able to log in my account. One of the reasons could be like this (using the same password in different websites), or another one is the insider of the exchange or they have been breached.

[Yaunfitda]

^
1. For remember, don't ticking "Always stay logged in" if using public pc

2. Don't click auto save login and password in browser
3. If you mobile and always have urgent situation, prepare your USB stick and download portable browser.

1. Using public computer is already a good method to lose your accounts, they can easily have installed keyloggers that will steal all accounts.

Or public WIFI for that matter, there are a lot of videos circulating around about this methods. So there are a lot of tricks. So don't believed that public WIFI are safe, until it's too late. You may have strong bitcointalk passwords, but once it is intercepted, then nothing you can do about it.

[AniviaBtc]

Absolutely not.

The thing that I do with my accounts is that, I made a list of those accounts in other platforms that are not that important so that I don't forget them when I try to access them.

But those platforms such as like this, it is very important to make it unique and easy to memorize even in those social media account that is personal. Here in bitcointalk, it is really necessary for you to not to apply the password or username that you use in other social media to prevent hacking or linking of accounts and also for the security of your account.

[samputin]

^
1. For remember, don't ticking "Always stay logged in" if using public pc



2. Don't click auto save login and password in browser
3. If you mobile and always have urgent situation, prepare your USB stick and download portable browser.

Checked on the two things. 

1. I do click "always stay logged in" but in my phone only. I open my bitcointalk account if I have the time and it's hassle if I still have to log in and do captcha every time I visit here. But in other public PCs, it's a no-no for me to tick that. I'll just open my account there for just an hour or less so no need for that. And also for security reasons. Better safe than sorry.
2. I don't auto save my passwords as well. I just keep them on my notepad or notes app. It's hassle sometimes but I got used to it.

Hackers are everywhere especially in this digital age. So we must be very cautious in what we do online and make sure that the security of our accounts is on top priority.

[Peanutswar]

Its the common problem right now of the people not only on our forum because some of them having the same password with all of their accounts some of the reasons are


They want to make it access easily
It's not hard to remember
Just common so they don't need to change from time to time.

For me, I highly recommend to the members use a
Camel Case
Symbol
Number

If you want to you can make your own encryption at the same time you don't need to make it change because this is one of the most secure.

[robelneo]

2. Use different email (not the email you used when registering at BTT) when you follow bounty. Coz usually your email exposed when following bounty.

And activate the 2FA feature on the email for additional security.

I was scrolling and reading on the comments and no one mentioned about securing your email by activating the phone or 2FA but only you this is a must if your email is secured the hacker cannot change your password it will trigger confirmation and notification to the email the user is using,
on Gmail there are three ways to secure your email, these are phone verification, 2FA, and code verification, you should apply anyone to all your emails.