This thread, and newalias’ growing list of negative trust feedbacks, are classic security theatre like the American TSA confiscating nailclippers from grandmas in wheelchairs. Bruce Schneier should give out some beatings here.

https://www.schneierfacts.com/

IIUC, it is a fan site not affiliated with Bruce Schneier.

Quote from: sandy-is-fine on Today at 04:26:09 PM

@nullius I think you have too much faith in the goodness of humanity. Cheesy

Of course you may be right but you have to look at where you are and what often goes on around here and in this world (forum world not geographic world).

Or perhaps I have less faith in humanity, especially on this forum. No good deed goes unpunished, as the aphorism goes. The guilty get away scot-free—I have seen it happen many times on this forum—while the innocent get burnt at the stake.

Indisputable objective fact: Having a “secret question” set is dumb. The users mentioning publicly that they received this PM are declaring to the world, “I do not know how to secure my forum account; and I do not read the forum UI warning which says, ‘Using this feature is not recommended.’”

Quote from: nullius on Today at 08:48:42 AM

Sorry to be so blunt, sandy-is-fine. You seem fine, although you should probably stop using that insecurity misfeature. Some others are getting on their high horses, making ridiculous statements, proclaiming sanctimoniously (and quite proudy as to their own smarts) that they caught the evil hacker. WTF? This would be the most moronic possible way to hack the forum: Notify people who have weak account security, and give them good advice about how to improve.

“Faith in the goodness of humanity”? The booby prizes for extreme stupidity thus far go to BitcoinGirl.Club...

Quote from: BitcoinGirl.Club on Today at 10:03:38 AM

Check the username. Does it remind you the user alia? A girl back in 2017 - 2018. She was having everyone's attention. Then caught on planning for scam before resting in peace. Someone is having fun.

...and to three of the four DT red-tags that newalias has thus far accrued:

Quote from: https://bitcointalk.org/index.php?action=trust;u=2705337;dt

Trusted feedback

greenplastic	2022-07-07		*FUCK THESE FUCKING FUCKERS!! HA!*
uelque	2022-07-07	Reference	*Messaged me saying that removing bct account security questions will improved account security. Don't get fooled by this person. - probably trying to hack bct accounts!*
tweetious	2022-07-07		I received a threat via PM, that if I do not change my account security settings (according to their needs and guidelines), they will report me to the board administration.... "for our all safety" (LOL) There was also a mention that I HAVE TO "get back to me stating how you improved account security"....
willi9974	2022-07-07		*Sent me a suspect PM to change my account settings.*

Untrusted feedback

These ratings are from people who are not in your trust network. They may be totally inaccurate.

User	Date	Reference	Comments
nullius	2022-07-07	Reference	In re PMs about the insecurity misfeature of a “secret question”, read the reference link before jumping to conclusions. #2705337 “newalias” has some explaining to do, but negative trust feedback is premature—potentially unjustified.

Later than any of the above, Nestade left a DT “neutral” alert. It does not link to this thread. He seems to have removed it now.

At the time when I left my neutral feedback, the only existing negative (only received feedback of any kind) was from willi9974.

Quote from: willi9974 on Today at 11:21:48 AM

Hello nullius,

I have set the neg. trust as a precaution, so that other users see that there might be something wrong. Should the whole thing turn positive and the said user have only positive intentions, I will remove the negative trust very gladly again.

In the crypto scene, caution and skepticism is certainly not the worst thing and we old hands have to protect all the new users a bit.

Many greetings
Willi

Yours was more reasonable, but arguable. If it turns out that newalias’ intentions were non-malicious, I’ll remove my ~ after you remove or neutralize your tag. (If he was acting maliciously, then of course, I will remove my ~ and give him my own negative; but from available evidence, I think it is improbable.)

These will stay, because the trust feedback texts show extremely poor judgment:

Code:

~greenplastic
~uelque
~tweetious

uelque and tweetious giving bad security advice in negative trust feedback shows judgment at least as bad as greenplastic leaving a tag that says, “FUCK THESE FUCKING FUCKERS!! HA!” Oh, yes. That user is currently in DT. No wonder I love DT so very much.

tweetious called a purported intent to communicate with theymos about insecure accounts a “threat”. If that’s a threat, then threatening people is a virtue. He also sneers in negative trust feedback at what was actually good security advice—the same advice given in the forum’s profile UI!

uelque smugly implies that a misfeature, which the forum warns people against using, improves the security of his account.

What’s worse than a forum thread full of security theatre? Negative trust feedback security theatre!

Quote from: sandy-is-fine on Today at 04:26:09 PM

User in question recently changed email which can possibly also mean a hacked account. Do any of his/her previous posts have such altruistic discussions on protecting all of Bitcointalk humanity? Cheesy

The PM's in question seems way out of character for the posters past conversations. But I guess one never knows.

I very briefly discussed this with JollyGood upthread. Adding to what I said there: When I glanced at the user’s post history before, I noticed that he has a longstanding interest in CAPTCHA systems, and in the breaking of CAPTCHA systems. Note that his PM claims that he has a secret method to bypass the CAPTCHA, which he says he will discuss only with theymos.

Quote from: philipma1957 on Today at 04:12:16 AM

Quote from: newalias on Today at 03:33:55 AM

Captcha is useless as I use some trick I will only discuss with theymos.

From a thread almost two years ago:

Re: php human verification / antibot v2 ---> i challenge you to defeat it as bot

Quote from: newalias on July 20, 2020, 08:44:00 PM

The code of this is a disaster. It does not allow multiple users solving the "captcha" at the same time either. Roll Eyes

Quote from: newalias on July 31, 2020, 02:36:13 PM

I am sorry to say so, but the code is the work of a script kiddie.

This captcha is easy to be solved by bots, I agree with Aveatrex.

There are solutions like Google reCaptcha out there, with many, many algorithms. They even watch out for malicious activity, badly-known IP addresses and so on. They have sort of scoring behind it and make the captcha as difficult as needed for the specific client (or block it at all).

The only need for another captcha solution is a self-hosted approach, without sending clients data to Google or some other service providers. To my knowledge, there is no nice solution for PHP as library. So, your idea is nice, but the current state is absolutely useless.

On 2020-08-01, newalias issued negative trust feedback to the author of bad PHP code. Egads! Is it a death_wish sighting? Roll Eyes

More recently, but still >30 days ago (thus before the e-mail change), newalias showed other security-related interest in CAPTCHAs:

Re: [ANN] ChipMixer.com - Bitcoin mixer / Bitcoin tumbler - mixing reinvented

Quote from: newalias on June 01, 2022, 08:47:36 PM

Quote from: dkbit98 on May 21, 2022, 07:07:15 PM

I am glad to see .com is back and I like this approach, but it's going to be interesting to see how long until phishing domain do the same thing, linking to their own scam onion link.

Looks like chipmlxer.com (SCAM!) just got a nice idea from you Undecided

However, this is the most advanced scam, even maintaining session expiration time and renew/restore.

I think the new API is really nice but it is a matter of time until scam sites will use it:
Checking and redeeming sessions and vouchers entered or even providing fully functional scam sites, scamming only higher amounts to gain trust.
For sure, the latter can be done with own infrastructure, but with much more effort.

All scam sites lack captcha, just as observation.
Captcha is to protect from DoS, I think. That is also a problem for API, isnt it?
I think API is (or will get) a nightmare.

Anyone has a clue about how many these sites are making? I would start monitoring on my own otherwise.

Quote from: Welsh on Today at 01:15:53 PM

Here's the bit I'm talking about:

Quote from: philipma1957 on Today at 04:12:16 AM

You are entirely correct!

Quote from: Rizzrack on Today at 02:59:17 PM

If you know/guess someone's secret question you could lock their account and change their password. No other info required besides username + secret answer

And you! IIRC, I walked through the same thought process when I first saw the thread—then somehow confused myself. Need coffee. Always my excuse when I make a stupid mistake: Need more coffee.

Quote from: philipma1957 on Today at 04:12:16 AM

Quote from: newalias on Today at 03:33:55 AM

However, you have a security question in place, what often means lower entropy than a secure password and maybe being easier to guess. Simplest thing I have seen in DefaultTrust was "1+1" with answer "2" was correct - I have frozen it for security. Easy questions ask for an age (try 0-99) or a birth year (try 1940-2022) or lower case initials (try aa-zz). Many questions ask for a city or a make of first car - brute force can help. And there are loads of questions for names of wife, birth names, pet names and so on. These are things that may be shared even in a post or require only your real name! The better people know the account owner, the better they know the answer!

Recommended action to take is to remove security question at all.

^^^ Excellent advice! If newalias posts the same publicly, preferably on a new Meta thread linked from here, then it will deserve significant merits. Hint, hint.

* nullius has a longtime personal grudge against so-called “secret questions”.