[Guide] Use Bitcointalk (more) privately

[LoyceV]

In absolute terms, you should not buy or sell anything on the forum in order to protect your privacy. You don't know who you are sending your address to.

For exactly this reason, I've refused physical prizes that I was offered, and never bought collectibles. It's unfortunate, but each time a "Trusted member" turns out to be a scammer I'm very happy I kept this part of my privacy.

I am sure that a lot of members can be already linked to a deposit/withdrawal made from a CEX via an address they posted here. Even with all the effort, the CEX will cooperate with law enforcement if necessary, and the efforts to protect themselves here will have been for nothing.

It depends on who you're hiding from. I'm not hiding from taxes, and I'm not hiding from law enforcement. But if you are, you should indeed not use any centralized service that requires your real data.

[joker_josue]

When I started with Bitcoin, I was bright enough to use a random generator to create a username. But I now realize that isnt' enough, and I never expected to use it this long. By now I've also used it on other sites. I can't take that back without giving up everything I've done in the past 8 years, and being a Newbie again. So having a reputation doesn't go with having privacy.

I think this was one of the best sentences I've read about privacy!
Sometimes people focus a lot on privacy today, but forget what they did 10 years ago, which ends up destroying that supposed privacy.

I'm in a similar situation with you. Therefore, today I only take the measures that I think are necessary for privacy, for the level of privacy that I still manage to maintain. For the rest, I just have to be attentive and take the necessary care not to fall into schemes that could harm me.

As people tend to have dozens to hundreds of accounts, if you can memorize all of your passwords, they are either:

• Not distinct enough (i.e. not a fresh one per account)
• Not independent enough (e.g. you have a 'master password' with numbers at the end or something like that)
• Not random enough (e.g. you use real words)

I may disagree with some of the points mentioned, but I think the use of real words, depending on how they are used, is a not bad model.
A machine finds random letters faster than real words. Logically it cannot be just a word or two. But, a sentence, with three or four words, can be very difficult to crack as a password.

In reality it all depends on how you build your password.
Random letters and numbers can be as easy to break as a few words together.

The suggestion I always give is to build passwords that you can memorize, but at the same time are complex.

"Waterwithsaltandsugar!1" it could be someone's password, which will be very difficult to be cracked.
Well... now it's not... it's better that no one uses it.  

[Findingnemo]

Privacy is not my ultimate priority but who really needs should practice all the points mentioned by OP to achieve it.

I noticed that you are advertising for Roobet; a mostly unregulated crypto casino registered in Curacao. It may be desirable for your real identity not to be linked to Roobet, due to obvious reasons.

I understand the risk of providing KYC documents to centralized platforms but it's somehow unavoidable at all circumstances for instance I used to trade a lot so I don't have any other option than doing KYC verification then only I get the higher trading limits, and for casino it's almost become mandatory on every crypto casino so it's you decision whether you want to use their platform or not but I have done KYC on Roobet since I am using their service and also I can't advertise without knowing anything about the platform.

[DainSLane]

As people tend to have dozens to hundreds of accounts, if you can memorize all of your passwords, they are either:
Not distinct enough (i.e. not a fresh one per account)
Not independent enough (e.g. you have a 'master password' with numbers at the end or something like that)
Not random enough (e.g. you use real words)

It is not recommended to memorize all your passwords because they should be unique, complex, and random for better security. Instead, consider using a password manager to securely store and manage your passwords.

[n0nce]

Is it better idea to show your ISP that you are using Tor? Don't you think it's alarming?

Is it less alarming to show your ISP that you are using a VPN?

If we wanted to go all the way, we would also have to delete the metadatas included in the photos of the narketplace's ads posted, not use an address that has been in contact with a CEX for a signature campaign (and I imagine that this is quite often the case).

Yes, I highly recommend doing these things, I consider them standard procedure.

I think the use of real words, depending on how they are used, is a not bad model.
A machine finds random letters faster than real words. Logically it cannot be just a word or two. But, a sentence, with three or four words, can be very difficult to crack as a password.

In reality it all depends on how you build your password.
Random letters and numbers can be as easy to break as a few words together.

The suggestion I always give is to build passwords that you can memorize, but at the same time are complex.

"Waterwithsaltandsugar!1" it could be someone's password, which will be very difficult to be cracked.
Well... now it's not... it's better that no one uses it. 

That is unfortunately completely wrong. Your example password is extremely easy to crack. Password crackers nowadays don't brute-force letter by letter anymore, but are based on wordlists. They also take into consideration that people like to append special characters and numbers to the beginning or the end of the password. Humans are way too predictable to be trusted to generate randomness; this is a scientifically proven fact.

Privacy is not my ultimate priority but who really needs should practice all the points mentioned by OP to achieve it.

I noticed that you are advertising for Roobet; a mostly unregulated crypto casino registered in Curacao. It may be desirable for your real identity not to be linked to Roobet, due to obvious reasons.

I understand the risk of providing KYC documents to centralized platforms but it's somehow unavoidable [...]

I was hinting at reasons privacy may be of interest to you, after all. Especially in relation to your forum profile. It is possible and maybe desirable to e.g. have and use a KYC-ed account on an exchange (although I highly advise against it) and have a completely separate online identity with no ties to that account. It is not too hard to accomplish, as I outlined in the OP.

[dkbit98]

I decided to compile a list of sensible advice that forum users can take to improve their privacy. More suggestions are of course welcome!

I assume that various AI programs are already mass collecting information for anything related with specific IP addresses, names, usernames and style of writing.
Anyone that is using modern smartphone is in much worse situation for privacy and Tor on Android or iOS is not as good as on regular computers, plus there are many other things smartphones record about users (like we saw in recent CM incident).
My main suggestion is to stop using smartphones and switch back to old mobile phones if you care about privacy, but if that is to drastic than use de-googled phone (GrapeheneOS is interesting).

Full IP addresses and geolocation data retained for months or even years. Your posts are ^[4-6] archived basically forever.

This is happening for almost all websites and forums, so it's even worse if someone used same real IP address on multiple websites.
Maybe you can add suggestion for people to use temp emails, or services that allow creation of alias and additional email addresses.
It would be perfect to self host your own email address, as we already saw how Proton mail and other ''private'' services can give all information to authorities.

Ironically: mix, tumble, CoinJoin or submarine-swap your campaign funds to a Lightning wallet. Anything that improves your on-chain privacy.

+ Joinmarket (jamapp.org)
+ Mercury wallet (second layer Bitcoin privacy)
+ Ironically XMR

For exactly this reason, I've refused physical prizes that I was offered, and never bought collectibles. It's unfortunate, but each time a "Trusted member" turns out to be a scammer I'm very happy I kept this part of my privacy.

You could eaisly use secondary accounts for purchasing stuff from forum... and I don't mean LeyoceV Mobile  , but some random newbie account.

[joker_josue]

That is unfortunately completely wrong. Your example password is extremely easy to crack. Password crackers nowadays don't brute-force letter by letter anymore, but are based on wordlists. They also take into consideration that people like to append special characters and numbers to the beginning or the end of the password. Humans are way too predictable to be trusted to generate randomness; this is a scientifically proven fact.

But it's not the special characters that make the difference in this example password. It's the phrase. Systems typically match words, but not phrases.
The system can combine "water" "salt" "sugar". But combining as a phrase "water" "with" "salt" "and" "sugar" is more unlikely.
Of course, this is just an example, and I'm not saying it's invalid, just that it's less likely to happen.

As you said rightly, the systems normally check letter by letter. Therefore, it is more likely to pick up a combination of random letters than a sentence that is understood by a human.

Which do you think is easier for an automatic system to find:
"1McY1aGwc8jvFtA."
or
"My2YearOldCatLikesYoWalk."

Both are equally strong, but the second option is much more difficult to be recognized by an automatic system than the first.

[dzungmobile]

"My2YearOldCatLikesYoWalk."

Both are equally strong, but the second option is much more difficult to be recognized by an automatic system than the first.

The second one looks pseu-do strong but in fact it is not. It is more vulnerable to bruteforce process because you don't know what are bad guys who intend to steal your passwords.

If it is people around you and know you love cat and some other information about your cat, he will put words like "cat" "2" "old" into inputs of brute force and make it becomes more easily to bruteforce your passwords.

If a person has his habit to create password like this, possibly he will have other passwords like
My3YearOldCatLikesYoWalk
My4YearOldCatLikesYoWalk
My2YearOldCatLikesFish

https://www.youtube.com/watch?v=rMtW8vIHHek

[UmerIdrees]

Well, too late And that's the thing with privacy: once it's gone, you can't get it back.

When I started with Bitcoin, I was bright enough to use a random generator to create a username. But I now realize that isnt' enough, and I never expected to use it this long. By now I've also used it on other sites. I can't take that back without giving up everything I've done in the past 8 years, and being a Newbie again. So having a reputation doesn't go with having privacy.

Guess what, i have made a username with my real name. Never thought about the privacy back then when i created this bitcointalk account, but now its too late.

• Opt into limited IP retention.
  

Generally, the IPs are logged for last 30 days. So if we opt for this limited IP retention, won't they be logged at all ?

• Ironically: mix, tumble, CoinJoin or submarine-swap your campaign funds to a Lightning wallet. Anything that improves your on-chain privacy.

It will be great if anyone can tell the procedure of doing this with a lighting wallet. A step by step procedure or guide may be really helpful along with links to site / wallets etc. Usually how much fee is involved in this process ?

[joker_josue]

If it is people around you and know you love cat and some other information about your cat, he will put words like "cat" "2" "old" into inputs of brute force and make it becomes more easily to bruteforce your passwords.

The phrase indicated was just an example, I do not recommend that it be used, much less that it be so logical.

The point I wanted to emphasize is that for a hacker who steals hundreds of passwords, he will use automatic systems that will try to match the victim's password letter by letter. The probability of him hitting random letters is greater than a sentence.

I am not recommending this or any other type of password here. Just to point out that both types of passwords can be safe if used correctly.

Perhaps a mix of the two options could be something interesting to explore.

[LoyceV]

I think the use of real words, depending on how they are used, is a not bad model.
A machine finds random letters faster than real words.

It depends: if you're comparing one random character to a word, the word is harder to find. But if you compare 4 random characters to a 4-letter word, the word is easier to brute-force (by using a dictionary attack).

"Waterwithsaltandsugar!1" it could be someone's password

I've seen similar phrases used as brain wallets, and they were found.

Is it better idea to show your ISP that you are using Tor? Don't you think it's alarming?

Is it less alarming to show your ISP that you are using a VPN?

Both isn't ideal, but VPNs are often used to connect to a company network too. Or for streaming.

You could eaisly use secondary accounts for purchasing stuff from forum... and I don't mean LeyoceV Mobile  , but some random newbie account.

"I'd like to give the t-shirt I won to a Newbie who lives in the same country as me"....

Which do you think is easier for an automatic system to find:
"1McY1aGwc8jvFtA."
or
"My2YearOldCatLikesYoWalk."

Both are equally strong, but the second option is much more difficult to be recognized by an automatic system than the first.

What makes you think they're equally strong? If the first one is generated randomly, it's much stronger. If you want to use words as a password, at least generate them randomly. Kinda like Electrum does it.

The probability of him hitting random letters is greater than a sentence.

You should look up the words "dictionary attack"

[n0nce]

But it's not the special characters that make the difference in this example password. It's the phrase. Systems typically match words, but not phrases.
The system can combine "water" "salt" "sugar". But combining as a phrase "water" "with" "salt" "and" "sugar" is more unlikely.

No, that's wrong. These are all regular English words found in every wordlist and cracked in minutes.
https://en.wikipedia.org/wiki/Dictionary_attack

As you said rightly, the systems normally check letter by letter.

No, I said the opposite. Letter-by-letter bruteforcing is probably dead for well over a decade now.
https://ieeexplore.ieee.org/document/4799025

Therefore, it is more likely to pick up a combination of random letters than a sentence that is understood by a human.

Which do you think is easier for an automatic system to find:
"1McY1aGwc8jvFtA."
or
"My2YearOldCatLikesYoWalk."

Both are equally strong, but the second option is much more difficult to be recognized by an automatic system than the first.

That's entirely backwards. The second option is orders of magnitude easier to crack, since it is just 7 words and a number. As the sentence even makes semantic sense, some crackers should have an even easier time guessing that password.
Meanwhile the first option consists of 15 random characters, so wordlist-based attacks don't work and one would have to default back to the much slower / 'legacy' byte-by-byte bruteforcing approach.

• Ironically: mix, tumble, CoinJoin or submarine-swap your campaign funds to a Lightning wallet. Anything that improves your on-chain privacy.

It will be great if anyone can tell the procedure of doing this with a lighting wallet. A step by step procedure or guide may be really helpful along with links to site / wallets etc. Usually how much fee is involved in this process ?

Sure; thanks for the suggestion. I will do such a guide in the future. But in essence, you just connect to https://boltz.exchange/ via Tor (you will be redirected to their Tor site), enter the amount you want to send to your Lightning wallet (such as Core Lightning) and send the amount shown on screen through a regular on-chain transaction.

The point I wanted to emphasize is that for a hacker who steals hundreds of passwords, he will use automatic systems that will try to match the victim's password letter by letter.

No, he won't.

The probability of him hitting random letters is greater than a sentence.

That is wrong. By definition, a sentence has less entropy since it does not consist of random letters.

I am not recommending this or any other type of password here. Just to point out that both types of passwords can be safe if used correctly.

Perhaps a mix of the two options could be something interesting to explore.

There is not much to discuss; it is mathematically proven that truly randomly generated passwords are much stronger than real words and sentences. We don't need to mix a strong system with a weaker system, either, that only reduces security.
My mate, I honestly suggest you go and change all of your passwords, now..

[Synchronice]

Is it better idea to show your ISP that you are using Tor? Don't you think it's alarming?

Is it less alarming to show your ISP that you are using a VPN?

Definitely it is less alarming. VPN is used by people to bypass restrictions that mostly include access to some games, game servers, netflix/hulu and so on. A lot of people use vpn with servers in Turkey to get cheap access to digital services.
Even if you want to hide your VPN usage from ISP, you can use VPN with obfuscated servers like ProtonVPN with Stealth mode or setup OpenVPN with obfsproxy.

By the way, if you use Tor bridges without VPN, node owner may know your IP address and in case nodes get compromised, others will know it too.

I think the use of real words, depending on how they are used, is a not bad model.
A machine finds random letters faster than real words. Logically it cannot be just a word or two. But, a sentence, with three or four words, can be very difficult to crack as a password.

In reality it all depends on how you build your password.
Random letters and numbers can be as easy to break as a few words together.

The suggestion I always give is to build passwords that you can memorize, but at the same time are complex.

"Waterwithsaltandsugar!1" it could be someone's password, which will be very difficult to be cracked.
Well... now it's not... it's better that no one uses it. 

That is unfortunately completely wrong. Your example password is extremely easy to crack. Password crackers nowadays don't brute-force letter by letter anymore, but are based on wordlists. They also take into consideration that people like to append special characters and numbers to the beginning or the end of the password. Humans are way too predictable to be trusted to generate randomness; this is a scientifically proven fact.

That's true but I always wonder what kind of prediction can someone find, for example, in this password: 'railWayZDanieAccCausticCornUebung'. I'll explain: Railway is railway, ZD is Russian word, short version of здapoвa (Hello), Zdanie is also Russian word здaниe and means building, Acc is a short version of Account, Caustic is caustic, for example caustic soda, Corn is a corn and Uebung is a German word Übung that means practice.
I agree that humans are very bad at randomness but I'm curious why these combination of words doesn't sound or look random.

[LoyceV]

I only remember a few passwords, but I use hundreds of different ones. Most of them look like "(f#L!{p[oKGzz[2aV$'[P6!n$", and I'm not even going to try to remember them.

That's the type of password everyone should be using. It's your choice if you try to remember them or not but believe me, if you try, that's not difficult to remember. Type that hard password frequently for months, for a year and then you'll realize that you have memorized it

Like I said, I can remember a few passwords. But I can't remember hundreds of them, and most of them I don't need very often. If I'd try to remember them all, I'd either have weak passwords, of lose access all the time.

you can type it with your eyes closed.

I always type with my eyes closed

[joker_josue]

That's entirely backwards. The second option is orders of magnitude easier to crack, since it is just 7 words and a number. As the sentence even makes semantic sense, some crackers should have an even easier time guessing that password.
Meanwhile the first option consists of 15 random characters, so wordlist-based attacks don't work and one would have to default back to the much slower / 'legacy' byte-by-byte bruteforcing approach.

Maybe I didn't explain it well. And what I did was just an example. Furthermore, the world does not only speak in English.
The idea I mean is that it doesn't necessarily have to be random in human eyes, but rather random in machine eyes.

This is a little bit what I want to say:

That's true but I always wonder what kind of prediction can someone find, for example, in this password: 'railWayZDanieAccCausticCornUebung'. I'll explain: Railway is railway, ZD is Russian word, short version of здapoвa (Hello), Zdanie is also Russian word здaниe and means building, Acc is a short version of Account, Caustic is caustic, for example caustic soda, Corn is a corn and Uebung is a German word Übung that means practice.
I agree that humans are very bad at randomness but I'm curious why these combination of words doesn't sound or look random.

Maybe my English is not the best and I can't explain it in the best way.
I apologize.

My mate, I honestly suggest you go and change all of your passwords, now..

I also wouldn't trust passwords created by a password system, because if a system can create them, it can also crack them.

Either way, you can rest assured that I have my own password model, different in many aspects from those discussed here, which, as you may understand, I will not share here.

[Accardo]

There is not much to discuss; it is mathematically proven that truly randomly generated passwords are much stronger than real words and sentences. We don't need to mix a strong system with a weaker system, either, that only reduces security.
My mate, I honestly suggest you go and change all of your passwords, now..

Having strong passwords is good, but 2FA is better because no password is strong enough not to be cracked with a quality config and combolist. A lot of accounts could get cracked using good checkers, so when that happens even if the cracker got the username and password they can't access the account if s/he don't pass through the 2FA requirements. For a forum like this having the question and answer feature set up is also recommended, to enable easy account recovery. Hence, since the forum is not a target to crackers, its nothing to worry about, since the forum account sales market is falling on daily basis. Though, your thread is very excellent, as we are meant to be security conscious online and keeping things private is important.

I also have a question, what happens to a person that doesn't have a picture anywhere online, how can he be traced? if their privacy is leaked that is they don't use VPN, Tor or all the tools you just mentioned, between the forum encourage users not to attach their real faces on the site.

[dkbit98]

"I'd like to give the t-shirt I won to a Newbie who lives in the same country as me"....

I don't think your are the only guy in bitcointalk forum from same country, but they could also send that same t-shirt to any neighboring country PO Box of mysterious person, since there are no real borders in EU  

I also wouldn't trust passwords created by a password system, because if a system can create them, it can also crack them.

LoL, but you brain is also a system, and when it breaks that means you don't have any backups.
You can do whatever you want, but most cases of people losing passwords and bitcoin keys is when they tried to act smart creating their own ''systems''.

Either way, you can rest assured that I have my own password model, different in many aspects from those discussed here, which, as you may understand, I will not share here.

Sorry but I have to say that you are making perfect recipe for disaster with your unique password model, whatever that is.

[joker_josue]

Sorry but I have to say that you are making perfect recipe for disaster with your unique password model, whatever that is.

Why? We all have models for passwords, even if it is the simple fact of using "software" to create passwords.

Also, the main passwords should be kept in a safe place, in case something goes wrong.

[NotATether]

For iOS, 'Onion Browser' exists and is recommended by the Tor Project:
https://onionbrowser.com/

I use an app called "TOR Browser", because the onion browser does not reliably work for me (or should I say not at all)!

It's good if you don't mind the occasional nagging to use the built-in VPN - honestly, I never use it, as a Proton Visionary subscriber.

Even if you want to hide your VPN usage from ISP, you can use VPN with obfuscated servers like ProtonVPN with Stealth mode or setup OpenVPN with obfsproxy.

ProtonVPN servers can also be exported as OpenVPN profiles. None will work in eg. China, unfortunately.

[Synchronice]

Even if you want to hide your VPN usage from ISP, you can use VPN with obfuscated servers like ProtonVPN with Stealth mode or setup OpenVPN with obfsproxy.

ProtonVPN servers can also be exported as OpenVPN profiles. None will work in eg. China, unfortunately.

But ProtonVPN's obfuscated servers work in Russia, Iran and Egypt.
China is a very individual case, sometimes some VPNs work in China, sometimes - not. At the moment, Astrill VPN is very popular in online Chinese communities. Chinese usually use Shadowsocks, V2Ray, Xray, Trojan, VLESS, or gRPC to bypass Great Firewall of China.
By the way it's a good idea to add in my thread VPNs or methods that work in China to bypass their internet cencorship.