Quote from: jimmychanga on July 24, 2018, 11:43:56 PM

On May 19th my Bitcointalk account was compromised via bruteforce, However it wasn't until July 9th 2018 that i found out as i'm not very active on the forum.
What surprised me about this situation wasn't that i was hacked but rather how EASY Bitcointalk made it for the "hacker", I'll elaborate.

Why does Bitcointalk offer NO security when it comes to its users accounts?

Since the beginning of the internet websites have always required the account-holder to verify ANY major changes to an account ie; password change, email etc.
Apparently Bitcointalk doesn't seem to require any verification of account changes, I mean sure we have the option to lock the account within 15-days of the changes happening
but that doesn't do much in my case or in the case of any casual member of the forum who doesn't realize until weeks after the fact.

See: https://gyazo.com/5a2dd6d9504e4af5acd5e0450edd0869

Your account recovery process is trash, Why?

I contacted Theymos on July 9th explaining what happened and how the hacker was attempting to scam the community via an ICO crowdsale, Received no response so i then reached out to Cyrus and still have not heard from either of the forum admins 2+ weeks later.

I'm aware i'm not the only one whom this has happened and it isn't as if my account was Hero/Legend status but when someone is attempting to scam your community and you as an admin are given weeks heads-up notice and don't even bother to read the message, Its concerning for the forum overall. I'm a member of several larger internet boards and they don't really seem to have this problem so what are the admins of Bitcointalk doing?

Recovery Method?

So in order to recover a stolen account we must supply admins with Bitcoin Address or PGP Key related to the account, EXCEPT none of which was REQUIRED upon signing up.
Why not make it clear to members that they MUST supply a wallet address or PGP key and/or store it somewhere as backup incase they're compromised?

In my case i used hundreds of different wallet addresses and never PGP signed my account that i recall.

With all the posts about accounts being compromised you'd think that there would be an urgency of sort to assist users of the community, Instead the entire procedure and account safety features seem rather moot.

OP , you can put a good heading for this topic .

Anyways , look like that forum policy makes hacking favorable. Instead of asking user to confirm the change email in the current email , they are changing the email and asking the original user to lock its own account.

No body knows how much time recovery takes.

Admins, should not allow change of email and passwords until it is confirmed on original/current email associated with the account.