Topic: Why changing the email and the password is so easy !!!! (Read 543 times)

Well, then this is not for you like I don't feel like staking my Bitcoin address would be something that would be beneficial to me. Especially if I have to wait for long periods of time for my account to be reinstated. But I believe that lots of users in this forum would be relieved to have that option. You want to remain completely anonymous, okay, I get it. I'm not suggesting a mandatory security measure here. I'm suggesting an option that would benefit me as many other users who prefer to lose part of their anonymity in favor of not losing their account and frankly, I don't know why we keep circling back to the issue of anonymity here. Privacy should be people's right, and to me this means they should be able to give some of it away if they wish in exchange for something more beneficial to them.

Just remember one thing: high rank account in this site means money. We can debate this as much as you like, but this is the reality.
High rank accounts are monetizing their position and some of them gain quite a lot from this forum.
So security must be increased. Having only a user/password pair is way to less for current online security.
You don't like a phone number, that's fine. i wouldn't choose such an option either. But something must be done.
I said 2FA, there are concerns about google authenticator, but there should not be. You don't need a phone to generate google codes.
If needed I can explain how you can do it without a phone or how to recover seed codes from google authenticator app  on android.
I'm quite sure there are other possibilities too, only the will to implement them is required.

This totally ignores one of the most important arguments against it: privacy! At best, I could use a prepaid number, which means I have to add balance at least twice a year. If I forget it, I lose the number, and thus access to my account.

It's the opposite for me. I still keep my first e-mail address, although now I have others, and my phone, even though it's obviously not the same device, still has the same number that I had in middle school, which was ages ago 

Which is why I don't understand why it's an inconvenience to have your account linked to your phone number. I've lost phone devices and then I went with my ID to my cell provider and simply got a new SIM card with the same number and a new phone. It's certainly easier than asking some moderator to recover my account and wait for I don't know how long for this process.

Now, 2FA, that can be a tricky one if you use Google Authenticator. I haven't lost a device recently, but I know that if you lose your phone which has the 2FA app, you're screwed. But there are other 2FA apps out there.

Which is why I think that the best solution is to simply verify via SMS and link the account that way. Again, because some people don't listen, I think that this should be an option and not mandatory. When I referred to it as a solution to spamming I was talking about another thing entirely which would require a much bigger conversation and frankly, I don't care much to have it. I'm lazy 

That's now what I tried to say. I'm simply asking that before you can change a critical part of your account (like email or password), you should receive an email at the current email address and you have to confirm that you really are the person who initiated the change. That means to click on a link or get a confirmation code in the email. Without using that link or confirmation code you should not be able to make the change you want. Of course it is possible that you don't have access anymore to the current email address, so an alternative way of confirmation should be available (a second email, sms, phone call, 2FA code). Sms or voice call are not something that some people would want for lack of anonymity, but the other 2 can be safely used from this point of view.

A staked address is a very easy method to offer this protection, although I do agree account recovery often takes too long.

I've had most of my forum accounts longer than most of my phone numbers and email addresses, and this forum account has already outlived at least 2 of my phones (although not my phone number). I consider losing my phone much more likely than losing access to my account, and in that case it will only lead to more support requests.

Friend, if I had a merit I would have given it to your post 

Forum was created in a period when bitcoin was probably the only coin available. That times are over.
Most of the people nowadays use bitcoin (if they even use it, because there are other alternatives)
only as a meaning to an end: to convert altcoins into fiat. And for that you don't even need a personal wallet,
the one(s) from exchange(s) is(are) more than enough for the purpose. Asking for a signed message with
bitcoin address as the only way to be able to recover an account seems rather archaic and leave a lot of people without a real option.

2FA is the way to go. It doesn't need to be phone connected, there are plenty of other alternatives.
Any TOTP code can be obtained on any computer as long as seed is known; you don't need a phone for that.
Also asking the user for confirmation before doing a critical change to the account should be mandatory.
That means at least sending a mail with a confirmation code. That's minimum security, any site has such an option implemented.

i can be more agree than that

you can add this option too :

 delete the personal security question , because even if we answer correctly to this one, we are locked for manual review.... and we wait we wait we....

like me here https://bitcointalksearch.org/topic/almost-1-year-hero-account-locked-please-unlock-i-have-many-proofs-2851296

Mate, are you serious? I have a lot of altcoin wallets, just no Bitcoin wallets. I didn't know it was a prerequisite to have a Bitcoin wallet to be able to regain your account in bitcointalk after someone has hacked it, maybe it should be on the registration page. In fact, even comparing the two, having a bitcoin wallet and a phone number, makes you look like a fool. What percentage of the world population has a Bitcoin wallet and is it bigger than those who have a phone number? Even assuming that because I don't have a Bitcoin wallet I actually keep Bitcoin in exchanges is idiotic since I never even suggested such a thing. Bitcoin is the way to exchange my fiat into altcoins and vice versa but of course, someone so stuck on Bitcoin would never understand that  

Again, my PS was just a suggestion, to be considered. I already told you that. The logic failure is yours. I already told you that linking an account to a phone number would be beneficial to me and many users in here. Just call us dinosaurs for having a phone still, I don't care. The truth of the matter is that this is an easy way to prevent account hacking. Whether it can actually benefit the moderators from lowering the number of spam accounts, requires a bigger conversation. I believe it can. But I am talking about two separate things here and there's a reason I suggested it as an afterthought, which you just don't want to or cannot understand. That's okay. Not everyone can understand the way I'm thinking  

"The Bitcoin Forum is for users of Bitcoin"

That's a load of crap and you know it. Just check the number of posts in the altcoins section. I don't come here to read news and analysis about Bitcoin, I come here for the altcoin section. And if there was a way to make a poll about the reasons people are in this forum, you'd see that despite the name, people come here for different reasons than that. Only people who have yet to scratch the surface of this forum think that all these users come here because of Bitcoin. Are you one of these people  

Edit: LoyceV, I will give some thought to your suggestion on the matter of the paper wallet. However, I believe that a forum such as bitcointalk should offer its members some sort of extra protection. I've been in forums that have 2FA as an option and they're definitely smaller than this one, so I don't know what the big deal is about doing this or having the option (again, I'm suggesting it to be optional) to link your phone number to your account to make sure it's not easily hackable.

I wouldn't like to see 2FA added, it's another layer that can fail and take away my access to the forum. Besides, there's another reason why phone or email verification is a bad thing: privacy! Theymos respects privacy, and privacy shouldn't be compromised for security.

I use KeePass (for Windows), KeePassX for Linux, or a different version for anything from iPad to Blackberry.
If you're not using one yet: get a decent password manager, spend a few hours setting it up for all your accounts (don't forget to backup the database!), and keep it updated for all new passwords you create in the future.
I'm pretty sure nobody will ever be able to brute-force my password, but I changed my password anyway after the forum got hacked (a few years back).

I regret not being more private when I joined here, but it's too late to change that now.

I have never in my life had any forum account compromised. It's entirely up to you to keep your account secure.

You can easily print a paper wallet, stake the address, and keep it secure in case you need it.

Neither did Satoshi Nakamoto, in this context.  Not that that would matter to one of the ovine imbeciles who exclusively keeps money on exchanges.  Baa, baa.  Do you even know what a private key is?  It is self-evident that you neither know nor care why private keys are important.


That’s not something to brag about.  That you think it is, says much about you.  But not as much about you as your attitude about private keys.

The Bitcoin Forum is for users of Bitcoin.  By definition, such people have private keys.  Those who don’t are serfs, living on a master’s estate and at his mercy.  As a serf, you should know your place, and never expect anybody to take your opinion seriously.  How dare you come on the Bitcoin Forum and complain that it’s such an imposition to have a private key?


Logic failure.  What you said was this:


How could that even try to solve any spam problems, if it were not mandatory?  I do not expect that spammers would “opt-in”.  Had you been advocating optional SMS “verification”, you would not have suggested it to be an antispam measure.

Well, for starters, I don't care if it's mandatory or not. Which is why I added it as a PS, an afterthought if you will, that the moderators should consider it. I would like the phone number validation to be an option, though. Most people have a phone.

I'm not sure a discussion over whether I am using Bitcoin or not is worth having with a person who doesn't have a phone.

Written from my phone  

That would do little against spammers who can easily avail themselves of bulk numbers for SMS; but it would instantly evict me from the forum.  Mandatory phone “validation”!?  It is reprehensible even to suggest that on a forum where many legitimate users, including Satoshi Nakamoto, exclusively connect(ed) through anonymity networks.

Fortunately, this has absolutely zero chance of ever happening here; and it’s a waste of everybody’s time for you to even mention it.


If you don’t control your own private keys, then you are not using Bitcoin.  Forgive me if I am underwhelmed by your opinions about the Bitcoin Forum.

The security mechanisms here in the forum are smart and forward-looking.
In the event, that an account is hacked here and the password / email address is changed, a link is sent to the old email, with which the account can be blocked.
Read this thread for further info:
https://bitcointalksearch.org/topic/m.23164732
In case, that the email address is lost, the email address here can easily be changed.
And it is easy to generate a Bitcoin address that can be staked here
https://bitcointalksearch.org/topic/stake-your-bitcoin-address-here-996318 and be used to sign a message. Just study the section "Beginners & Help".

To be honest, I find the security measures in this forum ludicrous especially if you consider that many accounts here belong to members who are trying to start or promote a business, whether that is a cryptocurrency coin/token or trading or something else. There's no confirmation e-mail even. At first, when I signed up I thought I had made a mistake in typing my e-mail and it had gone to a wrong address. There's no 2FA, no SMS verification, nothing... It's basically a hacker's paradise.

Staking Bitcoin address? Well, sorry that I don't have a permanent one. All my Bitcoin addresses are given to me by exchange sites so there would be no point. I think that the powers that be of this forum should try to look at this from the members' point of view. There's a huge chance that at some point many of our accounts will be hacked. I've seen it happen and I've seen the huge inconvenience it has caused.

So, please, if any moderator reads this, do not act defensively to my words. I only seek to protect myself and the rest of the members. Please, give us a second security measure besides our password to ensure that we'll be safer and that our accounts will not fall into the wrong hands. Remember, accounts in the wrong hands won't be beneficial for you guys either since these guys will probably sell these accounts to third parties of scammers or spammers.

PS: The phone validation would solve lots of problems with spammers in this forum. Just saying.

As of now they will send the push  notification to previous e-mail when the password and email address has been changed. However, you will be able to report the moderator hilariouscando and Theymos about account hacking issue.
OP mentioned would be good idea to secure the forum reputation from the hackers stealing accounts. After blocking and recovering and all a burden and extra efforts for moderators crew but implementing the Authentication push up to mail would better to secure everyone account.

Or directly take out the password and reset option under every account and implement the link 'change password' this should push reset link to concern email. For email, authentication link first to the old email and verification link to new email. This is also works better.

Actually, this works like this on almost all the forums in same way. I am not sure what protection is here for brute force attacks.

This is why I think user education is important.  For a forum dealing with what is now colloquially called “crypto”, only an astonishly small proportion of users are crypto-savvy.

One of my first thoughts on seeing anything Bitcoin-related is, “Why isn’t public-key crypto used for all authentication?”  Of all places, the Bitcoin Forum should lead with that!  If you use Bitcoin, you should also use PGP, at the bare minimum; and the attention brought by Bitcoin makes for an opportunity to introduce more people to what old cypherpunks call “crypto”, resulting in more security all-around.


Password crackers would beg to differ.  Most passwords are laughably weak.  The way you said that, I am guessing that that includes your password, too.


In this context, that’s the wrong attitude; it encourages people to give up and keep their security weak.  Yes, everything out there is broken.  The state of the industry is horrific.  Most people have bad security because they don’t care about security, don’t put any effort into it—and won’t pay for it, which is why the state of the industry is horrific.

I think the NSA could probably hack me.  I’m sure that forum account thieves can’t.  So much for “anyone is vulnerable”.

I think this actually might be helpfull because, new people don't know about signed messages until its too late and they got their accounts stolne, having a good or a bad password is not the issue, anyone is vulnerable to get hacked, and there is nothing worst than losing your account that you spend a lot of time on it.

Changing your password and email is easy. This is very convenient for email users. This will help us protect our privacy. If you feel your password is expired then you change it. Or sometimes you forget the password you can get back the password.

That means a randomly generated password of sufficient length, used only for this site and nowhere else.  May I suggest use of a good password manager (non-“cloud”-based).

You also need to prevent your computer from being compromised.  Accounts are not being hacked.  Users are being hacked.

There was discussion about it in the past but seems theymos didn't take care of it.
All you need currently to keep your account secure is very good password. There was a fact of hacking famous members too. I remember how condoras sent btc to one member (can't remember username) and lost it because account was hacked and real owner lose control on it. Condoras trusted blindly and didn't ask for signing a message. (I talk about loans)
Btw real way here is signing a message from your bitcoin adress which must be actively used here and then you need a lot of wait to get response on your pm from moderator, usually from Cyrus. There is another way to prove ownership if you can't sign a message but that will take a lot of time and won't worth for it (messages and etc for example).

What security weakness?  The users’ security weakness?  If you know of a security weakness in the forum, please report it and collect a bounty!


If a hacker knows the username and password, then there is nothing to hack!  That’s like saying that if a hacker knows your Bitcoin private keys, he can “hack” your wallet.


That would be extremely annoying, and of little or no use to users who know how to secure their own passwords.  Also, for Tor users, it would effectually mean an e-mail verification for each and every login.


I don’t have a phone.  (At least, not one that you or the forum will ever know about.)  What do you suggest I should do?


I have a better idea:

4. Choose a strong password, and keep it secure.

HTH.

I saw a lot of people here in Meta lost their accounts because of hacking, The majority are full members and senior members accounts, and sometimes Hero or legendary accounts. The problem is not on the signed message of the stacked btc address, but in the security weakness. I agree with the OP on that, because I already read a case like that. If the hacker knows the pseudo and the password of bitcointalk account, he can easily hack your account, and you can't do anything, Even the procedure of recovering the hacked account is too much hard, because Theymos and Cyrus take too much time to respond.

---

What I can suggest

1- Improve the bitcointalk account security using email verification when anyone login with a new device into the account.
2- Add a phone verification in case of login with a new device.
3- Add a new procedure for recovering a hacked account that doesn't take too much time.

Stake a Bitcoin address, and preferably, a PGP key.  (But n.b. that Segwit addresses cannot yet be used for this purpose.)

I think that current options for securing one’s account are inadequate.⁰  However, there do exist ad hoc ways to help protect your account.  If your account has any value to you, make the effort to do that—and also to improve your own security!  I’m sick of hearing about “accounts hacked” when, as far as I can tell, most or all (recent) such instances are matters of users being hacked.  I am not aware of any evidence that accounts are ever hacked, nowadays.


What about people who lose access to an e-mail address, but legitimately know their own password?

---

0. For account recovery purposes, users should be able to somehow bind a PGP key fingerprint to an account—either permanently, or with a long timelock.  I mean this as a forum feature with a form widget on the user profile page, not the ad hoc “post your key here” threads.  I would also add Bitcoin keys, but for the aforestated problem with Segwit addresses.

I also want some means of public-key auth login.  I began writing a long post for Meta about that more than two months ago, when I was more or less brand-new.  However, browser makers have made this infeasible by effectually deprecating functionality required for TLS client certificate usage by websites; and there are other problems with TLS client certs.  I also considered SSH tunnels, etc.; but I know realistically that has negligible probability of actually happening.

Some one tried to gain access to my account using the forgot password feature and I received an email, but I don't think you receive an email when some one gets access to your account and changes email /password /both. This suggestion of yours may or may not curb down the number of hacks but should be worth a shot.

No they don't get any notification when someone tries to access their account, they only get a notification when it's already too late and their email and password have been changed, and that's where the problem lies, they won't be able to know that they are being hacked.

Because there is no 2FA yet and the passwords that most users keep is just as terrible as their shitposts. Guessing the passwords are more easier when hackers have access to usernames. Poor security measures are the reasons why.

---

Slightly off topic :- When users sign in why doesn't the forum ask for email ids along with password rather than asking for username and password, because the latter only benefits the hacker?

---

Users do get email notifications when someone tries to get access to their accounts, right?

Recently my friend's bitcointalk account got hacked and unfortunatly for him he was not able to recover it, the hacker was able to change the email and password without being stopped due to the fact that bitcointalk system only sends you a notification mail to let you know that your informations were already changed, and the only way you can recover your account is by having a signed message which people only know about when it's too late, or by pming one of the administrators who have a busy schedule and probably won't reply to you even if you have a proof of ownership of the account.

What i'm suggesting here is to add another layer of security, so that when you want to change the email or the password, a verification mail would be sent to the current email and the owner would have the option to accept it or not and also know if he is being hacked.