Topic: Account hacked -- should I blame admins or not? (Read 653 times)

Apparently, my account got hacked on the 1st November by the unknown hacker for unknown reasons.

First of all, my password was secure atleast with 3 capital letters, 6 numeric numbers and the rest was just small letters.

It came as a surprise when I tried logging just now, but I was unable due to the unknown hacker my account. The next move that anyone would take after, would be recovering the password using the email. Then again, the email was invalid.

Then I headed to bitcointalk search box and tried searching the account user name, it showed up and indicated that it was last active this morning, and proceed to show last posts and noticed that the new owner is making use of it by participating in signature campaigns and social media campaigns, and probably hacking some forum users. This individual is impersonating me and in a way ruining my reputation since I am not well aware what he uses the account for. 

Enough about that, let head over to the forum security now.

After I released that the account email and passwords were changed, I then headed to my mailbox, searched bitcointalk on the search box to find out what really happened, and guess what happen; this happened:
https://i.imgur.com/tEfWDCy.png

This is what was happening, the bitcointalk team was telling me that the email has changed. I mean, what happened to " Confirm that you are changing the email by clicking this option? Even a site that was built a day ago has that.

The admin should do a better job in securing the forum because at the moment, I don't consider it safe, how can users not confirm the emails addresses they are changing? instead, they get a notification inform them that the email changed whereas the user didn't change it. Sometimes, we take more than month without accessing the forum, so the 14 day notification doesn't do much- look at me now.

Now my Snr Member account is hacked, when will I rank as senior again since they have introduced this merit system?
Please do something about this, there have too may complain regarding hacked account.

This is my email looked before the hack - 1 November. Bitcointalk PMs:
https://i.imgur.com/zOisUw3.png

That is exactly what I'm saying. There's this system where you "stake" your bitcoin address, meaning you post it in a dedicated thread and with that you can prove ownership of the account, such a flawed thing. Nobody promotes that, until I got my account hacked I didn't even know that existed.

Nevremind that, I've proven my identity with an Ethereum address, but who the fuck cares? You can find my thread in my profile, it's one of the only ones I've started.


Except the mods don't really give a shit, unless you use their shitty "staking" system, which they tell you to use after your account gets hacked.. Even then, it's a matter of chance and praying to the mod gods or some shit..

{
  "address": "0x47c3b73c1ffa061ae4a37c553780e426f883860a",
  "msg": "My account  has been hacked/lost. Please reset the email to . The current date is <10 January 2019>.\n-----BEGIN SIGNATURE-----\n<0x47c3b73c1fFa061aE4A37C553780e426F883860A>\n
-----END Ethereum SIGNED MESSAGE-----",
  "sig": "0xe89b163080156409be5fa1ceb2cdd8d5c01036558a18176e5939e2dde4deb739390f11951329c11194a76cf6522389453d3ce1aff0f416cbffa4ba1bbccd91c21c",
  "version": "3",
  "signer": "MEW"
}

What you are saying is that the after you clicked on the lock account link, you never got access to your account ever again?

No, locking the account is just a preventive measure, this way you will be sure the hacker will be unable to use this account for frodulent activities (scamming other users, posting links to phishing websites/malwares...)

You can recover your account by proving it is yours. You can read more about how to do that here: Recovering hacked accounts or accounts with lost passwords
You have to be patient though 

What you are saying is that the after you clicked on the lock account link, you never got access to your account ever again?

It's been 5 months since my account was hacked. Did the mods help me recover it? No. Could I recover it if I didn't use their "lock this account" thingy? Yes, the email was changed to a yopmail address.
They tell me to lock my account if I didn't authorize the changes and then tell me you can't prove ownership of this account after I fucking proved it? Fuck that.

They don't give a fuck for us, what happened to BTCTalk 2.0? Supposedly, that was supposed to be better and more modern, I hope more secure, but that's dead now it seems.

Give me some security features, we need 2FA, especially in this crypto world.

Yes, blaming other doesn't help and I mainly blame myself for not securing my account better, but the mods are offering a feature that they're not willing to enforce, can't blame myself for that.

Yeah, you should blame the admins so your account won't be recovered and get ignored as long as you live. But even if you can get patient enough and wait until theymos for a year he doesn't even read a single word to your thread though.

Email confirmations don't help to reduce spammers (or just a little) since bots are usually coded to verify emails as well. But an email confirmation to authorize to change the email is more convenient. (And not after like it's currently) I know people say "what if they lost their email box access" Well you can't hold hands with everyone like you do with children.

Requiring confirmation from the old email is not a good idea for the reason already mentioned.
Asking for password reentry to change the mail address would be good. If you have left your browser open where other people could have access to it, then it gives an extra measure of protection. Requiring a signed blockchain message for an email change could be a good way to stop this type of hijack.

Requiring email confirmation on signup is also good to help reduce spammers. It doesn't help in this case, but I believe it would be beneficial for the forum.

{reply crafted before the previous post was submitted}

You should definitely blame the admins, as do I. My account was hacked this summer, it had a secure password, but this forum is not secure at all, there's no email confirmation about changing the email address, no 2FA and what grinds mt gears is "If this change wasn't made by you, lock your account".

I clicked that link, and now both the hacker and I are locked out of my account, I had a thread active for more than a month, a few high ranking members verified that I'm genuine, but no, the admins don't give a fuck.

It took me more than a year to rise that account from the ground, 750+ posts and 101 merit, that is not easy to attain right now.

Yeah, you should blame the admins so your account won't be recovered and get ignored as long as you live. But even if you can get patient enough and wait until theymos for a year he doesn't even read a single word to your thread though.

Most likely your account didn't get hacked. It is far more likely that your password got phished by visiting one of the several clone phishing sites.

Apparently, my account got hacked on the 1st November by the unknown hacker for unknown reasons.

First of all, my password was secure atleast with 3 capital letters, 6 numeric numbers and the rest was just small letters.

It came as a surprise when I tried logging just now, but I was unable due to the unknown hacker my account. The next move that anyone would take after, would be recovering the password using the email. Then again, the email was invalid.

Then I headed to bitcointalk search box and tried searching the account user name, it showed up and indicated that it was last active this morning, and proceed to show last posts and noticed that the new owner is making use of it by participating in signature campaigns and social media campaigns, and probably hacking some forum users. This individual is impersonating me and in a way ruining my reputation since I am not well aware what he uses the account for. 

Enough about that, let head over to the forum security now.

After I released that the account email and passwords were changed, I then headed to my mailbox, searched bitcointalk on the search box to find out what really happened, and guess what happen; this happened:
https://i.imgur.com/tEfWDCy.png

This is what was happening, the bitcointalk team was telling me that the email has changed. I mean, what happened to " Confirm that you are changing the email by clicking this option? Even a site that was built a day ago has that.

The admin should do a better job in securing the forum because at the moment, I don't consider it safe, how can users not confirm the emails addresses they are changing? instead, they get a notification inform them that the email changed whereas the user didn't change it. Sometimes, we take more than month without accessing the forum, so the 14 day notification doesn't do much- look at me now.

Now my Snr Member account is hacked, when will I rank as senior again since they have introduced this merit system?
Please do something about this, there have too may complain regarding hacked account.

This is my email looked before the hack - 1 November. Bitcointalk PMs:
https://i.imgur.com/zOisUw3.png

Account 'FrankNoland' was banned on the 7th December 2018, as you can see on bpip.org.

https://i.imgur.com/lUCeMdi.png


The last owner of the profile 'FrankNoland' also said about it.

The account is hacked not banned

Hello. Today my BTT account was blocked, I didn’t break anything, why was my account blocked? thanks for the answer

https://bitcointalksearch.org/user/franknoland-1000883 (FrankNoland)

When I said you are naive , there is a reason.Look  how badly you mixed all the quoting in above post. (https://archive.is/72Chr)

Coming back to your questions in that post.
1. Which account is banned?

Your account is banned that you are talking  in previous posts

You can check in bpip : https://bpip.org/profile.aspx?p=FrankNoland


2.I hope you got paid to write that, what a bad joke it was

I think you got worst joke, hacked + banned account.

He is the link to the account: https://bitcointalksearch.org/user/franknoland-1000883

@OP.

My argument is based on the fact an email address was changed without letting the owner confirm it, it can be referred to as unauthorized change of ownership. In this case, everyone's account is at risk, including the admins.

- 1 XAU: Find the email address of user DefaultTrust and explain in detail how you did it.

Now my Snr Member account is hacked, when will I rank as senior again since they have introduced this merit system?

My argument is based on the fact an email address was changed without letting the owner confirm it, it can be referred to as unauthorized change of ownership. In this case, everyone's account is at risk, including the admins.

- 1 XAU: Find the email address of user DefaultTrust and explain in detail how you did it.

Why would you need this option? I mean clearly if you are not the one who have changed your email then you would only need the link provided in the email which lets you lock your account for recovery which they did. If you are asking for the "confirm that you are changing the email" option you are only giving the hackers a favor for you to fuck up your own account. I don't know why you are putting the blame to them as clearly your password has been obtained by someone from your computer, my advice is if you have any desktop wallets in your pc you should transfer the funds before nothing is left from your compromised pc.

Although i don't exactly agree with your proposal regarding the "confirm email" "problem", i do think that the forum can definitely improve on a number of things, and is HEAVILY lacking on certain features in comparison to other forums.

When you are spending most of the time with emails,why you didn't check it.I am just said because here no fault from the admins its just how the system works.

And also we have recover method for hacked accounts here : Recovering hacked accounts or accounts with lost passwords so you need to follow the instructions and wait patiently in the long queue.

You should at least post the link of the account in question so if your claims are concrete the account can be red tagged

And also the forum has a security measure that it is before an email can be changed in the forum the password to that account must be provided so who ever has your account provide your password.

You should also take part in the blame you must have lost your guard

Requiring confirmation from the old email is not a good idea for the reason already mentioned.
Asking for password reentry to change the mail address would be good. If you have left your browser open where other people could have access to it, then it gives an extra measure of protection. Requiring a signed blockchain message for an email change could be a good way to stop this type of hijack.

Requiring email confirmation on signup is also good to help reduce spammers. It doesn't help in this case, but I believe it would be beneficial for the forum.

{reply crafted before the previous post was submitted}

What I can see on this thread is some big time quote abusers most especially the first individual that replied who had no reason what so ever to quote the OP whole post when he or she is directly under the post

Post quotation when abused can create an ugly scene especially when the guilty party do not really have something tangible to contribute

This has never been in place, and by registering on the forum you don't even have to verify the email. If you had a problem with the security of the forum you could've brought it up. Many have, though. The new forum software will likely have some sort of 2fa authentication so there's that. However, no one really knows when that's going to drop.

That being said. Have you got a signed address? If you have you can start the recovery process, and in the mean time get DefaultTrust to tag it so it's basically useless to whoever hacked it.

Because people, generally, set a new email address when they lose access to the old one, thus sending you an email to the old address asking for confirmation is kind of stupid.
With that being said, I think instead of sending a link to lock the account, they should give you the possibility to refuse the new changes and keep your old email address.