Account compromised? | Bitcointalksearch.org

aleksej996

sr. member

Activity: 490

Merit: 389

Do not trust the government

Quote from: onnz423 on September 17, 2017, 05:13:26 AM

-snip-

I personally use unique 65-100char passwords, so data breaches cannot touch me any more. Also a possiblity of keylogger is possible as well, or some kind of data leak.
you would be the luckiest person in the world to get 8 alphanumerics done in 12 rights.

You need help dude Cheesy

100 char password, wow...That is more then 512 bits of data. Servers don't even use hashes larger that 512 bits.
It would be more profitable for someone to just try to get a collision, then to actually guess a password.
Especially since they are unique, they would have no use of the password, just a random number that gives that hash.

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

Quote from: jackg on September 17, 2017, 06:01:37 AM

Correct me if I'm wrong but a password that length would probably require copy and pasting. So it'll face any viruses that exist with access to the dashboard. Or any key loggers (if you type the 65 characters).
Also, passwords to websites are sent over Internet and while unlikely it's possible a potential hacker can gain access to the connection (by piggybacking) on it.

Keepass, lastpass etc. are great solutions, for password managing, since you can use 2FA and OTP solutions. On these solutions all of the passwords are encrypted with master password, and lastpass has support for yubikey at least. Atleast lastpass supports autofilling. However if we assume that the computer has malware, it does not matter really. However if you have a great security overall, and careful about what you download etc, those tools can be really useful.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: onnz423 on September 17, 2017, 05:13:26 AM

Quote from: jackg on September 16, 2017, 02:27:22 PM

1. I will show you the option in my app at some point if you really want me to. Its not rooted/jailbroken and the option existed from the start. So you're the one talking random FUD (the Seagate app also allows you to backup data from apps as well).

I just checked the Seagate backup, and there is no option for backupping any kind of application data. Only Photos, Videos, Music, Contacts, Call log and Messages. So care to repeat what you said?

Quote from: jackg on September 16, 2017, 02:27:22 PM

Also, a session between the server and Google that has to exist for the captcha to fully work can be interrupted and interfered with remotely.

Exactly. Not really possible to bypass it or cheat it.

Quote from: jackg on September 16, 2017, 02:27:22 PM

You could also hack an account where the same password can probably be used. Sites like Yahoo give you 12 attempts before you have to retry and get locked out of your account (I had someone manage to crack mine with a password i felt was fairly safe (8 alphanumerics).

I personally use unique 65-100char passwords, so data breaches cannot touch me any more. Also a possiblity of keylogger is possible as well, or some kind of data leak.
you would be the luckiest person in the world to get 8 alphanumerics done in 12 rights.

Correct me if I'm wrong but a password that length would probably require copy and pasting. So it'll face any viruses that exist with access to the dashboard. Or any key loggers (if you type the 65 characters).
Also, passwords to websites are sent over Internet and while unlikely it's possible a potential hacker can gain access to the connection (by piggybacking) on it.

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

Quote from: jackg on September 16, 2017, 02:27:22 PM

1. I will show you the option in my app at some point if you really want me to. Its not rooted/jailbroken and the option existed from the start. So you're the one talking random FUD (the Seagate app also allows you to backup data from apps as well).

I just checked the Seagate backup, and there is no option for backupping any kind of application data. Only Photos, Videos, Music, Contacts, Call log and Messages. So care to repeat what you said?

Quote from: jackg on September 16, 2017, 02:27:22 PM

Also, a session between the server and Google that has to exist for the captcha to fully work can be interrupted and interfered with remotely.

Exactly. Not really possible to bypass it or cheat it.

Quote from: jackg on September 16, 2017, 02:27:22 PM

You could also hack an account where the same password can probably be used. Sites like Yahoo give you 12 attempts before you have to retry and get locked out of your account (I had someone manage to crack mine with a password i felt was fairly safe (8 alphanumerics).

I personally use unique 65-100char passwords, so data breaches cannot touch me any more. Also a possiblity of keylogger is possible as well, or some kind of data leak.
you would be the luckiest person in the world to get 8 alphanumerics done in 12 rights.

konco_kenthel

full member

Activity: 378

Merit: 100

There may be people who do not like your opinion. But do not make the problem bigger and always give a better opinion to prove to them that we can still compete with the safe atmosphere to keep in touch.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: onnz423 on September 16, 2017, 12:31:55 PM

Quote from: jackg on September 16, 2017, 12:25:37 PM

1. I'm talking about the regular utility that comes with the factory install.
3. You can easily get past recaptcha many bots do it.

AOSP android does not have such a thing included, for privacy reasons, and you cannot access / with non-rooted device, so to me it seems like you don't really know what you are talking about.

Also you once again, just FUD around without sourcing. Talk is jusy talk, so unless you got a source, please do not talk about it. So far google has made a captcha software that is near impossible to break through, because it gets updated so often and bots are not smart enough to recognize different kind of signs, cars etc.

1. I will show you the option in my app at some point if you really want me to. Its not rooted/jailbroken and the option existed from the start. So you're the one talking random FUD (the Seagate app also allows you to backup data from apps as well).

Also, a session between the server and Google that has to exist for the captcha to fully work can be interrupted and interfered with remotely. Along with the fact you can test a few passwords and change IP if yours is dynamic. You could also hack an account where the same password can probably be used. Sites like Yahoo give you 12 attempts before you have to retry and get locked out of your account (I had someone manage to crack mine with a password i felt was fairly safe (8 alphanumerics).

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

Quote from: aleksej996 on September 16, 2017, 12:45:50 PM

Well there are about 50 million unemployed Chinese, so I think captchas should be considered effectively broken. Grin

However humans do not count as bots, so what are you referring to? Jackg said "bots"

aleksej996

sr. member

Activity: 490

Merit: 389

Do not trust the government

Quote from: onnz423 on September 16, 2017, 12:31:55 PM

Quote from: jackg on September 16, 2017, 12:25:37 PM

1. I'm talking about the regular utility that comes with the factory install.
3. You can easily get past recaptcha many bots do it.

AOSP android does not have such a thing included, for privacy reasons, and you cannot access / with non-rooted device, so to me it seems like you don't really know what you are talking about.

Also you once again, just FUD around without sourcing. Talk is jusy talk, so unless you got a source, please do not talk about it. So far google has made a captcha software that is near impossible to break through, because it gets updated so often and bots are not smart enough to recognize different kind of signs, cars etc.

Well there are about 50 million unemployed Chinese, so I think captchas should be considered effectively broken. Grin

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

Quote from: jackg on September 16, 2017, 12:25:37 PM

1. I'm talking about the regular utility that comes with the factory install.
3. You can easily get past recaptcha many bots do it.

AOSP android does not have such a thing included, for privacy reasons, and you cannot access / with non-rooted device, so to me it seems like you don't really know what you are talking about.

Also you once again, just FUD around without sourcing. Talk is jusy talk, so unless you got a source, please do not talk about it. So far google has made a captcha software that is near impossible to break through, because it gets updated so often and bots are not smart enough to recognize different kind of signs, cars etc.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: onnz423 on September 14, 2017, 06:47:52 PM

Quote from: jackg on September 14, 2017, 05:56:16 PM

Nope, I have full android (jellybean) and that stores EVERYTHING the apps produces on command. It can store the app along with the associated data.

Yeah but this requires root, and a root user would know the risks of producing such backups. What app are you talking about right now?

Quote from: jackg on September 14, 2017, 05:56:16 PM

Also, there are many ways that someone could have gone on his phone and posted something, who said anythng about a public place? Maybe it was a friend or someone living in his house just posting something random when they got bored?

What kind of "friend" would go to your phone, and start using it? Also i doubt that he had his screen on without a screen lock. Also it does not really matter, since i think that the point of this thread was to discuss technical details rather than discussing people who could possibly access the phone.

Quote from: jackg on September 14, 2017, 05:56:16 PM

By "hacking" I mean more a a brute force attempt, there are parts of the phone that can be taken over from the web client of play.google.com. If these were ammended by a little programming then a pasword for a bitcointalk account can be gathered, obviously this is unlikely as they'd change the email address and password after logging in.

You cannot bruteforce a google account, because after few invalid tries it does ask you for captcha, so that makes no sense. Would you care to actually define the technical details of the attack you are meaning, and there are no any tools that actually can solve recaptchas as far as i know.

1. I'm talking about the regular utility that comes with the factory install.
3. You can easily get past recaptcha many bots do it.

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

Quote from: jackg on September 14, 2017, 05:56:16 PM

Nope, I have full android (jellybean) and that stores EVERYTHING the apps produces on command. It can store the app along with the associated data.

Yeah but this requires root, and a root user would know the risks of producing such backups. What app are you talking about right now?

Quote from: jackg on September 14, 2017, 05:56:16 PM

Also, there are many ways that someone could have gone on his phone and posted something, who said anythng about a public place? Maybe it was a friend or someone living in his house just posting something random when they got bored?

What kind of "friend" would go to your phone, and start using it? Also i doubt that he had his screen on without a screen lock. Also it does not really matter, since i think that the point of this thread was to discuss technical details rather than discussing people who could possibly access the phone.

Quote from: jackg on September 14, 2017, 05:56:16 PM

By "hacking" I mean more a a brute force attempt, there are parts of the phone that can be taken over from the web client of play.google.com. If these were ammended by a little programming then a pasword for a bitcointalk account can be gathered, obviously this is unlikely as they'd change the email address and password after logging in.

You cannot bruteforce a google account, because after few invalid tries it does ask you for captcha, so that makes no sense. Would you care to actually define the technical details of the attack you are meaning, and there are no any tools that actually can solve recaptchas as far as i know.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: onnz423 on September 14, 2017, 04:11:38 PM

Quote from: jackg on September 14, 2017, 03:41:48 PM

That couldbe it. If your phone was left unattended anywhere then someone could have posted something (especially if the app was already opened).
Else, if it's an Android phone and your google has a fairly week password then that can also be fairly easily hacked (or if a backup of your phone is stored online somewhere with a weak password).

What? How does phone being unattended for few moments relate to someone posting as him? Im pretty sure he did not leave the phone unattended on public place, so that comment makes no sense at all Roll Eyes

Also he just said that he has a strong password, and google do not really get any public data breaches at least so what do you mean by "hacking"? Also only nandroid backups store such information, as far as i know, so how is a backup online related to this?

Nope, I have full android (jellybean) and that stores EVERYTHING the apps produces on command. It can store the app along with the associated data.
Also, there are many ways that someone could have gone on his phone and posted something, who said anythng about a public place? Maybe it was a friend or someone living in his house just posting something random when they got bored?

By "hacking" I mean more a a brute force attempt, there are parts of the phone that can be taken over from the web client of play.google.com. If these were ammended by a little programming then a pasword for a bitcointalk account can be gathered, obviously this is unlikely as they'd change the email address and password after logging in.

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

Quote from: jackg on September 14, 2017, 03:41:48 PM

That couldbe it. If your phone was left unattended anywhere then someone could have posted something (especially if the app was already opened).
Else, if it's an Android phone and your google has a fairly week password then that can also be fairly easily hacked (or if a backup of your phone is stored online somewhere with a weak password).

What? How does phone being unattended for few moments relate to someone posting as him? Im pretty sure he did not leave the phone unattended on public place, so that comment makes no sense at all Roll Eyes

Also he just said that he has a strong password, and google do not really get any public data breaches at least so what do you mean by "hacking"? Also only nandroid backups store such information, as far as i know, so how is a backup online related to this?

Quote from: podyx on September 14, 2017, 04:02:21 PM

How would they get access to bitcointalk account from google hack though if that was the case?

Google has not had a single public data breach recently, so there's no way that the bitcoin password has leaked via that way. However there was a Spambot leak recently, which might have caused your password to leak, if you used same password on any of the leaks.

podyx

legendary

Activity: 2338

Merit: 1035

How would they get access to bitcointalk account from google hack though if that was the case?

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: podyx on September 14, 2017, 03:35:17 PM

Quote from: jackg on September 14, 2017, 03:29:43 PM

Quote from: podyx on September 14, 2017, 03:02:17 PM

Quote from: onnz423 on September 14, 2017, 02:39:20 PM

I just checked your trust page and it says "This user changed his/her password recently.", which means that most likely it is compromised.
Change your password IMMEDIATELY if you can, as well as if you do not have a staked address yet, stake one now. If somehow you get logged out of your account, make a new account, and post over at Meta asking that your account gets tagged, and prove your ownership with signed message so no one gets screwed over because of the stolen account.

I changed password before I made this topic. I don't know how somebody could post on my account though?

Did you have to reset your account password? Or is it someone you know that has done this. Are your Cookies saved on a computer without a password, with a password that is fairly common or a password that someone else knows.

No, I didn't have to reset password, just changed it because I saw that post. My computer has a strong password but I logged in on bitcointalk on my phone, maybe that is why?

That couldbe it. If your phone was left unattended anywhere then someone could have posted something (especially if the app was already opened).

Else, if it's an Android phone and your google has a fairly week password then that can also be fairly easily hacked (or if a backup of your phone is stored online somewhere with a weak password).

podyx

legendary

Activity: 2338

Merit: 1035

Quote from: jackg on September 14, 2017, 03:29:43 PM

Quote from: podyx on September 14, 2017, 03:02:17 PM

Quote from: onnz423 on September 14, 2017, 02:39:20 PM

I just checked your trust page and it says "This user changed his/her password recently.", which means that most likely it is compromised.
Change your password IMMEDIATELY if you can, as well as if you do not have a staked address yet, stake one now. If somehow you get logged out of your account, make a new account, and post over at Meta asking that your account gets tagged, and prove your ownership with signed message so no one gets screwed over because of the stolen account.

I changed password before I made this topic. I don't know how somebody could post on my account though?

Did you have to reset your account password? Or is it someone you know that has done this. Are your Cookies saved on a computer without a password, with a password that is fairly common or a password that someone else knows.

No, I didn't have to reset password, just changed it because I saw that post. My computer has a strong password but I logged in on bitcointalk on my phone, maybe that is why?

aleksej996

sr. member

Activity: 490

Merit: 389

Do not trust the government

Quote from: podyx on September 14, 2017, 01:36:41 PM

Hey, I was looking through my posts and saw this

Quote from: podyx on September 13, 2017, 02:25:40 PM

Time for more cheap coins Kiss

And I have not posted that, how is this possible?

Do you live alone?
This is a good time to question your sanity Cheesy

Otherwise, sure it is possible you got hacked. Your account is old and there were leaks in the past (I believe 2015, so you are one of those accounts).
There is this website as well https://haveibeenpwned.com/ but it is obvious that your account was one of them. I hope you changed your password since then.

jackg

copper member

Activity: 2856

Merit: 3071

https://bit.ly/387FXHi lightning theory

Quote from: podyx on September 14, 2017, 03:02:17 PM

Quote from: onnz423 on September 14, 2017, 02:39:20 PM

I just checked your trust page and it says "This user changed his/her password recently.", which means that most likely it is compromised.
Change your password IMMEDIATELY if you can, as well as if you do not have a staked address yet, stake one now. If somehow you get logged out of your account, make a new account, and post over at Meta asking that your account gets tagged, and prove your ownership with signed message so no one gets screwed over because of the stolen account.

I changed password before I made this topic. I don't know how somebody could post on my account though?

Did you have to reset your account password? Or is it someone you know that has done this. Are your Cookies saved on a computer without a password, with a password that is fairly common or a password that someone else knows.

podyx

legendary

Activity: 2338

Merit: 1035

Quote from: onnz423 on September 14, 2017, 02:39:20 PM

I just checked your trust page and it says "This user changed his/her password recently.", which means that most likely it is compromised.
Change your password IMMEDIATELY if you can, as well as if you do not have a staked address yet, stake one now. If somehow you get logged out of your account, make a new account, and post over at Meta asking that your account gets tagged, and prove your ownership with signed message so no one gets screwed over because of the stolen account.

I changed password before I made this topic. I don't know how somebody could post on my account though?

onnz423

hero member

Activity: 840

Merit: 508

Make winning bets on sports with Sportsbet.io!

I just checked your trust page and it says "This user changed his/her password recently.", which means that most likely it is compromised.
Change your password IMMEDIATELY if you can, as well as if you do not have a staked address yet, stake one now. If somehow you get logged out of your account, make a new account, and post over at Meta asking that your account gets tagged, and prove your ownership with signed message so no one gets screwed over because of the stolen account.

Topic: Account compromised? (Read 712 times)