Securing your Bitcoin talk account

[Mia Chloe]

Security is one of the most important section of the crypto space and internet as a whole.Security in the internet simply refers to measures we take to prevent our device, assets or  privacy from cyber threats or attacks associated with the internet.Alot of persons spend much time on this forum while others spend little intervals of time on the forum however both categories of users require security measures to protect their accounts from hacks and other cyber threats.below is a series of things one can do to protect them from such threats.

Note!!--> This post may not contain all security measures therefore any additional information would be appreciated.

1.Always be sure to use a secure internet connection before logging in to your account as using unsecure connections exposes you to cyber threats which in some cases may lead to account ban due to using an IP with record of some units of evil on the forum.

2.limit your logining into your account via public cafes or computer centers as this can pose threats to your login details such as email and password.if possible avoid using public cyber cafes for logging in, instead stick to using a particular personal device this will make it even easier to monitor your IP logins using this function below.


3.Avoid using similar or same passwords on majority of your accounts or logins on different platforms.(try to make your passwords distinct and different.)

4.limit using Google password suggestions and password auto save as this makes it easier for hackers to access your Bitcoin talk account through your Google account.

5. Use the forum hide email address button to conceal your email.This feature is usually turned on by default for added security. However here is a guide to setting it up.




6. Make use of email addresses that seem different from your username as it reduces chances of hackers getting to know your email address easily which could make it easier for your account to be hacked, or your privacy tempered.Below is an illustration.

Compared to ;

 

7. Make use of secure browsers to avoid phishing attacks or leaking of your info to third parties.also avoid changing your email address frequently as this puts a message on your trust page for a certain period of time.
                    ADDITIONAL INFORMATION
1.For an extra layer of security forum users can make use of the forum 2FA.This works using a cryptographic proof of ownership which is done by submitting your Bitcoin wallet address on this thread
https://bitcointalk.org/index.php?topic=996318.0. (Thanks to @Tomatocage) forum moderators can then use the necessary submitted cryptographic details to verify your ownership of the account in the case of hack or loss of account.

2. You can also setup a security question for your account.
You can do this by following the steps below;



 Note!! :Make your security question difficult to figure out avoid simple questions like;
*middle name
*Pet's name
*Mother's maiden name.... etc

3. For additional security set up an SMS 2FA for the email tied to your Bitcoin talk account.

4. Avoid clicking suspicious links.As these links may carry phishing properties or malicious softwares.

5. For more information on security you can see to the posts below;

• Forum account: security, privacy, and recovery
• [GUIDE] How to Create a Strong/Secure Password
• How to sign a message?!
• [Eng: Tutorial] PGP Signature - Encrypt/Decrypt message - Fingerprint
• Post your PGP key, add an encrypted message, open for anyone.
• Why do you need PGP?.
• A Tutorial for Beginners to PGP - Pretty Good Privacy.

Don't forget to keep your keys safe mate 😁

[bitmover]

You forgot the most important

Sign bitcoin message with an address that belongs to you here

https://bitcointalk.org/index.php?topic=996318.0

This is how you will recover your account using a cryptographic proof of ownership

[EL MOHA]

Nice thread mate, although I have come across many of this similar threads about safeguarding once forum account, but no reminder is useless. Here is another thread https://bitcointalk.org/index.php?topic=5261696.msg54779472#msg54779472

Aside the staking of bitcoin address which is the most secure way to recover ones account. Other tips to avoid the account from been hacked can be;

1: turn on your Email 2FA used for the forum account
2. Regularly change the password of your forum account

[JunaidAzizi]

When you came to the internet all the protocols and rules were alloying on you. Internet is something like you don't know the people and they don't know you if they don't know about your life then how they are you will wisher they will use you for their benefits through a hack and I don't know that bitcoin talk account will be hacked like others I heard it for the first time because u heard a lot about the wallet the most every third person talking about the wallet security but you are The first one I think that talks about the privacy of the account. I don't know other routes of securing the account but the one that you mentioned was done when I joined this forum I am still confused about how someone can hack your account through email if you have an answer then please reply.

[GxSTxV]

1: turn on your Email 2FA used for the forum account
2. Regularly change the password of your forum account

I want to add one simple and maybe important note:
3:  It's important to use a different password for your Bitcointalk account than for your other accounts, just in case one of your account passwords gets compromised.

[Hatchy]

Security is one of the most important section of the crypto space and internet as a whole.Security in the internet simply refers

It's nice to see that we have some persons here on btt that actually thinks about the security of our account and not just focusing on how to secure our asset all the time. We nice guide mate. I will lik to add some important internet security tips written by mapuche33 that I find very useful.

By the way, I would like to mention some other useful general security tips:

• 1- Using multiple web-browsers on the same machine for different purposes (chrome, waterfox, opera, safari, brave, etc.) For example: one for social media purposes, another for banking / crypto, another one for surfing / researching, other for entertainment and so on. Also make sure to configure them properly installing useful add-ons. Like the following:
• 1.1- Password manager Add-ons like LastPass or KeePass are essential both for storing + generating random combinations of characters, just make sure to setup 2FA as well as never losing access to the associated email.
• 1.2- Ad-blockers will censor most of the annoying ads including scams / phishing pop-ups. uBlock Origin is the best.
• 1.3- Disconnect add-on is great for saving time + bandwidth by blocking 3rd party scripts used for social media metrics, advertising, analytics, etc. Also enhances privacy.
• 1.4- Privacy Badger add-on blocks all those undesirable trackers that let others monitor your activity.
• 1.5- EtherAddressLookup is a must for crypto enthusiasts, it performs an automated address lookup as well as warns you against blacklisted domains. it prevents you against phishing / loosing money.
• 1.6- Running proxy scripts on your browsers is highly recommended because hides your real IP from websites by sending fake headers with anonymous IP addresses. it is easy to setup and gives you peace of mind.
• 1.7- Finally replace your default search engine Google with a more reliable one like Duckduckgo.com. it is private & simplified without Ads fighting to be on top of the results. You will less likely fall into fake sites, with a plus of a more personalized experience. Highly recommended doing this switch.
• 2- Using a VPN (paid or free) in order to prevent man-in-the-middle attacks, specially if your connection is wifi and you carry a laptop, also to prevent / bypass government censorship. There are a lot of services worth trying, just pick one that doesn't keep user logs + accept crypto as payment. Also keep in mind that the free ones are great but much slower: ultrasurf.us & riseup.net
• 3- Incorporate the habit of changing your passwords more often, let say 6 months minimum to 1-2 years max.
• 4- Make backups more often, or make it automated. Be prepared to deal with data-loss and ransomware. Also always keep your sensitive data offline to prevent identity theft.

[aysg76]

As @bitmover already pointed out above signing messages will help in verifying that address belongs to you and can easily gain access of your account even if you face any problem.The second step as you said remember mail and also hide it from public as scammers will parade with fake links that you unintentionally might click and fall for such scams.

[OcTradism]

Forum account: security, privacy, and recovery

Use a strong password for your account, your email, sign a Bitcoin message, stake it. Sign a message with PGP key and stake it.
[GUIDE] How to Create a Strong/Secure Password


How to sign a message?!
Stake your Bitcoin address here

[Eng: Tutorial] PGP Signature - Encrypt/Decrypt message - Fingerprint
Post your PGP key, add an encrypted message, open for anyone.
Why do you need PGP?.
A Tutorial for Beginners to PGP - Pretty Good Privacy.

[lovesmayfamilis]

Once on the Internet, you always need to understand that something that you consider valuable to yourself needs protection. OP, you forgot one small point that many newbies neglect: your privacy, which is also a guarantee of the security of your account. No matter how you protect your account, sometimes we see that someone, in order to receive merit, goes to extreme measures and posts evidence in the form of photos of themselves and their loved ones about their participation in a particular event. In addition to keeping your account secure, I would also advise being very careful about posting your personal information. There are archives on the forum; you need to remember about them. Having seen your identity, hackers can get information about you outside the forum, and then things can go in a different direction.

[Arenga pinnata]

As for the steps to hide emails, it seems that this is implemented by default on this forum. I have done the steps as said by the OP. but I missed about showing the email or hiding it. I'm afraid I've been showing my email all this time. But after I checked it, it turned out that it was automatically hidden. And I feel relieved knowing this.

But about signing a bitcoin address, I don't understand how to do it. Looks like I have to learn to do it.

[SquirrelJulietGarden]

But about signing a bitcoin address, I don't understand how to do it. Looks like I have to learn to do it.

It's good to start learning.

Signing a message with your Bitcoin private key is a good practice and it can give a proof of account ownership that you might need to recover your account when it gets hacked.

The bottom line is, to sign a Bitcoin message, you need to have a private key. To have a private key, you must use a non custodial wallet that is good to keep your bitcoin safely too. If you use a custodial wallet like centralized exchange wallet (account), you don't have a Bitcoin private key. Don't have a private key means you don't own bitcoin.

[Yamane_Keto]

Signing a message or proving account ownership using PGP signatures is good if you want to access your account if it is hacked, but one of your suggestions is bad. If you restrict IP addresses for the last 30 days, this enhances privacy, but it may not be good in the process of recovering your account because the recovery team has less information about you, thus making it more difficult to verify that you are the owner of the account.



this one is bad

Using a clean email address and having it on a separate phone that you do not use on a daily basis will greatly enhance your security.

[armanda90]

Seems you miss with another important points for securing Bitcointalk account, you can set up question security with your account when some one accessing to your account and try to change password. I think that feature is still available in bitcointalk profile security and make more secure with your bitcointalk account. Looks all your points above are very important how to protect our account but don't forget always check right website of bitcointalk link when accessing to the forum.

Many hacked cases happening because they access with bitcointalk forum trough fake link and all account details have been record make the hacker easily account change hands.

Thanks for all important points about how to secure with bitcointalk account, not bad ideas if you can added some information from responder how to make more secure with our bitcointalk account.

[Doan9269]

We are the first custodian to our security, we shouldn't handle our bitcointalk login device with carelessness that everyone have access to it, no matter how we secured it, if other people have access to it then nothing there is hundred percent safe, we should be mindful of what we download, the websites we visit and by not storing our login details on any device that could be accessible to anyone, when we don't make them have access to us, they cannot attack us.

[HelliumZ]

If you give your bitcoin forum id username and password very strong then there is no chance of your account being hacked. Also, if someone can't access your device then there shouldn't be any problem with your account. Moreover, you can recover your account with the original Gmail, so if it gets hacked, you can recover your account again.

[Lucius]

7. Make use of secure browsers to avoid phishing attacks or leaking of your info to third parties.also avoid changing your email address frequently as this puts a message on your trust page for a certain period of time.

Which browser can be considered safe in the sense that it can prevent phishing in the literal sense of the word? Every user can install some kind of adblocker and protect himself from the display of paid ads in the search results, but if someone wants to click on a phishing link that he received in an e-mail or that someone posted on a forum, the browser can only protect him if someone has reported a malicious location and then it will display a notification.

Changing the e-mail address and password is a completely legitimate procedure and I don't see why it would be a problem, except in case there is a suspicion that the BTT account has changed owners.

Seems you miss with another important points for securing Bitcointalk account, you can set up question security with your account when some one accessing to your account and try to change password. I think that feature is still available in bitcointalk profile security and make more secure with your bitcointalk account.
~snip~

This is a bad option that should have been removed a long time ago, because people are very often predictable and set a very simple question and answer.

Another good reason not to use this feature -> PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT

[coupable]

OP, I think you somehow forgot to mention the two most important measures to take in order to completely secure the ownership of your bitcointalk account; First, apply all security measures for the email used for registration. You should always have access to that email because in extreme cases that your account gets compromised then the only way to prove ownership is by having access to the original email used for registration as the account would be restored to that email. Second (most important) is to be able to sign a message from any public address staked before the account got hacked. It's not that much important to post a bitcoin address as long as you can use other protocols to sign a message through other blockchains.

I had my account stolen previously, and without these features, I would not have been able to recover it. Thank you to the forum administration, which provides many solutions to avoid multiple account thefts.

[Peanutswar]

Besides the listed of you OP above, ideal if you make sure to secure your device too even in the internet, if you can afford a good antivirus it a good because this can be a preventive measure for you for possible attacks, suspicious links, phishing, and etc. but of course having a license of this is different from free take time to read the perks. At the same time, I highly recommend checking your IP address every of end of the day. I recommend using this too. https://bitcointalk.org/myips.php

[Orpichukwu]

If you give your bitcoin forum id username and password very strong then there is no chance of your account being hacked. Also, if someone can't access your device then there shouldn't be any problem with your account. Moreover, you can recover your account with the original Gmail, so if it gets hacked, you can recover your account again.

I hope you are not forgetting the fact that when most hackers who want to get total control of your account want things to go off your control when accessing the account, the first thing that they will do is to change your email, and when this email is changed, you don't have any other way of accessing the account back because you can't reset the password. Unless you create a thread using another account and pass the required details over to the community, then you can have a chance of having your account recovered.
 
Another thing is that most people always attack e-mail first; it's through the email that they have access to your account, and they can revoke your own access from the email, and you, the owner, won't have access to it, so relaying on email for recovery is not really a good option. We should just protect our account in any way possible to avoid too much grammar in the future.

[tranthidung]

Signing a message or proving account ownership using PGP signatures is good if you want to access your account if it is hacked, but one of your suggestions is bad. If you restrict IP addresses for the last 30 days, this enhances privacy, but it may not be good in the process of recovering your account because the recovery team has less information about you, thus making it more difficult to verify that you are the owner of the account.

Details are explained at https://bitcointalk.org/privacy.php

IP-address retention

IP address retention works in this way:
Thing   Normal retention   Limited retention   Retention for guests
Full IP   6 months   3 months   A few weeks
Partial IP   2 years   N/A   N/A
City geolocation   6 years   3 months   N/A

You can opt into limited retention in your account settings. This will apply only to logs created after you change the setting, and doing so will make it much more difficult for you to recover your account if it is ever lost.

Between 6 and 24 months, the IP linearly loses least-significant bits over time. For example, the IP 123.234.210.221 would lose 8 bits and become the prefix 123.234.210.0/24 approximately 10.5 months after it was logged. For IPv6, the least-significant 66 bits are dropped after 6 months, and then the remaining bits are dropped linearly over the 1.5-year period.

The city geolocation locates you to the nearest large city according to your IP address.

Exception: if you click on a "ping link" as part of a manual account recovery process, the IP log created by this action has possibly-indefinite retention.

Using a clean email address and having it on a separate phone that you do not use on a daily basis will greatly enhance your security.

You must secure your email properly too with different layers of protection. 2FA must be turned on and avoid using SMS code for your email 2FA.

Passwords for your email and your Bitcointalk account must be unique and strong too then your account will be less likely hacked through password reset via email. Then by using a strong password for your Bitcointalk account, it's hard to be hacked directly with your account password.

I quote a great post of theymos about email that can be a throw away email (Use https://cock.li/)
Bitcointalk - About privacy

BTW, email is a big privacy issue in general. It's too expensive (mainly time-wise) to create new email addresses, but if you use the same one, it creates tons of links. Ideally, you should use one email per service. I've had two ideas in this area:

First, you could create a simple email forwarding service like this:
 - Without registration (but maybe with a tiny fee via eg. Lightning), take a user's email address, generate a random key, and use the random key to encrypt the email address.
 - Also encrypt the email address with a server secret.
 - Give the user an email address of the form ENCRYPTED_EMAIL.DECRYPTION_KEY@asdf.com
 - When the service receives email at a forwarding address, it decrypts the email first using its server secret, and then using the provided decryption key. Then it forwards the email to the email address
 - To destroy forwarding addresses, users could provide the service with both their forwarding address and target address, and the service could then send a confirmation email.

This would be convenient, and it'd fix the problem of services being able to connect users across multiple sites through email-address reuse. But it trusts the forwarder not to log the per-email decryption keys or give up the server secret key. Though if multiple services like this existed, you could chain emails through them to increase security.

My second idea is:
 - The user would be using his own software (like eg. Thunderbird or perhaps prontonmail). From this software, the user could instantly create low-capacity throwaway accounts on the server. Each throwaway account could be (or behave similar to) a POP3 account with low capacity (eg. 50MB) and quick message expiration (eg. 60 days).
 - The client software would use Tor and careful polling to download all of the messages on its throwaway accounts without leaking to the server info about which accounts are connected. To improve anonymity and efficiency, you could perhaps use PIR, or the server could publish hourly/daily bloom filters meant to match email addresses which received mail in the time period. The client software would collect all of the messages into a single inbox for the end-user. Since it polls frequently, the client wouldn't have to worry about the low limits on the individual throwaways.
 - The server could anonymously require a small one-time for each throwaway account by using blinded bearer certificates.

With this, the server shouldn't ever be able to connect any of the accounts together. You could also send mail from the throwaways.

The main thing necessary for this second idea is a really smart email client meant to juggle many throwaways. You also need a cooperative server allowing quick account creation (like cock.li), ideally via an API.