Topic: Forum account: security, privacy, and recovery (Read 963 times)

It is. I don't catch people thoughts that how they thought and made decisions to leave all information in one place. Here, on profile page. Facebook, with their real names, phone numbers, locations, and more things.

Some people leave their bitcoin address on their profile page or personal text and I won't surprise that they reuse that address many times.

No sensitive information should be displayed or be obtainable by anyone visiting your profile link. Skype or emails connected to your real name. Even a website link that leads to your personal website where you might have posted about yourself, where you live, work, or a photograph of yourself, your house, etc. Links to social media can obviously also be abused if someone targets you.

Key principle to keep identities and accounts away from threats is store those details offline.

It does not make any sense if you set up a very strong password (long and complicated) but you save its details on Google Drive, Dropbox or on the devices you use with Internet connection every day.

If want to store those details on digital devices and digital files, do it on offline devices (as less connection to Internet as possible) and encrypt the file with strong passwords.

Some password managers can help:
https://keepass.info/
https://play.google.com/store/apps/details?hl=en&id=com.android.keepass
https://pwsafe.org/

[GUIDE] How to Create a Strong/Secure Password
https://protonmail.com/blog/protonmail-com-blog-password-vs-passphrase/
Good topics on security and privacy (no password managers or softwares can protect you if you have bad websurfing practices)

Also worth noting, the majority of the time security breaches are because of the person behind the screen, and not the software. Since, usually its easier for a attacker to target someone who has weaknesses, and only one mind, than to attack software which has been out for years, tested by thousands, and being actively developed. I'm not saying that software isn't targeted because it most certainly is. This is especially true, when it comes to privacy. There's a lot of software which is specifically designed to keep your privacy in tact, but its usually the end user which compromises it by misusing the software, or simply by making a mistake.

So, although its always best to take security seriously, and follow the advice of the experts, you should be taking precautions against your mistakes that can creep in through complacency, which is something privacy, anti virus software, and security measures can induce by giving an illusion of safety.  

Finding the balance between security, and user experience is difficult. Depending on your user base, some might require strict security practices, where others may find convenient ways of retrieving their accounts beneficial if they so happen to lose the account. Without being too stereotypical, this is quite common in the older generations, where they become forgetful of their credentials, or simply don't want to go through all the security protocols to retrieve their data. As far as I'm concerned a security question is a flawed design, because of the way its presented. A lot of websites do it far worse, and make you choose between a predefined question, which means its usually asking a personalized question such as "what was your first pets name", now you could do a random answer length should be treated just as important as a password though), but usually people find this convenient to remember, and put in their actual data, which is usually easily found out with social engineering. Especially, of the age of social media where pretty much everyone documents their life, sometimes without even realizing the data they're presenting to the world.

OcTradism
You should encrypt sensitive messages. As you know, we also use cloudflare, so, this is a must.

Btw since the secret answer is no longer considered and is even play with death, why do we still have it and why wasn't it changed? Despite the fact that I highly agree and confirm that it's our responsibility to take care of our accounts and there is no need to blame others for your mistakes, I think additional security wouldn't be a bad, especially for those who are very sensitive regarding this and prefer an extra layer of protection.

But first of all we should integrate this rule: Don't Bring Me Problems, Bring Me Solutions. This applies to me at the moment but I'll think around it and maybe publish my opinion.

You can recover your account if you stake a bitcoin address or your bitcoin address was posted and quoted and you can sign a message from it after the hack of your account.

You will receive email notification from the forum if your posts are deleted as spam, zero value, off topic but you won't receive notification if the thread in which you post is moved by moderators to trashcan.

Your email will be flooded with notifications (3 to 4 thousands of notifications each day: https://btctalk.live/today/) and I don't think you need them. You can edit your Watch List, Watch board with https://bitcointalk.org/index.php?action=watchlist

It's quite necessary to set up your forum account privacy and security in such a way it won't get temper upon.
It's painful to lose an account after years of building it.

Are there ways to set up your forum account by getting notification of every new post that comes in this forum through an email address?

I agree with you about the Brave browser.
But also, for those who can and want to figure out all the privacy settings on their own, I would like to offer this guide for configuring the Firefox browser.
I have been looking for an up-to-date guide for a long time, with a more detailed description of all the actions that are proposed to be performed for the browser to become the most secure safe browser. And in my opinion, this is one of the complete and detailed tutorials.

https://12bytes.org/articles/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs/

I'll highly recommend against using Brave, and personally I would probably only recommend Firefox. For one they aren't owned by Google, which I consider a privacy breach in its own right, but in my experience have been the stand out guys from a security point. There's a reason why Tor Browser is built inside of Firefox.

I'd also always recommend using a offline, local password manager rather than those built inside extensions, or the browser itself. In fact, I'd avoid installing extensions almost all together. The exceptions would probably be; No script security suite, https everywhere, and an ad blocker like Ublock Origin.

Good point, but IMO it's still better than Chrome when you need to visit website that only works properly with Google Chrome, if you disable ALL annoying feature (BAT reward, exchange widget, etc.).
But i would use another browser based on Chromium such as https://github.com/Eloston/ungoogled-chromium.


If you plan to use Tor, you better use Tor Browser.

Brave browser is not good as they have claimed to be since their start. They arbitrarily require KYC and implement shady things. Their reputation is damaged from their shady developments. I don't recommend Brave browser. If need privacy protection, do it by using Tor browser (the best) or FireFox.

Brave browser hijacking links and affiliate codes!
[SCAM]Archive.is has stopped supporting Brave Browser

The Brave browser also has "Tor mode", you can add it to the description if you like.

Yes, that is a good idea to secure account here in btc but for us low ranks would not mind doing it for now because anyone can rank up to member. Getting merits seem to be ready and available witg merit source around. There are merit giveaways too so whenever low rank account gets compromised then one could start again by registering another account. But, whenever one reaches full member to legendary then securing account should be a good practice. Anyway, I see that bct has strong security features and that only few account gets compromised by being unmindful acts of a certain user that lead to disclosure of his account important details like email and password.

This post from Welsh is very good for your forum account's sensitive data in PMs. I think everyone should spend time to read Welsh's post and check PMs and delete PMs that have sensitive information.

If your account unfortunately is compromised, you will not lose your sensitive data in PMs if you delete them. PMs will be only deleted all if sender and all receivers delete them all. It is difficult to ask receivers delete PMs in their conversations with you but you must do it from your side.

• I'm not sure I got your question, but recovering accounts involves sending a mail to the recovery address and it's preferable if it can be sent from the accounts email address;.

---

• It's is not always enough, a signed message is the preferred proof of ownership, but depending on the situation it may not be required;

The best should be a mix of:
 Email was used to register account.
A Bitcoin signed message that was quoted or staked before.
And maybe more things, secret questions, IP addresses, some more things that admins, Cryptios team can ask you to prove account ownership.

This is really helpful for those people who are wondering about the security of their account in this forum.
It is really not that easy to recover an account once its lost, you really need to undergo a lot of process which is very hassle.

Thank you for this @OcTradism, this could help a lot of users here.

One question. Is it much better to recover an account if the email that you used in your lost account is your personal email? Is it enough to prove your ownership?

I don't think admins or the recovery team will consider signed Ethereum addresses when proving ownership and recovering accounts. They could, but in that case people will start asking to sign messages from other altcoins as well.

According to theymos:
One might ask, what those rare situations are. But it doesn't cost anything to sign a message with a Bitcoin address so there is no sense in experimenting with alternatives. 
 

My main concerns is security and privacy and the weekend I have time to learn more about them. The thread is born this way, in the weekend.

---

Table of Contents

• Security
• Privacy
• Recovery

---

Account security
You can visit the page in 2 ways:

• Profile - Account Related Settings (for password, secret question) / Forum Profile Information (for birthday, location, gender)
• Use the link

Since December 2023, 2FA is deployed and you can activate it for your account, to secure it better. Make sure you do proper 2FA backups with Shared secret (Base32) that is used to activate your account 2FA. You will need it for importing your account 2FA on another device.

• 2FA added
• [Guide] How to use the 2FA feature on Bitcointalk

Password
On the forum, there is a reminder that emphasizes the importance to set up a strong password. Copy and paste the link: https://bitcointalk.org/index.php?action=profile;sa=account. You will see the reminder.

Quote from: Pucielo on July 11, 2020, 04:26:01 PM

Or how to return account access to this mail xxxxxxxxxxx?

Your Bitcoin Forum ([Suspicious link removed] to xxxxxxxx by IP address xxxxxxxxxxx.

Birthday: set it up and have a birthday cake each year but you should not set it up or if you set it up, you should not use your real birthday. The same rule for location and gender.

Where to set it up?
There: copy and paste the link: https://bitcointalk.org/index.php?action=profile;sa=account
https://bitcointalk.org/index.php?action=profile;u=mysuerid;sa=account, replace myuserid to your userid.


Stake an address
Stake your address to use it as proof of account ownership later.

Which address is used to stake?

• Bitcoin (first priority)
• Ethereum (don't think of it if you can sign a message with Bitcoin wallet).

Ethereum address can be used too but you should always prioritise Bitcoin for your signed message. Additionally, backup that wallet and secure your backup. In future, if your account is hacked, sign a message to prove ownership (from that wallet) is a good evidence to recover your account.

How to sign a message? See following guides
Stake your Bitcoin address here
How to sign a message?


Check seclog and myips pages frequently
https://bitcointalk.org/seclog.php (stores data each 7 days and will be overwritten with new data)
https://bitcointalk.org/myips.php (it does not make sense if you always use Tor)



Account privacy
Your logged IPs for the last 30 days: https://bitcointalk.org/privacy.php

Choose the Limit IP retention for your personal favorite privacy level. Read the About privacy to have more guide details.

Quote

. If you choose it, your Full IP will be stored up to 6 months.
Limit IP retention:
Reduce the retention of your future logged IP addresses. This will make it far more difficult to recover your account if it is ever stolen; make sure that your email address is correct and that you have staked a public key.

Account recovery
Please bookmark those threads and read them at least once to have knowledge on how recovery process works. And use them just in case your account is locked, hacked, frozen, etc. Follow those guides to recover your account and you have to be patient.

• Account recoveries are moving again
• Recovering hacked/lost accounts
• FYI: "ownership change queued"
• Cryptios (the recovery team can help you).