[Guide] Use Bitcointalk (more) privately

[n0nce]

Motivated by recent events ^[1-2], I decided to compile a list of sensible advice that forum users can take to improve their privacy. More suggestions are of course welcome!

To be clear: Bitcointalk is a centralized forum, whose operator(s) may or may not ^[3] have to hand out IP addresses and other personally identifiable information in the worst case. Full IP addresses and geolocation data retained for months or even years. Your posts are ^[4-6] archived basically forever.

• Do not post privately identifiable information about yourself.
• Do not post information that ties your Bitcointalk identity to other online identities.
• Use a dedicated Email address for your Bitcointalk account.
• Opt into limited IP retention.
  
• Use Tor Browser to access Bitcointalk.
  
• Bookmark your personal Captcha Bypass URL to avoid JavaScript and connection to Google (as well as the hassle of solving those).
  
• Stake your Bitcoin address for account recovery (since IP-based won't work now).
  
• Ironically: mix, tumble, CoinJoin or submarine-swap your campaign funds to a Lightning wallet. Anything that improves your on-chain privacy.

I am aware that Tor is not perfect and not entirely untraceable and that better privacy measures do exist, but these should provide you with relatively good privacy at little 'extra cost'. Especially with that captcha code, and the lightweight nature of the forum without lots of fancy, big graphics, it is extremely usable through Tor.


Tor Browser exists for Windows, MacOS, Linux, but also Android!
https://www.torproject.org/download/#android

For iOS, 'Onion Browser' exists and is recommended by the Tor Project:
https://onionbrowser.com/

[1] https://bitcointalk.org/index.php?topic=1935179.msg61920144#msg61920144
[2] https://bitcointalk.org/index.php?topic=1935098.msg61916953#msg61916953
[3] https://bitcointalk.org/privacy.php
[4] https://ninjastic.space/search
[5] https://loyce.club/archive/posts/
[6] https://archive.today

[LoyceV]

Well, too late And that's the thing with privacy: once it's gone, you can't get it back.

When I started with Bitcoin, I was bright enough to use a random generator to create a username. But I now realize that isn't enough, and I never expected to use it this long. By now I've also used it on other sites. I can't take that back without giving up everything I've done in the past 8 years, and being a Newbie again. So having a reputation doesn't go with having privacy.

[Findingnemo]

Avoid using your real name as username because some members used to register with their own name and few of them managed to get them changed by requesting theymos but in future it should be avoided.

I used Tor for accessing bitcointalk but even though the forum UI is simple which still feels lags while clicking thread or posting so I am mostly using it on chromium but only in my personal devices and I never logged in from any other devices and also I am using always logged in feature so captcha doesn't bother me much.

Privacy is not my ultimate priority but who really needs should practice all the points mentioned by OP to achieve it.

[n0nce]

Well, too late And that's the thing with privacy: once it's gone, you can't get it back.

Not sure; for some people and some privacy goals, it may be 'too late' to follow this advice, others are doing at least some of the steps outlined here, already.

While the second statement is true, it is important to note that data 'ages'. What I mean by that: your primary email address may change, your physical location may change, the list goes on. A record of your personal information from 2019 may be mostly worthless today. The information may all be wrong by now.

Privacy is not my ultimate priority but who really needs should practice all the points mentioned by OP to achieve it.

I noticed that you are advertising for Roobet; a mostly unregulated crypto casino registered in Curacao. It may be desirable for your real identity not to be linked to Roobet, due to obvious reasons.

TOR is terribly inconvenient, I'd rather continue to use Opera. Most users do not need it at all, as well as its use

I disagree; you should try it out. In my experience, websites did load pretty slowly a few years back. But nowadays, it has gotten a lot better, especially if the website doesn't need JavaScript and doesn't use lots of graphics (like Bitcointalk).

this option is more suitable for those who are completely turned on privacy or those who have something to hide.

Everyone has something to hide. For example their affiliation with crypto casinos. Others earn money online without declaring it to the taxman. And even others post their opinions freely on here, meanwhile those opinions aren't legal to post in the country they're living in. Lots of reasons, scenarios and risk profiles. In general, you probably want to better be safe than sorry.

There is a strong opinion that privacy is a myth, and if really want to, will still find you.

I'm not arguing that my recommendations fully protect you if you are a highly sought-after criminal, but it's a 'bare minimum' that can go a long way.

I don't understand how this relates to privacy. How does this relate to my privacy? It's more of a security issue.

If you hide your IP and use the privacy measures mentioned, you cannot restore your password by e.g. sending a message from the IP you last logged in with. I think that's what the warning in the Bitcointalk account settings hints at, so I wanted to present an alternative in case that ever happens to someone.

[LoyceV]

or those who have something to hide.

Everyone has something to hide.

I don't understand how this relates to privacy. How does this relate to my privacy? It's more of a security issue.

Your IP-address can be used for account recovery purposes. If it's no longer stored, you'll need an alternative.

[n0nce]

~

You can argue that using your default web browser is more convenient, I'm not denying that. This is not a topic about the most convenient way to access Bitcointalk or a place to discuss the convenience of Tor browser..

Everyone has something to hide.

Apparently I have nothing, since I use Opera.

It is good for you that all opinions you express and all actions you do online are now and forever will be legal, but that is a relatively rare and risky assumption.

[digaran]

Ok, let me get this straight, you guys are unhappy that a criminal was busted and you lost your few bucks of an income and now are trying to help future criminals on how to stay under the radar?
I mean who gives a fack about your identity if you are not Satoshi or a criminal/ financial terrorist/ scammer?
You know what got to me? Saying ""motivated by recent events" and a straight forward list of guidance to stay anonymous in order to conduct criminal activity and pay a few bucks to a few shills so that they could defend your nefarious shenanigans for years"".
And the fact that someone else posted: "well too late   "
A sad fucking emoji, really? I guess we should keep our identities safe from criminals like you guys, because your behaviour is more scary than of that of black op unit members. What is wrong with you?

[digaran]

only lightning, only mixers, only a new address on every transaction. Such sweet self-care bordering on paranoia.

Well since using lightning contradicts with privacy advices mentioned, means an obvious shill. Mixing as mentioned in OP, is good to hide campaign earnings, as advised in OP, but using change addresses is absolutely a brilliant financial security advice, don't mix them with other things, some people might be blinded by greed but they are not stupid.

[Charles-Tim]

@Ratimov
Privacy is a matter of choice. You can be private in some areas and not private in some areas. It all depends on how you want it. You may as well not want to be private.

I work more on my mobile device on this forum, I tested the Tor browser, it loads this forum fast (I may update the desktop version to test it too). But one of the reasons I prefer my browser is because it does not log me out, it keeps the tabs I have opened before intact and also the dark mode. I like the dark mode at night.

But if privacy is advised on this forum, I think it is a good thing.

Ways to privacy is not easy, but people that are very rich in bitcoin or other crypto should be concerned about privacy. Nobody can be 100% private, but they may prefer to have privacy in one area or the other.

[Synchronice]

Your IP-address can be used for account recovery purposes. If it's no longer stored, you'll need an alternative.

I don't get it, why should you lost your account? Set a difficult password, write down, type a lot of times, a lot of times that will definitely imprint it into your muscle memory and then you'll write it down with your eyes closed.

I don't get it why it's so hard for people to memorize things, I don't think I am the only exception who can memorize things easily. I have a lot of different passwords, strong ones with a combination of random characters, uppercases, numbers and special characters. I memorize them, type them regularly very frequently and then I know it so well that I can type it very quickly with my eyes closed.
But it's okay, if people can't remember their passwords, then they shouldn't follow my advice. But they should find safer ways, i.e. write it down and save in a safe place without underlying the website this password belongs to, I wouldn't even mention that it's a password and shouldn't focus on recovery options if they want to be more anonymous.

• Stake your Bitcoin address for account recovery (since IP-based won't work now).
  

Doesn't that break rule number one?

• Use Tor Browser to access Bitcointalk.
  

Tor without VPN is a bad idea, you should hide your Tor activity from your ISP. It's always good idea to use Qubes OS, a Linux distribution instead of Windows and combine it with good VPN and Tor. I'll use this moment and share a List of VPN Service Providers - 2023

[_BlackStar]

• Do not post privately identifiable information about yourself.
• Do not post information that ties your Bitcointalk identity to other online identities.
• Use a dedicated Email address for your Bitcointalk account.
• Opt into limited IP retention.
  
• Use Tor Browser to access Bitcointalk.
  
• Bookmark your personal Captcha Bypass URL to avoid JavaScript and connection to Google (as well as the hassle of solving those).
  
• Stake your Bitcoin address for account recovery (since IP-based won't work now).
  
• Ironically: mix, tumble, CoinJoin or submarine-swap your campaign funds to a Lightning wallet. Anything that improves your on-chain privacy.

Thanks for your advice, I think I've put most of your points into practice so far.
While this may seem too late for someone, it's always good reminder that privacy is important. Many people may forget that posting something detrimental to their privacy in forum is basically detrimental to them. So I think it's wise to consider not posting things that you might not want to keep forever on the internet wisely even if they don't seem that serious today.

Online wallet, one email for all services, one password for all services - this is the harsh reality of most crypto users.

You might be able to exclude some user who very care about privacy, but not about most crypto users in general.

[dzungmobile]

Newbies may not know, Tor is available for Android too.  

Download its Android version https://www.torproject.org/download/#android
Reference
Retention /Privacy info

Delete your PMs and backup them by your own
https://bitcointalk.org/index.php?topic=5284282.msg55447742#msg55447742

They're "personal messages", not "private messages".

[LoyceV]

I tested the Tor browser, it loads this forum fast (I may update the desktop version to test it too). But one of the reasons I prefer my browser is because it does not log me out, it keeps the tabs I have opened before intact

Tor browser can do that too, but it ticks "Always use private browsing mode" by default.

I don't get it, why should you lost your account? Set a difficult password, write down, type a lot of times, a lot of times that will definitely imprint it into your muscle memory and then you'll write it down with your eyes closed.

I'm not losing my account, but many people do. And when it happens, for instance because someone gains access and changes the password, it's good to have a recovery option. That's one of the reasons I staked an address.
Note that "recovery options" are often a risk factor on their own. If a service uses SMS for recovery, gaining access to your phone is enough to gain access to that service. That's why I prefer not to enable recovery options, although a signed Bitcoin message is safe enough for me. If anyone gets access to my wallet, they have access to my forum account already.

I have a lot of different passwords, strong ones with a combination of random characters, uppercases, numbers and special characters. I memorize them, type them regularly very frequently

I only remember a few passwords, but I use hundreds of different ones. Most of them look like "(f#L!{p[oKGzz[2aV$'[P6!n$", and I'm not even going to try to remember them.

• Stake your Bitcoin address for account recovery (since IP-based won't work now).

Doesn't that break rule number one?

Stake an unused address.

[Husires]

The forum is not only central, but:

Bitcointalk.org is in US jurisdiction, and is subject to US subpoenas, wiretap orders, preservation orders (which would negate the above retention rules), and similar. Furthermore, our service providers could also be subject to similar orders without our knowledge. Note that we consider PMs to require a warrant in order to be released.

You can read more in the privacy page https://bitcointalk.org/privacy.php

In short, all the data that you share here, I assume that everyone knows it, because the IP addresses, your private messages, etc. can all be reviewed by the administrators.
Using a centralized platform wallet, social media accounts, keeping cookies, javascript enable etc. are all things that help identify you.

[n0nce]

You know what got to me? Saying ""motivated by recent events" and a straight forward list of guidance to stay anonymous in order to conduct criminal activity ^{[emphasis mine]} and pay a few bucks to a few shills so that they could defend your nefarious shenanigans for years"".
And the fact that someone else posted: "well too late   "
A sad fucking emoji, really? I guess we should keep our identities safe from criminals like you guys, because your behaviour is more scary than of that of black op unit members. What is wrong with you?

You must be really biased, otherwise I see no way how you can misinterpret my reference to recent events and the topic as a whole so badly.

It's also sad to see forum members buy into this 'privacy = criminal' misinformation campaign. Privacy should be a fundamental human right for everyone. It has nothing to do with criminal activity.. sigh. Next time you are going to tell me Bitcoin is only for criminals, because it is pseudonymous? We should tie our real identities to our Bitcoin address if we have nothing to hide? Why do you use new addresses for different payments, are you a criminal?

The Privacy Culture Manifesto

should generally forget about everything that is convenient:
~snip~

This is a common fallacy. Limiting the amount of data you leak to the world is always good for your privacy; there is no black-or-white, no 'private' and 'unprivate'. The more you share, the lower your privacy; it is a gradient, a spectrum.

I don't get it, why should you lost your account? Set a difficult password, write down, type a lot of times, a lot of times that will definitely imprint it into your muscle memory and then you'll write it down with your eyes closed.

Ask the millions of people resetting passwords every day.. This is also off-topic. Of course you don't need account recovery if you properly stored your password, I know. But things can go south (house burnt down, password manager hacked, whatever) and you may still have access to your Bitcoin keys. The staked address is just one extra layer of security.

• Stake your Bitcoin address for account recovery (since IP-based won't work now).
  

Doesn't that break rule number one?

Obviously don't use an address tied to your identity. You do know you can create 'sub-wallets' under a certain seed by using derivation paths and passphrases, for instance.

• Use Tor Browser to access Bitcointalk.
  

Tor without VPN is a bad idea, you should hide your Tor activity from your ISP. It's always good idea to use Qubes OS, a Linux distribution instead of Windows and combine it with good VPN and Tor. I'll use this moment and share a List of VPN Service Providers - 2023

A VPN is a central point of failure potential spying, so that's why I do not blanketly recommend  using VPNs. They have their use cases, but may not be a good idea for everyone.

Newbies may not know, Tor is available for Android too. 

Download its Android version https://www.torproject.org/download/#android
Reference
Retention /Privacy info

Delete your PMs and backup them by your own
https://bitcointalk.org/index.php?topic=5284282.msg55447742#msg55447742

They're "personal messages", not "private messages".

Thanks, adding this to OP!

I have a lot of different passwords, strong ones with a combination of random characters, uppercases, numbers and special characters. I memorize them, type them regularly very frequently

I only remember a few passwords, but I use hundreds of different ones. Most of them look like "(f#L!{p[oKGzz[2aV$'[P6!n$", and I'm not even going to try to remember them.

I agree with Loyce. You should have a different password for each account and they should look like that (no regular words, no dates etc.), absolutely. As people tend to have dozens to hundreds of accounts, if you can memorize all of your passwords, they are either:

• Not distinct enough (i.e. not a fresh one per account)
• Not independent enough (e.g. you have a 'master password' with numbers at the end or something like that)
• Not random enough (e.g. you use real words)

[LoyceV]

As people tend to have dozens to hundreds of accounts, if you can memorize all of your passwords, they are either:

• Not distinct enough (i.e. not a fresh one per account)
• Not independent enough (e.g. you have a 'master password' with numbers at the end or something like that)
• Not random enough (e.g. you use real words)

Another common mistake is using a few different passwords, and not remembering which one is used where. So when trying to get access, those people try all passwords they know  until one of them works, without realizing they've just compromised them all.

[dzungmobile]

Forgot about Orbot that is useful if you need Tor for other things than only web browsing.

https://support.torproject.org/tormobile/

Do I need both Tor Browser for Android and Orbot, or only one?

While both Tor Browser for Android and Orbot are great, they serve different purposes.

• Tor Browser for Android is like the desktop Tor Browser, but on your mobile device. It is a one stop browser that uses the Tor network and tries to be as anonymous as possible.
  
• Orbot on the other hand is a proxy that will enable you to send the data from your other applications (E-Mail clients, instant messaging apps, etc.) through the Tor network; a version of Orbot is also inside of the Tor Browser for Android, and is what enables it to connect to the Tor network. That version, however, does not enable you to send other apps outside of the Tor Browser for Android through it.

Depending on how you want to use the Tor network, either one or both of these could be a great option.

Another common mistake is using a few different passwords, and not remembering which one is used where. So when trying to get access, those people try all passwords they know  until one of them works, without realizing they've just compromised them all.

They can use password generator to have unique, fresh passwords and must be aware how weak their previous passwords are.
[GUIDE] How to Create a Strong/Secure Password
Are Your Passwords in the Green?

Dumb question

Anyone know who to use two features on mobile
New identity: Ctrl+Shift+U
New Tor circuit for this site: Ctrl+Shift_L
The second one is important because when you use Tor, sometimes it sucks and if you close it, you lose your post content.

[Synchronice]

I'm not losing my account, but many people do. And when it happens, for instance because someone gains access and changes the password, it's good to have a recovery option. That's one of the reasons I staked an address.
Note that "recovery options" are often a risk factor on their own. If a service uses SMS for recovery, gaining access to your phone is enough to gain access to that service. That's why I prefer not to enable recovery options, although a signed Bitcoin message is safe enough for me. If anyone gets access to my wallet, they have access to my forum account already.

I know that many people do lose their accounts but here we talk about improved security.
If a service uses SMS for recovery, that means that you have to leak your mobile number. Yeah, it doesn't need to be actually your phone number but I would avoid it. And I don't understand how can someone gain access to your phone that way? What does SMS recovery option has to do with your phone access?

If you use bitcoin address without transactions just for signing a message, okay but if you use it for transactions, I don't think your info is safe.

I have a lot of different passwords, strong ones with a combination of random characters, uppercases, numbers and special characters. I memorize them, type them regularly very frequently

I only remember a few passwords, but I use hundreds of different ones. Most of them look like "(f#L!{p[oKGzz[2aV$'[P6!n$", and I'm not even going to try to remember them.

That's the type of password everyone should be using. It's your choice if you try to remember them or not but believe me, if you try, that's not difficult to remember. Type that hard password frequently for months, for a year and then you'll realize that you have memorized it so well that you can type it with your eyes closed.

• Use Tor Browser to access Bitcointalk.
  

Tor without VPN is a bad idea, you should hide your Tor activity from your ISP. It's always good idea to use Qubes OS, a Linux distribution instead of Windows and combine it with good VPN and Tor. I'll use this moment and share a List of VPN Service Providers - 2023

A VPN is a central point of failure potential spying, so that's why I do not blanketly recommend  using VPNs. They have their use cases, but may not be a good idea for everyone.

Is it better idea to show your ISP that you are using Tor? Don't you think it's alarming? You may use tor just for your privacy but a lot of people use it for illegal activities, your ISP doesn't care what your actual purpose is, your are under their radar.

[The Sceptical Chymist]

I'm nearly almost relatively 86.72% convinced that if law enforcement needed to track down a member of bitcointalk, they wouldn't need a trail of pizza-sized breadcrumbs to do it (except for Satoshi, apparently).  Nor does Chipmixer even stand out in my mind as anything special in terms of crypto debacles aside from the fact that I and many others didn't know what was *apparently* happening, or what would happen.

Part of me thinks this has become such a big deal on the forum because their signature campaign was extremely selective and had a lot of not only excellent posters but trusted members as well, and they like to see them get a sort-of comeuppance.  Like Schadenfreude, you know?

Or maybe that's me just being my misanthropic self again.  Nasty mindset to get out of, let me tell you.

[paid2]

If we wanted to go all the way, we would also have to delete the metadatas included in the photos of the narketplace's ads posted, not use an address that has been in contact with a CEX for a signature campaign (and I imagine that this is quite often the case).

In absolute terms, you should not buy or sell anything on the forum in order to protect your privacy. You don't know who you are sending your address to.

In my opinion, being careful on the forum is not especially necessary (even if I actively support the principle you defend in this post), because I am sure that a lot of members can be already linked to a deposit/withdrawal made from a CEX via an address they posted here. Even with all the effort, the CEX will cooperate with law enforcement if necessary, and the efforts to protect themselves here will have been for nothing.