FULL MEMBER ACCT locked because did password reset by secret question

mexxer-2

hero member

Activity: 924

Merit: 1005

4 Mana 7/7

Quote from: ptypichai on October 26, 2015, 12:25:41 AM

Quote from: achow101 on October 25, 2015, 11:43:34 PM

See the thread I made about this here: https://bitcointalksearch.org/topic/psa-accounts-will-be-locked-if-the-secret-question-is-used-to-recover-it-1206977
You will find instructions on what to do there.

Thanks for the info. When I get home from vacation I will do as you suggested in the linked thread. I have a BTC address in the sig so I should be able to send a signed message. I will send PMs from this account until I get a favorable reply. A warning on the reset page to do by email only to prevent locked accounts would have been nice.

It will not be so and this has been discussed in the thread knight pointed you to

Quote from: Quickseller on October 12, 2015, 05:47:11 PM

Quote from: achow101 on October 12, 2015, 05:37:13 PM

Quote from: Quickseller on October 12, 2015, 05:29:02 PM

I think this was suppose to be a secret.

Why?

I believe it was secret because the answers to the secret questions were leaked when the forum was hacked, and this data was stored in a way that would be fairly easy to hash the data to get the plaintext answers. Since it would be so easy to hack accounts via secret questions, accounts would need to be manually checked by an admin prior to allowing them to have their password reset this way. It should have been a secret so people who were attempting to hack accounts would not know which attack vectors were not going to work, discouraging people to even attempt to hack accounts.

ptypichai

newbie

Activity: 6

Merit: 0

Quote from: achow101 on October 25, 2015, 11:43:34 PM

See the thread I made about this here: https://bitcointalksearch.org/topic/psa-accounts-will-be-locked-if-the-secret-question-is-used-to-recover-it-1206977
You will find instructions on what to do there.

Thanks for the info. When I get home from vacation I will do as you suggested in the linked thread. I have a BTC address in the sig so I should be able to send a signed message. I will send PMs from this account until I get a favorable reply. A warning on the reset page to do by email only to prevent locked accounts would have been nice.

achow101

staff

Activity: 3458

Merit: 6793

Just writing some code

See the thread I made about this here: https://bitcointalksearch.org/topic/psa-accounts-will-be-locked-if-the-secret-question-is-used-to-recover-it-1206977
You will find instructions on what to do there.

ptypichai

newbie

Activity: 6

Merit: 0

Quote from: cryptosmoker on October 25, 2015, 11:22:29 PM

Did you ask whoevers account it was for their secret answer?

It is my account. I was traveling on vacation and forgot the password. The secret answer was correct and the password was reset. But I did not know until afterward that Theymos set the board to automatically lock any accounts with password reset by secret question due to hackers. If I had done a password reset by email the account would not have been locked. I only found this out afterward by searching the META section after my acct got locked. No warning that doing the secret question would lock the account. A warning not to do this on the reset page should have been there. It has happened to many senior members who did not know this was implemented by the board operators. It did gave an email address to contact Theymos for a possible unlock. Still waiting for a reply. I have a bitcoin address in the signature so I can do a signed PGP message to prove it is my account if needed.

cryptosmoker

sr. member

Activity: 581

Merit: 250

Did you ask whoevers account it was for their secret answer?

ptypichai

newbie

Activity: 6

Merit: 0

I have an account with an activity level of over 900 and I was a Full Member. I did a password reset by secret question and it locked my account. I did not know at the time that doing this automatically locked the account. It would have been nice if the password reset page said do by email, not by secret question because we will automatically lock your account. I sent an email to the email address the page gave when it locked my account. Still waiting for a response. Will someone eventually respond and unlock the account or do they ignore these emails forever. I am bummed that an account with a high rating got locked for something so stupid and the page should have warned me not to reset by secret question.

Topic: FULL MEMBER ACCT locked because did password reset by secret question (Read 413 times)