8 BTC loan request

[Keninishna]

I need a 8 BTC loan.
I can pay back 10 BTC in 5 days.

my bitcoin address is : 1KRESt175G6Ny13bH6A5g21vKLHcCdsfpG

[dollartrader]

Loan sent. Return to 14cJemNEQh7sj7PKndqRxsiuFCPVcuUkfx

[senbonzakura]

just like that

[Keninishna]

holy crap I did not make this post, who has been hijacking my account damnit.

[Keninishna]

I'll just send you 8 btc back now so my forum credit isnt ruined.
fuck I changed my password too. 175836c669c44941ca47d71dcbec6d6e536a60db58c017d14656109712b87e5f

[PatrickHarnett]

Something odd going on - obviously someone or ones is targeting lending.  Confirmations by pm's recommended.  Nice that you were able to cover the debt, but yu shouldn't have had to.

[dollartrader]

I agree with Patrick, I took the risk here. Sending PM.

[Keninishna]

well this has taught me to start using a pgp key or something.

[farfiman]

Something odd going on - obviously someone or ones is targeting lending.  Confirmations by pm's recommended.  Nice that you were able to cover the debt, but yu shouldn't have had to.

How does Pm's help ?  If the fake user answers the pm its the same shit...
unless you know some secret information of his ( grandmas maiden name...) and ask him

I guess the  5% a day interest should have been a big warning...

[Kluge]

Something odd going on - obviously someone or ones is targeting lending.  Confirmations by pm's recommended.  Nice that you were able to cover the debt, but yu shouldn't have had to.

How does Pm's help ?  If the fake user answers the pm its the same shit...
unless you know some secret information of his ( grandmas maiden name...) and ask him

I guess the  5% a day interest should have been a big warning...

Even a five-minute delay could prevent the kind of fraud which occurred in the OP. Most users have PMs sent to their email account. If user is online, and is notified of emails, it's possible he could intervene to prevent similar fraud. It's unlikely to help, but it's a very easy way to help prevent similar problems.

Though, I'm curious as to how the OP had his account hijacked.

ETA: Also worth noting many loans aren't funded for a good few hours, sometimes days. Real owner may have control of the account again, perhaps've contacted the admin. However, it appears this situation was due to poor password management.... we're over-reacting a bit, I think, unless something like what happened in OP becomes more frequent.

[farfiman]

Maybe this thread should be stickied as a warning to lenders ( and lendees....)

[dollartrader]

Would be a good idea to sticky something.

If an account is hacked, any of the info or settings could be changed so I'll definitely tread a little more carefully in the future. Lesson learned, thankfully a small one.

[Keninishna]

well you can check my signature line now. If you go to that link in it to my external site that has my btc address signed via gpg. So if any more loan requests come from me only send it to that address or to an address signed by me.

[copumpkin]

well you can check my signature line now. If you go to that link in it to my external site that has my btc address signed via gpg. So if any more loan requests come from me only send it to that address or to an address signed by me.

That's no use. If someone can post under your name, they can change your signature. We should ask theymos what's going on here.

[someone703]

Yup, sig thing won't be much good either like copumpkin mentioned.

Would be a pain, but maybe you should reformat your computer, install an anti-virus on it right away, then sign in and change your password and stuff up.

[JusticeForYou]

well this has taught me to start using a pgp key or something.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

May I suggest signing your requests with a gpg signature. Then at least they will need to steal your forum password, your computer, your passphrase, and understand how to use gpg.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJPIxwyAAoJEB2k6OhXVIbD9OgP/1YuJkhHQt3dcvgexzh3XRcj
zQCz3xMy38pB1OgnSSkX5SfSJn7cIoTadGdRmB+bUXm0dv5uGZbKGSpd1JtvQAkO
4XgmwRpP9LePKf4/vIwsMgX3JtF97l9rJByJarxAbCyElLVfht7xaPrue6jYkOE2
VGHXlDCscJxMgNnB5kSUuPoae291gZWSDCGpB4BiuU38EJmRV2+PKhBkmI1KDSWj
Ddw9JhYOE9olm5Y5L5bHQF3bgRLRTBSFn973QKmFbGJicLwnIrrHoA3wTqtqBfGd
6/JJ+qnRPH96gFzZuVob784aZo81EIB8SrXqirDMzj1B3ap3P+yl4sG/rpdlRnyR
BtgNn7k5E6IeSZ6EQGQWpoY42UUZRV5/N6xK0T9mS7T2lTmEMKkg/ED9cKbb3Tad
urCTk7IIkHRPbHiEO73PX0EIeT2lbchjuFKuLkWrBpuKLykgDTp8ttiAyczCG2J2
xaeWYopEg0Rj7O/yYChCHJpz5BOr631jOnZc0oLrfZEAM3YjAepF1+DEAyo46kiB
DiFlbMW+hsoRQ+qRB8OPYtrohc1eUHD6FjOWj/pLQeKdnY/9gq4kRDTaqv4nrOMt
gr+79UoyDjjdD0VYRQ6PglfFHFuoToxP+6p3zJO2bkeTjtFQOxnTLHdilLLbsjFY
MXkl+jNhCbk60nwKhNlB
=2AV+
-----END PGP SIGNATURE-----

[Keninishna]

but the link in my sig points to an external site which the hijacker does not have control over. Plus the address is crypto signed by me which you can verify via open pgp http://www.slideshare.net/poustchi/how-to-use-openpgp-for-email-encryption-signing

[Keninishna]

exactly

well this has taught me to start using a pgp key or something.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

May I suggest signing your requests with a gpg signature. Then at least they will need to steal your forum password, your computer, your passphrase, and understand how to use gpg.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJPIxwyAAoJEB2k6OhXVIbD9OgP/1YuJkhHQt3dcvgexzh3XRcj
zQCz3xMy38pB1OgnSSkX5SfSJn7cIoTadGdRmB+bUXm0dv5uGZbKGSpd1JtvQAkO
4XgmwRpP9LePKf4/vIwsMgX3JtF97l9rJByJarxAbCyElLVfht7xaPrue6jYkOE2
VGHXlDCscJxMgNnB5kSUuPoae291gZWSDCGpB4BiuU38EJmRV2+PKhBkmI1KDSWj
Ddw9JhYOE9olm5Y5L5bHQF3bgRLRTBSFn973QKmFbGJicLwnIrrHoA3wTqtqBfGd
6/JJ+qnRPH96gFzZuVob784aZo81EIB8SrXqirDMzj1B3ap3P+yl4sG/rpdlRnyR
BtgNn7k5E6IeSZ6EQGQWpoY42UUZRV5/N6xK0T9mS7T2lTmEMKkg/ED9cKbb3Tad
urCTk7IIkHRPbHiEO73PX0EIeT2lbchjuFKuLkWrBpuKLykgDTp8ttiAyczCG2J2
xaeWYopEg0Rj7O/yYChCHJpz5BOr631jOnZc0oLrfZEAM3YjAepF1+DEAyo46kiB
DiFlbMW+hsoRQ+qRB8OPYtrohc1eUHD6FjOWj/pLQeKdnY/9gq4kRDTaqv4nrOMt
gr+79UoyDjjdD0VYRQ6PglfFHFuoToxP+6p3zJO2bkeTjtFQOxnTLHdilLLbsjFY
MXkl+jNhCbk60nwKhNlB
=2AV+
-----END PGP SIGNATURE-----

[copumpkin]

well this has taught me to start using a pgp key or something.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

May I suggest signing your requests with a gpg signature. Then at least they will need to steal your forum password, your computer, your passphrase, and understand how to use gpg.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJPIxwyAAoJEB2k6OhXVIbD9OgP/1YuJkhHQt3dcvgexzh3XRcj
zQCz3xMy38pB1OgnSSkX5SfSJn7cIoTadGdRmB+bUXm0dv5uGZbKGSpd1JtvQAkO
4XgmwRpP9LePKf4/vIwsMgX3JtF97l9rJByJarxAbCyElLVfht7xaPrue6jYkOE2
VGHXlDCscJxMgNnB5kSUuPoae291gZWSDCGpB4BiuU38EJmRV2+PKhBkmI1KDSWj
Ddw9JhYOE9olm5Y5L5bHQF3bgRLRTBSFn973QKmFbGJicLwnIrrHoA3wTqtqBfGd
6/JJ+qnRPH96gFzZuVob784aZo81EIB8SrXqirDMzj1B3ap3P+yl4sG/rpdlRnyR
BtgNn7k5E6IeSZ6EQGQWpoY42UUZRV5/N6xK0T9mS7T2lTmEMKkg/ED9cKbb3Tad
urCTk7IIkHRPbHiEO73PX0EIeT2lbchjuFKuLkWrBpuKLykgDTp8ttiAyczCG2J2
xaeWYopEg0Rj7O/yYChCHJpz5BOr631jOnZc0oLrfZEAM3YjAepF1+DEAyo46kiB
DiFlbMW+hsoRQ+qRB8OPYtrohc1eUHD6FjOWj/pLQeKdnY/9gq4kRDTaqv4nrOMt
gr+79UoyDjjdD0VYRQ6PglfFHFuoToxP+6p3zJO2bkeTjtFQOxnTLHdilLLbsjFY
MXkl+jNhCbk60nwKhNlB
=2AV+
-----END PGP SIGNATURE-----

Well, the issue there is that there's no strong connection between someone's GPG identity and their forum identity. A scammer could easily generate a new key and sign messages with that. There need to be write-once fields in one's forum profile to set a key identity so nobody can change it after taking control of your account Of course, depending on how badly compromised the forum gets, they could just change the field in the database and we'd be screwed either way. This is why we need a strong crypto-based decentralized loan/reputation system

[copumpkin]

but the link in my sig points to an external site which the hijacker does not have control over. Plus the address is crypto signed by me which you can verify via open pgp http://www.slideshare.net/poustchi/how-to-use-openpgp-for-email-encryption-signing

My point is that the attacker can change your sig to point to another key on the same external site that's under his control, instead of yours. Or he could just change your sig to not point to a key at, and I doubt anyone would notice.