Topic: PSA: ACCOUNTS WILL BE LOCKED IF THE SECRET QUESTION IS USED TO RECOVER IT (Read 4537 times)

If you made it now it is not that the question would make it vulnerable.  It is that there was a past security breach where the ones at that time were compromised.   So a security question in itself is not really making it vulnerable, but the problem is account's that have same security question now as time of breach.    It also becomes even harder with inactive accounts as chances of changing security question are none.

So the security question now locks to prevent compromise.   It is a pain for those who hit it but it is considered known now, and we really have a LOT less using security questions now then we did say in October of 2015.  If you look back there was quite a few more then say today it has went down drastically that more users know it locks account's.

It won't anymore, it will just be useless considering the account would just be locked if it were used.

What that quote is saying is about secret questions in general. Accounts only began to be locked after the forum was last compromised, as the secret questions and answers were leaked and could be decrypted to hack into accounts.

You can (can't you??). But you probably should not.

It will make your account vulnerable. (which is why the account gets locked to protect account theft when that is used to recover account)

You do not want to set a secret question. If you use it to recover your password your account will be immediately frozen.

Is this why I can not make a secret question? I would assume so, but I figured I would ask anyway I did not see it in this thread anywhere

Unfortunate typo as English is not my primary language.

I meant to say


It was originally set to display red text "You have a secret question set, this is not recommended" if there was a secret question set.



Only Theymos and BadBear have the technical abilities to unlock accounts.


I'm just a regular member.



~BCX~

BitcoinEXpress, cheeky question: Since you are able to make changes to the forum, are you also able to unlock accounts?

I was originally set to display red text "You have a secret question set, this is not recommended" if there was a secret question set.

If no secret question is set, you will not see this warning.



~BCX~

Unfortunately it is not a bug. A while back the user database of the forum was hacked. Logins were compromised. Theymos did it so the hackers could not get the password via the reset option. And they purposely kept it secret so the hackers would not know about it. They won't be turning it off. Just need to know or once you do it and get your account reinstated you will never do it again. But someone who did have a BTC address six months prior in a post or signature has no chance of recovering the account.

I understand that you can have it turned off, I actually had it turned off before, but thought I'd improve the security. I ment it's strange that the possibility of adding a secret question is still in there, if the feature is bugged and gets people locked out (for months).

I am not sure how robust of a solution this is. Not everyone is going to see this warning (or even visit Meta on any kind of regular basis), so they will not know to remove their security question and to not attempt to use it to reset their password to their account.

Thank you.

Yes

Blanking the fields and saving them will not lock your account.



~BCX~

Yes, that is how you disable the security question for your account.

Can this be done after the question is set by blanking them out and saving? I was already burned by this and had my account locked. It was frustrating, to say the least, to get my account restored many months later.

thank you for creating the thread to give information about it to every one..

There is.

Leave both fields blank in the secret question section.

It will disable it.


~BCX~

Thank you, I will do that. It just seems strange that there is no option to turn of the "feature" completely. There are a lot of people who don't browse the different forum sections and simply don't know about the issue. I won't forget it anymore though 

It does take patience in some of the cases it is kinda seen as a lessor issue with it being known I think.  It is hard to get info about it to every user I bump a thread I made in beginner about once a month - https://bitcointalksearch.org/topic/message-to-beginners-do-not-use-secret-question-to-reset-account-it-locks-it-1214627 .   The good news is overall it has slowed down a ton, it was multiple a day at first.   Now it's much much slower.

I would suggest starting your own thread in meta about issue though.   List user and problem about lock.    And then the patience part comes in, I would bump your thread and send email once a week.  I would not do it any more then that as you don't want to be a pain to admins. 

Be patient and persistent sending messages to Theymos. It took me about two to three months of a signed message a week before he finally responded and apologized for the late response.

Shit.....just got locked out of my account by answering the secret question. I can't believe they haven't taken this out or disabled it yet. I'm afraid I won't get control back of my "main" account for a long time....

I could be incorrect, but that might just be a glitch.

Thank you to the OP of this post. Using the instructions in the top post I finally got my Sr. Member account back after a month of sending signed messages every week as directed. Nice to get my account back.     

Got home and sent PMs a couple of days ago. I hope I can get my Sr. Member account unlocked. Would suck having to start all over building a rep here.

Yes, I meant posts, sorry. Posts over 1040 and Activity over 330. My locked account is a "Sr. Member." Thanks for pointing out my brain fart. Also a BTC address has been in my sig for about eight months or longer and it is from my Trezor. So when I get home from vacation I can definitely send signed messages with that BTC addresses' private key.

No, an activity over 900 would make you at least Hero if not legendary. You are refering to the number of posts I guess.


Yes.


It was meant to be hidden as long as possible, thus there is no warning. Sorry you have to go through this now.

My account just got locked today due to this stupid implantation of password reset by secret question. Had I know about this I would have just done reset by email. It is really annoying because it is a FULL MEMBER account with activity over 900. Today I had to make this new account so I could post. I sent an email to Theymos to the email address given when I was told my account was locked after trying to sign in after the successful password reset by secret question. I am on vacation so when I get home I can figure out which BTC address I have in the sig of my old account and sign a message with it. If they do not answer the email I guess I will use this account to send a PM with a signed message every week as the OP suggested until I finally get a favorable response. I wish I had known about this before resetting the password. Using the secret question seemed faster than doing an email reset. A warning on the reset page that my account was going to be locked would have been nice and I would have done an email reset to avoid having my account locked. Very annoying.

I don't think the secret question should be implemented on the new forum. I mean if it's been exposed to the hackers before then that might happen again. Well not with a much secure forum but then, anyway I just want the secret word reset to be fix because I sometimes find it handy specially in my case where I am very precautious in online security.

Why not try to address this matter on the new forum software? I think it will gain much attention there seeing that it is the place where discussions for what the new software could come up with, and afaik we can kind of request some features we like to see in the new forum.

I would say it is better to change OP to discuss "Do not have a secret question for your account. Why, and how to do it."

As QS said, I guess it is better to keep it a bit secret. Changing the title would help. Having a secret question for an account is not very useful.

One day there will be a "new forum" not sure on timeline of when we see updated forum.  I suspect then it they might possibly address it or remove it.

I think that chances of spending time programming on this forum to do it is slim.  Just have it in meta and people will know not to use it.

Well I think that is also for security purposes. If one gained access to your secret answer, then you know the rest: they can get access to your account. This feature should be removed imo so that things like hacking wouldn't be a that much of a problem when it comes to secret answers.

It does, you can't leave the email box empty. I also agree with the removal of secret question, why put something like that if it can lock your account, at least a warning like this should be available on the secret question page or new members may get themselves locked out while using this.

I would guess it's that the forum really does not check email when you sign up.  Some assumed  secret message was enough.   But after a while that big hack the secret messages were compromised. 

So now you really need to sign with a address used or something else to prove ownership.   Honestly everyone should stake a address

Why not just remove the secret question?
When the account is locked for security reasons you will have to sign a message from an unused address anyway

bump

Ok thanks. Got it removed.

AFAIK you just make sure that both text boxes for the secret question are empty. IIRC the answer box will have a red warning next to it when you have one set, when it isn't set, that warning should disappear.

I have a question, How can I remove the secirity question in my account? I already set another security question when I got back my account from previous lock. Thanks!

A staff member previously posted something similar to this, I spoke to them about it privately and they removed it.

This is not exactly the private keys to the forum's bitcoin, however it is a security issue. IMO there is really no reason to remove the thread now since this has been posted for long enough.

Thank you for letting me know this, ill remove my SQ now

Huh. I could've sworn I saw a post by theymos himself saying that accounts were being locked if the security question was being used to unlock them. But now I can't find any such post.

I suppose I will leave this up since it may help people who lock themselves out. If it's a problem and theymos doesn't want it up, he can let me know, or just remove it himself.

I believe it was secret because the answers to the secret questions were leaked when the forum was hacked, and this data was stored in a way that would be fairly easy to hash the data to get the plaintext answers. Since it would be so easy to hack accounts via secret questions, accounts would need to be manually checked by an admin prior to allowing them to have their password reset this way. It should have been a secret so people who were attempting to hack accounts would not know which attack vectors were not going to work, discouraging people to even attempt to hack accounts.

What I find very strange is how tspacepilot's account was hacked, or at least "hacked" and then so quickly restored by theymos with the help of dooglus. Especially considering how most of these requests usually take weeks.

I don't know. Ask theymos, he made it that way.

Why?

I made this since I always see at least 3 threads in the front page meta where people are complaining about being locked out of their accounts and they all tried to use the secret question to recover it.

So that is the reason why I locked myself before when I reset my account with the security question.So what then is the use if that feature if it can't be used properly? As for me I always want a secret question attached in all my accoints even outside this forum so I thought it's a good thing but then it's not. Why can't they just reset it all again anyway?

I think this was suppose to be a secret.

I dont get why it is still possible to use it as a lot of ppl lock themself out... or just wipe all q and as out so ppl have to put in new ones...

This is a Public Service Announcement:

If you lose your password, DO NOT USE THE SECRET QUESTION TO RECOVER THE ACCOUNT. It will result in your account being locked. Please use the email recovery option to recover the account.
The reason that the accounts are locked is because the May 2015 hack leaked Bitcointalk's database which did not securely secure the Secret Question and Answer. To prevent people from guessing the answers, theymos made it so that accounts that are recovered using the secret question are automatically locked when the option is attempted. This is to prevent hackers who may be able to guess the answers from the leaked database.

If you have had your account locked, to recover it, please send and email to the email displayed on your screen when you try to login. You can also create a new account and pm both theymos and badbear. In the email and PM, to prove your identity, You MUST sign a message with a bitcoin address that you have posted previously, at least 2 months prior. Please be patient. Theymos and BadBear are busy people. Your email or pm may become lost among all of the other stuff that they have to do. You should resent your email and pm once a week so that they will see it and get around to you. If you need help signing a message, check this thread: https://bitcointalksearch.org/topic/how-to-sign-a-message-990345

If you haven't lost your password yet or you have regained access to the account, don't set the secret question, it can be a hassle. Make sure that you have the email set to an email address that you can access. That will make everything so much easier and will not require the long recovery process.