Account Security

Your forum account is reputational collateral worth years of work. Losing it to a credential stuffing attack, weak password, or hijacked email costs more than most users realize. The fixes are quick + free.

The basics

Unique strong password. Generated by a password manager and never reused on any other site. Length beats character-class rules — a long generated passphrase is stronger than a short one padded with symbols. Bitcointalk's user database has been compromised in the past: treat any password you have ever used on the forum as potentially exposed, assume it could be in a breach dump, and never reuse a forum password anywhere else.

Different email for the forum. Not your main email. Not the email tied to your exchange accounts. A dedicated address used only for the forum, with its own strong password + 2FA.

Two-factor authentication on the email account. The forum's email is the recovery path. If an attacker compromises the email, they compromise the forum account. Use an authenticator app if you can — SMS codes can be stolen by SIM-swapping. SMS two-factor is still far better than none.

The Academy does not recommend a specific app. Judge one on whether it is actively maintained, whether it lets you back up or export your codes so a lost phone is not a lost account, and whether it stores those codes somewhere you control.

Forum-level 2FA

Bitcointalk supports TOTP two-factor authentication — the same one-time-code standard your authenticator app already uses. Enable it via:

• Profile → Account-related settings → Two-factor authentication

This adds a per-login challenge, which defeats credential stuffing — someone who has your password from an old breach still cannot log in. It does not protect you from phishing, malware on your machine, or a stolen session cookie.

Sessions + devices

• Log out when finishing on shared devices
• Periodically review active sessions (when supported)
• Don't stay logged in on devices you don't fully control

What to do if compromised

1. Reset password immediately from a clean device
2. Force-end other sessions if the option exists
3. Reset email password + check for forwarding rules added by attacker
4. Check for impostor PMs sent in your name
5. Post in Meta to disclose so others know your recent posts may be the attacker
6. Re-verify with theymos / mods if needed to recover full access

Account recovery in practice

The forum has minimal automated recovery — there's no "forgot password" rabbit hole that gives back full access. Recovery options:

• If you have email access: standard password reset
• If you've lost email access: follow the forum's current account-recovery process, posting from a clearly-labelled new account if you must, with evidence of ownership (post history, prior PGP signatures). Do not expect a fast or guaranteed outcome.
• If neither: the account may be permanently inaccessible

This is why prevention matters more than recovery.