Cybersecurity subforum

[takuma sato]

Would it be a good idea to have cybersecurity subforum? It is a topic that goes hand in hand with bitcoin. Without a good setup hosting your private keys is useless, you might as well have them on an exchange than host them on some Windows machine.

For instance I wanted to talk about bios tampering to see if anyone here is using Heads: https://osresearch.net/

This I think is a key factor that no one is talking about. Checking the integrity of the bios, not only corebooting it. This way you could avoid man in the middle attacks that would go unnoticed.

I wasn't sure in which subforum to post this. It is too niche to get any serious replies outside of development subforum but I think that's off-topic. In a dedicated subforum we could share different techniques to improve the setup.

[1714217283]

1714217283

[1714217283]

1714217283

[1714217283]

1714217283

[mk4]

Idunno, since the cybersecurity part of Bitcoin is mostly concerning wallets, the Wallet software section might be the best for it. Or probably even just the Bitcoin Discussion is enough for that. The security subtopic doesn't have THAT much demand to have it's own subforum imo; but I'm not really against it.

[hugeblack]

Regardless of the nature of the board and its importance, unless there are enough topics and discussions about it, a new board will not be created.

In other words, if there are not many topics in the main menu, and there are many discussions about them, a subforum/board dedicated to them will not be created.

Let's take the Lightning Network as an actual example, although there are many topics and many discussions about them, no dedicated subforum/board has been created for them. Therefore, general terms such as "cybersecurity" will be impossible to create a dedicated board for it.

[BlackHatCoiner]

It is too niche to get any serious replies outside of development subforum but I think that's off-topic.

From my experience, if you share good content in the Development & Technical board, your chances of having your post removed are inconsiderable, even if it isn't that on-topic. Don't hesitate to share your thoughts about something that you consider important.

This forum is known for hugging high quality posting.

[Pmalek]

I wouldn't mind if such a sub-board got created, but at the same time, I don't think it will. It's desirable to have decent security practices and know how to keep your computer, phone, or wallet safe. But if such a sub was introduced right now, can someone name or recommend 10 threads to be moved there without having to do quite a lot of searching for threads on the forum?

[uchegod-21]

In other words, if there are not many topics in the main menu, and there are many discussions about them, a subforum/board dedicated to them will not be created.

Let's take the Lightning Network as an actual example, although there are many topics and many discussions about them, no dedicated subforum/board has been created for them. Therefore, general terms such as "cybersecurity" will be impossible to create a dedicated board for it.

You are very correct about this. When the hype of NFT was high months ago and the demand was coming in but the board was not created. That was when I knew that the admins are not interested in creating boards or childboards that will not last or people will run out of discussion within a short time.
The Lightening network was a surprise to me when I search the forum but I didn't see any board for it. But in Development Board is saw _Rath always discussing it. I believe one of the reason why it has not gotten a childboard is that I always see a high user countering everything about Lightening network. His name is franky1. Not that he does not have nice points, he has many good points and I always read them. If childboard is created for LN, there can be home for arguments only and the purpose of the board will not be achieve.

[o_e_l_e_o]

It's been discussed many times before, but it has gone ignored by the admins. I think it's a good idea as there are plenty of topics which deal with general online security and privacy which get lost in various boards, or even worse, moved to Off Topic where they immediately die. The logical place for topics like these would be Off Topic, if Off Topic was actually moderated as advertised ("Other topics that might be of interest to bitcoiners"), rather than just being "Literally any old shit".

Therefore, general terms such as "cybersecurity" will be impossible to create a dedicated board for it.

I disagree. Here is a post I made the last time such an idea was brought up: https://bitcointalk.org/index.php?topic=5230782.msg53974580#msg53974580. I found 14 threads just from the front page of two boards which would belong in such a new board.

Looking at the front page of various boards now, I can see the same again, with threads on passcode lengths and online privacy at the top of Beginners and Help and threads on Firefox and KYC in Off Topic.

[DaveF]

I would support this.
Sometimes it's just nice to have a location for little tidbits of information to be posted in one central location that may or may not be impotant to some people. But will get buried in some other locations due to the number of other topics.
As an example I posted this over a year ago: https://bitcointalk.org/index.php?topic=5282613
There are also a few other firewalls / brands that have vulnerabilities might be nice to have a forum to discuss things like that.

Even if it's just to discuss things like the log4j vulnerability and if it will cause any issues for crypto clients / apps.

-Dave

[Toughit]

I wouldn't mind if such a sub-board got created, but at the same time, I don't think it will. It's desirable to have decent security practices and know how to keep your computer, phone, or wallet safe. But if such a sub was introduced right now, can someone name or recommend 10 threads to be moved there without having to do quite a lot of searching for threads on the forum?

I think it's a great idea.

I found 7 with a short search that I would include, and the last one lists about 30 67....

There are a lot in Beginners and Help, but good links in many other subforums.


2fa in Other/ Beginners and Help - https://bitcointalk.org/index.php?topic=5041789.0

Yubikey in Other/ Beginners and Help https://bitcointalk.org/index.php?topic=1353231.0

Keyword storage in Wallet software by N0nce https://bitcointalk.org/index.php?topic=5363596.0

Wallet Security in hardware wallets https://bitcointalk.org/index.php?topic=3176978.40

Malwarebytes (needs discussion) in Digital Goods https://bitcointalk.org/index.php?topic=5281484.0

Spam in Reputation https://bitcointalk.org/index.php?topic=5281484.0

Security in Beginners and Help https://bitcointalk.org/index.php?topic=5239098.0

[dkbit98]

Would it be a good idea to have cybersecurity subforum? It is a topic that goes hand in hand with bitcoin.

I don't remember last time when moderators added some new child boards in forum, and I have been saying for some time that we should have some changes.
Adding cybersecurity board could be added but only if related with Bitcoin, otherwise it would probably go to off-topic section.
Lightning Network board could also be interesting, with some different opinions, but Theymos might not be in the mood for adding anything new things in forum, but I could be wrong about that

For instance I wanted to talk about bios tampering to see if anyone here is using Heads: https://osresearch.net/

I don't use Heads, and messing around with bios is not advisable for most people.
Even regular update of bios is not recommend to everyone, and should be done only if you need to fix some issue with your computer or enable new functionality.

[takuma sato]

Would it be a good idea to have cybersecurity subforum? It is a topic that goes hand in hand with bitcoin.

I don't remember last time when moderators added some new child boards in forum, and I have been saying for some time that we should have some changes.
Adding cybersecurity board could be added but only if related with Bitcoin, otherwise it would probably go to off-topic section.
Lightning Network board could also be interesting, with some different opinions, but Theymos might not be in the mood for adding anything new things in forum, but I could be wrong about that

For instance I wanted to talk about bios tampering to see if anyone here is using Heads: https://osresearch.net/

I don't use Heads, and messing around with bios is not advisable for most people.
Even regular update of bios is not recommend to everyone, and should be done only if you need to fix some issue with your computer or enable new functionality.

All standard bios contain proprietary blobs. If you are not using Coreboot, chances are your CPU has Intel ME enabled, which has it's own proprietary OS in it with pretty much full access to your computer at pre-boot times. Anyone that is serious about Bitcoin should be using Coreboot or Libreboot. Most people don't use Bitcoin tho, if you aren't running your own full node you aren't using Bitcoin as far as I can tell. So it all begins with a good defense at the bios level, then you build a decent Linux setup, then install Bitcoin full node client you can trust. Most people aren't even aware of Intel ME and PSP for AMD exist so without addressing that most Bitcoin nodes are potentially compromised by default.

[Quickseller]

Idunno, since the cybersecurity part of Bitcoin is mostly concerning wallets, the Wallet software section might be the best for it. Or probably even just the Bitcoin Discussion is enough for that. The security subtopic doesn't have THAT much demand to have it's own subforum imo; but I'm not really against it.

There are three potential security concerns regarding bitcoin:
1 - keeping your private keys private
2 - ensuring your full node continues to act in ways as intended
3 - ensuring your miners mine at the pools as intended
There is also a potential fourth regarding clipboard, and display malware.

Issues regarding 1 belongs in the wallets sub, 2 belongs in dev and tech, and 3 belongs in the mining sub.

I don't think there is a high enough volume of these types of threads to warrant a new sub.

[o_e_l_e_o]

There are three potential security concerns regarding bitcoin

Maybe that would be the case if everyone ran their own full node.

We see plenty of threads regarding things like Tor or good browser practices or extensions, best OSs to uses, PGP, encryption, password managers, best 2FA practices, phishing ads and attempts, different types of malware, critical vulnerabilities in various commonly used software, punycode attacks, KYC safety, VPNs and VPSs, and so on. All of these are very relevant to using bitcoin securely and privately, and do not fit nicely in to any other board. They often end up in Beginners and Help despite being relevant for all users, or worse they are moved to Off Topic and seen by nobody except spammers.

There are certainly far more topics which would fit in to such a board than are posted in some already existing boards.

[dkbit98]

All standard bios contain proprietary blobs. If you are not using Coreboot, chances are your CPU has Intel ME enabled, which has it's own proprietary OS in it with pretty much full access to your computer at pre-boot times. Anyone that is serious about Bitcoin should be using Coreboot or Libreboot. Most people don't use Bitcoin tho, if you aren't running your own full node you aren't using Bitcoin as far as I can tell. So it all begins with a good defense at the bios level, then you build a decent Linux setup, then install Bitcoin full node client you can trust. Most people aren't even aware of Intel ME and PSP for AMD exist so without addressing that most Bitcoin nodes are potentially compromised by default.

Sure, but you can always lock your bios with a strong password and you can disable in settings anything that you don't want to have.
Don't get me wrong, I updated my bios many times and I never used corebot or libreboot so far, but maybe I will give it a try to see how it works on older computer.
In addition to this you can always enable encryption during installation of any Linux OS, that makes is much more secure than any windows os will ever be,
and you can always go next level with Tails, Whonix or Cubes os, but that is not recommend for majority of people.
I don't see how Bitcoin nodes or any bitcoin related software can be affected with having bios password, plus encryption on OS level, plus strong password for your account.

[tranthidung]

Regardless of the nature of the board and its importance, unless there are enough topics and discussions about it, a new board will not be created.

In other words, if there are not many topics in the main menu, and there are many discussions about them, a subforum/board dedicated to them will not be created.

• Good topics on security and privacy
• Disable auto-downloading in Telegram to avoid malware. I remember that someone in the forum made a topic about this one (I can not find that topic for now). I bring this security issue because it is a good example that in this forum, we have very active members to warn communities about that.

[takuma sato]

All standard bios contain proprietary blobs. If you are not using Coreboot, chances are your CPU has Intel ME enabled, which has it's own proprietary OS in it with pretty much full access to your computer at pre-boot times. Anyone that is serious about Bitcoin should be using Coreboot or Libreboot. Most people don't use Bitcoin tho, if you aren't running your own full node you aren't using Bitcoin as far as I can tell. So it all begins with a good defense at the bios level, then you build a decent Linux setup, then install Bitcoin full node client you can trust. Most people aren't even aware of Intel ME and PSP for AMD exist so without addressing that most Bitcoin nodes are potentially compromised by default.

Sure, but you can always lock your bios with a strong password and you can disable in settings anything that you don't want to have.
Don't get me wrong, I updated my bios many times and I never used corebot or libreboot so far, but maybe I will give it a try to see how it works on older computer.
In addition to this you can always enable encryption during installation of any Linux OS, that makes is much more secure than any windows os will ever be,
and you can always go next level with Tails, Whonix or Cubes os, but that is not recommend for majority of people.
I don't see how Bitcoin nodes or any bitcoin related software can be affected with having bios password, plus encryption on OS level, plus strong password for your account.

You can't disable Intel ME etc in the bios settings, that's the whole point. It runs no matter what you do, except if you flash your bios with Coreboot, which 99% of people will not do because it doesn't work in most modern computers, and it requires you to do some hardware modifications, it's not just flashing a rom file.

A reason why an attacker would want big blocks on the network, besides reducing number of nodes due higher space needed, would be to take advantage of built-in exploits at the hardware level. Once 100% of the network is running on hardware that can be controlled remotely or modified in some way you have a killswitch. I haven't seen this angle discussed. Basically most of the network outside of Raspberry Pi and flashed bios' without Intel ME and PSP is potentially backdoored.

[dkbit98]

You can't disable Intel ME etc in the bios settings, that's the whole point. It runs no matter what you do, except if you flash your bios with Coreboot, which 99% of people will not do because it doesn't work in most modern computers, and it requires you to do some hardware modifications, it's not just flashing a rom file.

Is there any list of supported hardware for Coreboot or Libreboot?
I know there are some premade stuff that work on Thinkpads but it could be issue to run this bios on custom made desktop computers.

A reason why an attacker would want big blocks on the network, besides reducing number of nodes due higher space needed, would be to take advantage of built-in exploits at the hardware level. Once 100% of the network is running on hardware that can be controlled remotely or modified in some way you have a killswitch. I haven't seen this angle discussed. Basically most of the network outside of Raspberry Pi and flashed bios' without Intel ME and PSP is potentially backdoored.

This is possible in theory, but more simple way of introducing a global kill switch would be to just turn of the internet, like we can see it's happening in some countries during riots.
Internet is centrally controlled and controllers don't have to worry about people like you who run custom bios on computers.
If they really want to hurt Bitcoin (and everything else) this is what they would do because it's more simple.

[kaggie]

Privacy and security would be nice, even if a sub-sub-forum. One of the largest drawbacks to bitcoin is that your regular person is at risk to losing their life savings by storing their information on their computer that may have a hole/leak in it. It's a separate topic of relevance. It would be better to have it in one location to point people to.

[n0nce]

I'm in! Totally agreed: we often talk about aspects of 'cybersecurity' / IT security, throughout various boards, and it would be preferable to have a central place to find all those threads.
I think it would need to be outside the Bitcoin board, since it could include topics such as general OS-level security practices, network setups and firewalls, but also lots of privacy-oriented topics such as decentralized YouTube alternatives (there was a tiny spark of interest in the community after some Bitcoin content was deleted off YouTube) and similar.

[Zilon]

A cybersecurity board is really necessary because as important as Blockchain and Bitcoin is to the society today it's private key security should also be a necessity because there is no need for an innovation if it's prone to attack. As the technological aspect is fully represented there should also be need for it's security board to help discuss the preventive measures to secure private keys and for the safety of our coins. I think cyber security alongside ethical hacking could be merged