Topic: Security bounties - page 3. (Read 146817 times)

Bullshit offer.
If you are sincere in solving any security breach, you should seek paid professionals.

These people really seem to know what they're doing, and theymos keeps doing it despite stupid comments from people who blurt out whatever without doing any research about what they're talking about. It's nice to be on a forum that's so well run.

when will the Iron tank forum be released?

In case you didn't notice Theymos ...
It would appear that the email harvesting from the 2015 hack, has recently put the forum email addresses from back then into spam lists.
https://bitcointalksearch.org/topic/forum-database-compromised-1635595

Looks like you need to up the bounties and/or find someone who can be rewarded them

They do not.

Just asking regarding you mentioning mod-related vulnerabilities in the OP.

Mods don't have access to the server(s) that host bitcointalk, right? Only you and maybe Badbear?

Not in the USA and other relatively advanced economies. There the order was approximately:

196x) organization-owned mainframes
197x) shared rented mainframes (provider-owned)
198x) departmental minicomputers (back to organization-owned)
199x) personal computers (both organization-owned and individual-owned)

Also, I'm talking about broad industrial/commercial/academic trends, not about various niches.

Edit: added one more decade and ownership qualification

Some years off in that one...1970 was mostly punched cards.  I'd guess timeshared computer services maxed out in parallel with the first five or ten years of the PC.

No, we are in a time-loop. We went back to about 1970 when the sales of "time-shared" computer services were at their highest. "Time-share" term was later appropriated by the vacation real-estate salesmen, so the computer salesmen renamed their "time-shares" to "cloud computing".

But the bullshit stayed the same.

>> Are you telling me decentralization is better for scalability/performance at this point? Def not. Also interesting you are first for keeping IPs private but now you want a P2P forum?

My previous post is a set of ideas for theymos to think about, while he studies PHP and that "new" Javascript ...  
He can pick something useful from it...
as he tries to stay behind of time and progress, he maybe will accept some ideas at least  
So it looks eclectic and messed dish just bcoz i feed  conservators

>> Well for some people it's just about usability. But an optional option to only do (automatic, not manual like now) recovery by signing w/ a specific addy would be cool.

yes, would be nice to have different options for password recovery, tweakable in profile,
with safest option set on by default.

>> Not storing IPs def will be bad against spam / trolls / etc.

My point was : to store IPs and other sensitive info ( emails too ) in special separated storage, preferably in member's browser.
I did not say : "never store IPs !!!"

>> Seriously, "don't use passwords" is easier said than done.

Yes, not easy. But why cant we have a choice : power members can log in with keys, bitcoin addresses, good wishes etc AND just members can log in with passwords ?!
It can be done for sure.

>> Performance of decentralized forum software at this point will be very shit AFAIK.

the same will  be true for Epochtalk i guess. which is alfa, unaudited engine.
My point here was : if theymos will stuck with traditional approaches,
he will lose community due to aftermath of next hacks, social engineering "accidents" etc.
BTW we are now on Romania based hoster.
are romanian front desk guys safer when it comes to social engineering, than NL based ones ?!

Performance of decentralized forum software at this point will be very shit AFAIK. And usability probably bad too (gotta download client?)

You want people to sign a message with a bitcoin address every time they login?

Seriously, "don't use passwords" is easier said than done. Login with Trezor Connect would be cool though. And 2FA should obv be option.

Not storing IPs def will be bad against spam / trolls / etc.

Well for some people it's just about usability. But an optional option to only do (automatic, not manual like now) recovery by signing w/ a specific addy would be cool.

Are you telling me decentralization is better for scalability/performance at this point? Def not. Also interesting you are first for keeping IPs private but now you want a P2P forum?



Not disagreeing with all points, but some things are easier said than done

of course i was joking about dedicated server in basement.
such setup will have issues with load balancing and speed of connection likely.
also it will be stil centralised service.

If theymos wanna save his income and keep community here,
he should :

i) invest in decentralised forum software, or some day such forum engine will become reality,
 but not under his control, written by other guys.Community will switch to it after next couple of hacks here.Theymos must be smart and proactive

ii) make sure to have auth of members without passwords ( maybe with bitcoin keys or other virtual identities ).

iii) never store hashes and IPs in Internet-hosted DB.
     take a look : https://unhosted.org/

iiii) abolish email usage for passwords' recovery ( there are safer means of communication ).

iiiii) drop "security question checking" feature for password recovery.

If Bitcointalk will stay centralised, what will happen when next bubble of greater adoption will arrive ??
How many members can bear 1 forum engine ( SMF or Epochtalk ) ??

At least theymos should go to several federated servers for forums...
I am not sure what is the year right now for theymos and team ?!
Are we really in 2015 ?!

If I may, the main problem with security vulnerabilities is our lack to understand that most of them are based on breaking some very simple rules. For instance, anyone who has the ability to physically access my computer is -in theory- able to retrieve ANY password that I have stored inside my web-browser and/or key-chain. You may be now thinking "oh, this is not possible" but please take some time to use some good UN-delete software together with a web-browser password retriever utility and most probably you will get the job done in less than 10 mins. Brute forcing is another way, but will take more time.

@Theymos:
It's been sometime now that I thought about the possible attacks this (and similar) sites will get within the next BTC bubble. I expect this will get much worse. Restricting user access via Tor blocking (I know this will hurt me as well, because I'm using tor from my work to access the site) will definitely rule out some of the most significant attacks. Cloudflare is also a way, but I'd go for a dedicated person(s) service. You can hire one that you trust, most possible near where you live. This would've been the best case scenario I'd choose, if I were you.

Best of luck sorting this out.

to kill all "social engineers" theymos must host forums in his basement
 on dedicated server with fat connectivity.  
Problem solved !

Time for social engineering to be added as a valid attack?

Do you release information about vulnerabilities once they're fixed, or is obscurity safer in this case?

Thanks !

The only major flaw in this forum that I can see is that you are using SMF as your forum software. Can't wait until the new platform arrives.

I've sent a pm to theymos, I hope he doesn't miss it
(it's not a code hack etc.)

I was meaning to raise awareness about people using different characters to make their usernames visually similar to some trustworthy members on bitcointalk.
Example: ṣatoshi, theymoṣ, ṫheymos etc.*
Why not limit the charset to UTF-8, and maybe some non-visually interfering symbols?

*As of yet, there aren't any usernames containing the characters ṣ and ṫ, but I could compile a list of such characters just to show how easy it is to try and register such a username.

It's not covered in this bounty, but I'd probably pay a little for info about some bugs of that sort. Some things (like various ways to visually defeat prohibited strings) are known bugs that aren't likely to be fixed.