Reduce the chance using Old Accounts for Hacks , Scam and Malware things !

[Lafu]

As the title already explain a little bit whats should be done there is suggestion about Old Accounts that are not active for years !

Most of the Old Accounts that have written here on the Forum after a long time of inactivty for years was used from Hackers to spread Malware and Scams the last years.

This year and the last year Older Accounts from 2021 was used , the year before it was an lot of Accounts 2020.
I can post the exactly numbers of them but that would take some time.

Here also i would say and get big thank you out to all the reporters that looking for Malware , Scam and abusing old Accounts for that.

In the first line this is for theymos , Cyrus and also for the Recovery Team.
Global and also Local Moderators please post your opinion about that as you handle most of that things.
Every other User is also welcome to post your thoughts about that.

My suggestion here for Old Accounts is :
(This is just an Idea and i am open for other Ideas)

• Old Accounts that havnt post anything or active after the last post in the last 3 years should be taken in some temp cooldown !
  (this means before they can post again they should be going also to an overwatch by the Recovery Team)

I am sure that would helping against Malware posting Accounts , Scammers and other things to abusing this Old Accounts to harm others!

If wanted or needed to change here something i can make a list of the last 5 years what Accounts have posted Malware and suspicious Links.
I dont have given up the fight against Hackers and the bad boys here on the Forum and always looking for how we can make something against them.

I also know its some kind of endless fight as they always will be find a new way , but we can together reduce the space where they can act.

Let me know your opinions.

[notocactus]

Old accounts become actively again after several years of inactive don't trigger any security alert if email address was not changed almost immediately after waking up account password was not changed almost the same time too

So with such accounts, no suspicious things to trigger anything in account security and it does not relate to account recovery. It seems you try to make account wake-up and account recovery as the same, while these activities are complete different.

Accounts that have suspicious activities can be locked even they don't use the secret questions.

[Lafu]

So with such accounts, no suspicious things to trigger anything in account security and it does not relate to account recovery.
It seems you try to make account wake-up and account recovery as the same, while these activities are complete different.

To be honest , you dont have no Idea what was going on the last years with all that or some old Accounts.
If you want to look about it take your time and look here : Report Malware and Suspicious Links here so Mods can take Action
Check the Accounts what was used for it.

Accounts that have suspicious activities can be locked even they don't use the secret questions.

Old Accounts that have suspicious activities will be only locked or banned if you report them and then maybe it would be to late.
So i guess you have no clue whats really going on with Accounts and what some are posting.

[promise444c5]

Imo users that engaged  in such should already being banned unless if such account was hacked but recovered..
Not all users who woke up from a deep sleep is actually going to have such intensions  though but it could make a lot of sense preventing such account from posting for a period of time unless whitelisted just like the “evil ip” thingy .
What could be added is every of their post should always go  under review for a particular period or just specific number of posts. Through this period if there’s a change of account user, it should be detected through  the posting pattern and then placed under watch.

[Obim34]

It will really be hard to flush them out, with their intentions if they try to sign into old accounts and it becomes a problem, the next step is to create a new account some of them go ahead to buy copper membership at least to raise a slight conviction.

If these has to work it needs to be on ranking level, confirmations on lower ranks should be more difficult than that of higher ranks, as far i have come across, low ranked accounts are the majority of user bringing attacks we mostly see. With how the forum now give earnings, they wouldn't want to spoil those accounts, i have seen accounts with high ranks wake up to apply for signature campaigns they hardly go into scamming, but since full members and below are easy to get they are the most used to carry out these deeds.

After passing the recovery team, those account can be flagged or tagged, it needs to be visible on the profile to give formal consent of long time of inactiveness.

[mcdouglasx]

Perhaps it would be good to apply some sort of penalty to accounts that stop interacting for a long time (years), i.e., lower their rank.
Since sometimes it can be difficult to tell if it's the same person starting to post again or not.
Or a simple warning in their signature, on service, lending, or marketplace boards, indicating that they are interacting with an account that has been dormant for a long period of time.

[Synchronice]

Most of the Old Accounts that have written here on the Forum after a long time of inactivty for years was used from Hackers to spread Malware and Scams the last years.

It's not our duty to take care of those who are extremely naive and inattentive. By the way, how would they spread Malware? They can't upload malware on this forum and if someone puts some url in their signature that redirects to malware, I don't know, that's a different task and that can be done by any account.

• Old Accounts that havnt post anything or active after the last post in the last 3 years should be taken in some temp cooldown !
  (this means before they can post again they should be going also to an overwatch by the Recovery Team)

We have 3,278,649 members. I also think that Recovery Team might be lazy (pardon me if I'm wrong) and they won't like this idea, nobody wants a further work.

Slightly off-topic but I have a question. Did theymos change the password of satoshi's account? I mean, it could have been hacked, right? And theymos wants to keep this forum as an internet museum, so did he change the password of satoshi's account to make it resistant to brute-forcing? I'm simply curious about that.

[Jewan420]

It is a good idea to monitor members who have been active for a long time until it is confirmed that the account is still under the old owner. Most of the time, these accounts are used for scams or malware, but not always. So it may be a mistake to lock and ban an account immediately after it is active without any verification. We may be able to identify this account by comparing the post pattern after activation and the old post pattern. In most cases, it is too late to identify the accounts, as soon as they are successful in their purpose. We should report such accounts whenever we see them.

[Agbamoni]

Perhaps it would be good to apply some sort of penalty to accounts that stop interacting for a long time (years), i.e., lower their rank.

No, it will be wrong to do so. Some accounts dont interact in the forum because of some certain reasons but once in a while they visis the forum. You cannot tell why they were absent so reducing the rank is not a good option. BlackHatCoiner said goodbye to the forum in December 2023 but he was last active in February 2025. Scamvirus was inactive for more than 6 months, now he is active again

Since sometimes it can be difficult to tell if it's the same person starting to post again or not.

It is very simple to tell. Let them sign or verify the previous address that was used in the forum. And if vigilant members of the forum figure out difference in posting style they will notify everyone. Dont worry about that.

[DYING_S0UL]

But wouldn't that be a lot of work for the moderators? And do we even have that kind of manpower to moderate these things? I believe the mods are already doing a heck of a lot of work. Meanwhile, we have users who constantly monitor the forums and report these hacked, malware posting accounts. That should be sufficient enough. So in my opinion, it would be an unnecessary hassle for everyone to take such steps. Just my two sats of course...

Perhaps it would be good to apply some sort of penalty to accounts that stop interacting for a long time (years), i.e., lower their rank.

No, it will be wrong to do so. Some accounts dont interact in the forum because of some certain reasons but once in a while they visis the forum. You cannot tell why they were absent so reducing the rank is not a good option. BlackHatCoiner said goodbye to the forum in December 2023 but he was last active in February 2025. Scamvirus was inactive for more than 6 months, now he is active again

Agreed.  

[Alpha Marine]

Most times, those accounts are not used by the original owners of the accounts. They are either bought or hacked, so it will be difficult to completely stop this form of illicit activity entirely. However, I believe the secret question should be asked when old accounts that haven't been active for years try to log back in. This doesn't matter if they logged in to the account with the right password. Before they are allowed to post, they should give their answer to the secret question.
This won't eradicate the issue entirely, but accounts that were hacked won't be able to post, and it might reduce the problem.

Perhaps it would be good to apply some sort of penalty to accounts that stop interacting for a long time (years), i.e., lower their rank.

This won't make sense. People stay off the forum for a lot of reasons, it won't make sense to punish people like that simply because they were inactive for years.

Or a simple warning in their signature, on service, lending, or marketplace boards, indicating that they are interacting with an account that has been dormant for a long period of time.

This is better. It may work. It may just be there for a while and then the admins can remove it if they stay active.

[Amphenomenon]

• Old Accounts that havnt post anything or active after the last post in the last 3 years should be taken in some temp cooldown !
  (this means before they can post again they should be going also to an overwatch by the Recovery Team)

What I understand by this is that or think is better, old account that just woke up after a long time should be watch by the recovery team and this doesn't mean any limitation on their account for posting, not to discouraged legit members for returning. I have notice while of these account might not be active also, there are events that make them return back to speak about something on the forum.

Anytime is dropped they would be fend off even much faster through this.

Most of the Old Accounts that have written here on the Forum after a long time of inactivty for years was used from Hackers to spread Malware and Scams the last years.

It's not our duty to take care of those who are extremely naive and inattentive. By the way, how would they spread Malware? They can't upload malware on this forum and if someone puts some url in their signature that redirects to malware, I don't know, that's a different task and that can be done by any account.

• Old Accounts that havnt post anything or active after the last post in the last 3 years should be taken in some temp cooldown !
  (this means before they can post again they should be going also to an overwatch by the Recovery Team)

We have 3,278,649 members. I also think that Recovery Team might be lazy (pardon me if I'm wrong) and they won't like this idea, nobody wants a further work.

I won't say they are lazy, they are still doing their job well, maybe they adding what op said to their task may limit this or another body would be required for these?

Slightly off-topic but I have a question. Did theymos change the password of satoshi's account? I mean, it could have been hacked, right? And theymos wants to keep this forum as an internet museum, so did he change the password of satoshi's account to make it resistant to brute-forcing? I'm simply curious about that.

Here is your answer:

Done. Lauda is banned in the same way as satoshi, such that it isn't possible to even log into the account anymore.

Perhaps it would be good to apply some sort of penalty to accounts that stop interacting for a long time (years), i.e., lower their rank.
Since sometimes it can be difficult to tell if it's the same person starting to post again or not.
Or a simple warning in their signature, on service, lending, or marketplace boards, indicating that they are interacting with an account that has been dormant for a long period of time.

This is not gonna work rather it will even limit legit users from returning, and other idea is also not ideal. Aside from those who got airdrop merit, many of these accounts deserves the rank they are currently, their contribution to the forum cannot diminish because they became inactive.

About the other, this doesn't stop for posting malicious link even in other board where post of such doesn't show.

[DYING_S0UL]

Most times, those accounts are not used by the original owners of the accounts. They are either bought or hacked, so it will be difficult to completely stop this form of illicit activity entirely. However, I believe the secret question should be asked when old accounts that haven't been active for years try to log back in. This doesn't matter if they logged in to the account with the right password. Before they are allowed to post, they should give their answer to the secret question.

But why exactly? What would secret question achieve here? With it both the hacker and the original owner would be locked out of the account. The secret question is a kind of failsafe intentionally placed. Did you mean the secret question would be forced on the inactive user? And after getting self banned through the secret question (nobody remembers the answers IMO), they would need to appeal and sign a message to prove ownership and regain access to the account? Something like that?

[Ultegra134]

I agree with @Synchronice. This sounds too much work for moderators and I also don't understand how it would work. What do you mean by "temp-cooldown"? What would it achieve by not allowing them to post for a while and how are moderators going to monitor someone who's unable to post? I'm sorry, but it sounds unreasonable. Although I understand the risk of old accounts being sold for malicious purposes, it's not possible to save every single user who's naive enough to end up scammed by someone who has woken up after a long inactivity period.

The trust section of each user warns us of any possible password or email changes and if the account has suddenly woken up. This warning suffices enough if we're suddenly presented by an offer or something that sounds too good to be true.

[Jawhead999]

Is it like in Facebook group where the post must be reviewed and accepted by the moderators first?

I feel like it's kind of newbie jail and theymos no longer want to see something like that to happen.

Honestly I don't really know how it should be done, maybe there should be a system to detect if someone create an ANN thread in ANN/Token which use the same name like the existing one and not locked, it should automatically notify them/delete it immediately.

[Mrbluntzy]

The trust section of each user warns us of any possible password or email changes and if the account has suddenly woken up. This warning suffices enough if we're suddenly presented by an offer or something that sounds too good to be true.

For the old experienced users of the forum, they already knows how to check the trust section of a profile to confirm if the account just woke up or if any of the account information like email and password have been recently changed, but how about newbies or guest visitors who don't know the forum very well?

Some of those old accounts may not even have any tag on their trust, it appears as "Trust: +0 / =0 / -0" Newbies might not have the idea to check for warning about password change.

The scammers that are using those old account might not post or present an offer that sound too good to be true but they could make a considerable post which will contain the malware link and once anyone click on the link not knowing it's a malware, they face the attack.

[Pablo-wood]

Perhaps it would be good to apply some sort of penalty to accounts that stop interacting for a long time (years), i.e., lower their rank.
Since sometimes it can be difficult to tell if it's the same person starting to post again or not.

Looking at this suggestion from a different perspective, what if the user was sick all along and couldn't engage in forum activities for years only to recover and resume forum engagement just to find out his/her account got a lower rank don't you think it worsen the state of that person. This is a community and in a community we don't chase or bully people for being absent for long, we only protect against impersonation.

Or a simple warning in their signature, on service, lending, or marketplace boards, indicating that they are interacting with an account that has been dormant for a long period of time.

This might be a better suggestion, a warning badge, logo or message showing on every post they make indicating a user have been absent for a long time just to keep forum users safe from scam.

[dkbit98]

I don't see how forcing a mass cooldown on all inactive accounts would improve anythings.
This won't prevent scammers to scam other members, and malware is usually posted by newly created accounts.
With cooldown you would also hurt genuine users for who not always active, and they would probably stop quit the forum if they couldn't post after comeback.

[nutildah]

Not the worst idea in the world... Maybe accounts that have been inactive for 3 or more years should be allowed to post but they can't post links or crypto addresses for the first week they come back, or their next 10 posts or something. That way they can still contribute to discussion but not for financial purposes.

The amount of bought accounts in sig campaigns is kind of disheartening. Wish the managers would do a better job of checking account histories before allowing these accounts to join campaigns.

[babo]

~~~~
Let me know your opinions.

We could put a longer lasting wake-up account warning, a kind of warning like for trusts or flags
Just to warn people not to trade or anything with these accounts that have been awakened after so long
a warning that lasts, I don't know, 6 months?