Showing posts with label bitcoin. Show all posts
Showing posts with label bitcoin. Show all posts

Friday, August 3, 2018

Scam Alert: Thorium Molten Salt Reactor ICO Is A Scam

Introduction

The following conversation(s) happened back in May 2018, but I had a lot on my plate at the time and didn't get to post here. It took place in the CryptoMENA Telegram group where I lurk and contribute to the community and have discussions with various people.

TL;DR

It's a scam. Those posting about it refer to some videos that talk about how great Thorium is and it being an untapped source of energy. When asked for details, they refer to old research (1968) which didn't even include Thorium and only discussed Molten Salt Reactors (MSRs). At the end, when they have no more excuses, they start a conspiracy theory that countries insist on using nuclear reactors for weaponization purposes.

Warning

I have kept all links as-is and did not remove their links. The ones to the PDF files and YouTube videos are safe, but click anything else at your own risk.

Details

Below is the full conversation that happened in the group. I have masked the person's name because I don't want to smear them in person, and only focus on the ICO scam itself. I have also omitted the name of a person I had asked on nuclear reactors as I didn't get his permission prior to publishing this post. If he agrees to have it included, I'll add it later.

I'm pasting both images (first) then text to allow for the conversation to be indexed by search engines, in hope to save anyone who's looking for evidence or proof.

Picture-Captured Conversation

conversation - part 0
Part 0
conversation - part 1
Part 1
conversation - part 2
Part 2

Links to the 2 PDF files the person had shared:
ORNL-TM-2316.pdf : "Physical Properties of Molten-Salt Reactor Fuel, Coolant, and Flush Salts"
Pub20808.pdf : "An Account of Oak Ridge National Laboratory’s Thirteen Nuclear Reactors"


Text Conversation

The conversation is between 1 person and myself. I will add my name and color my text in red to differentiate it from the person.

Person: Make an impact - on your future and your children's, children's future: join our early blockchain project and contribute to clean transparent energy production. Now is our Private Token Sale. Watch these videos for more... The tech: https://goo.gl/WKDfsY; The story: https://goo.gl/7vwmkF
Register for the PTS document: https://goo.gl/XWTLe8. 
Let's build our future together.

MBH: Someone mentioned this last month, and as I warned before: Thorium reactors are inefficient on an industrial scale and that's why they weren't done decades ago.

You're free to invest into any coin you like, but don't do it based on false information and false promises.

Person: Thanks for your comments , but I am sure   the Danish nuclear group Copenhagen Atomics  has other point of view. They are partner in this project which I assume if it such project won't be feasible they would not invested and have dedicated team, nor would 100 other companies be developing molten salt technology, including a Chinese team with 700 engineers. Oak Ridge laboratory was forced to shut down their working molten salt loop in 1974 by the FBI because the reactor burns highly efficently and does not product plutonium - that means a thorium LFTR in thermal spectrum can't be used to make material for nuclear weapons. There's a great interview with two of the original engineers somewhere on youtube. Anyhow Denmark and other parts of world are long ahead of us in such subjects. 

Also your point that this group is related to the Crypto is valid too.  The blockchain for thorium is going to be the first ever transparent nuclear energy source tracking and management system ever in the world. Backed by thorium, each token will trace all energy production from this amazing fuel source.  However I saw there are many related discussions to ICO therefore I thought this can be relevant too, perhaps my misunderstanding.

MBH: Show me a valid research paper for mass produced Thorium reactors, please.

All what I saw were a bunch of videos, but the papers I saw indicated inefficiencies in production.

And yes, I understand it's an ICO and related to this group, which is why I didn't question that :)

Person: It's a proven technology - just forgotten - on purpose ;o)

Here's the research paper you ask for (the pdf)

And a video based on the paper:
https://www.youtube.com/watch?v=tyDbq5HRs0o

Wikipedia is an easier read, though not as accurate as the actual paper:
https://en.wikipedia.org/wiki/Molten-Salt_Reactor_Experiment

Here's an interview in 2012 with two of the engineers from Oak Ridge who actually worked on the molten salt reactor. They add much more context to the paper:
https://www.youtube.com/watch?v=ENH-jd6NhRc

Here's the reactor now:
https://www.youtube.com/watch?v=knofNX7HCbg

MBH: I don't want videos and interviews. I want a research paper for a production ready reactor.

Why would the energy industry leave such a lucrative energy source untapped? Especially in Germany and France.


MBH: I mention these 2 countries specifically because they're heavy on nuclear reactors, and if something exists that's cheaper and cleaner, then they would've used it.

Person: Pub20808.pdf

This TSN blockchain aims to put the power of decentralisation, transparency and accountability of a vitally important energy technology back into the control of the people, and not governments. For civilian owned and managed power generation.

Here's one of our ICO members, Thomas Jam Pedersen, talking about the technology:
https://www.youtube.com/watch?v=tHO1ebNxhVI

Thomas just got back from presenting in China at a nuclear energy conference. Once the private token sale is over some of that footage will be used for the preICO.

I shared you the research papers

France wanted nuclear weapons

one of their representative is here in Kuwait if anyone wants to know more about the  technology and their current stage and process just register in this link https://goo.gl/XWTLe8 .

MBH: This talks about salt mixtures & plainly says it hopes for nuclear reactor design engineers to make use of it at some point. This is dating to 1968, yet we still don't have a single molten salt reactor...

Person: You have not read it, it was a working molten reactor for 5 years

MBH: (inserted picture showing an excerpt of the first document searching for the word "Thorium")

excerpt from first PDF

It talks about molten salt reactors, and then clearly states thorium was never used in the reactors (was part of the concept but never used in practice).

Let me ask: 5 years of a working *Thorium* MSRE? Or just a MSRE?

Why haven't there ever been any mass produced Thorium MSREs since 1950s?!?

All claims for Thorium MSREs are reducing cost of the nuclear reactors and the fuel, yet not a single mass produced one exists. All existed in experiments, if ever.

Germany is pushing hard for renewables & last year generated 30% of its need from them in one of the months, but that's not sustainable throughout the year, so nuclear is still needed throughout the year for sustainable energy.

Person: You have a point, but you are missing the big one: why isn't thorium mainstream? 

Because you can't make weapons out of it. 

It was bluntly shelved for this reason 

(In fact staff at ORL were told to destroy their research. They didn't thankfully...)

There's a huge misconception in "nuclear" energy.

The way of obtaining electrical energy using uranium is totally different to getting it from it's cousin, thorium.

It's like comparing apples with oranges. They just ain't the same.

The hugely expensive nuclear facilities of present day are like they are not to produce the energy - the energy comes out easy - way too easy.

The huge money in present nuclear is spent in-case things go wrong: spent to prevent a meltdown - a very bad thing; and spent to contain explosions from spreading radioactive material in the area - like Fukushima or Chernobyl....

Thorium doesn't need such high costs: 1) it can not "melt down", the technical reason is neutron density reduces as the fuel gets hotter, it cools, so it self regulates. No intervention needed, and 2) there is no high pressure cooling fluid pummelled with neutrons to either produce hydrogen (that goes bang) or create a rapidly expanding radioactive water vapour (steam explosion).  So no massive containment building or complex safety shut down systems are needed. The costs are much, much less.

Speaking of waste: less than 0.5% of the same volume of a uranium machine is produced in a thorium machine and this 0.5% only needs to be stored for 300 years...  

So, comparing apples with oranges is what is happening here between uranium and thorium. You can't, and shouldn't once you know the science.

(yes, for present nuclear it is in the billions to produce electricity at 20 cents per kWh and above - when you include the environmental costs. The thorium target is 5 cents per MWh, matching that with nuclear energy produced in France. Thorium doesn't have any significant environmental costs).  

Let's compare thorium as an energy source to the crypto market directly.

Here's the main reason why the bitcoin and crypto market is coming alive - rigging the gold and silver markets - traditional safe havens amid economic turbulence:

(see the chart...)

But! -Why- has gold been flat for the last five years? 

Because of futures contracts, rigged, fraudulent paper contracts issued mainly by the bullion banks themselves to control the market and avoid bank runs.  The coverage ratio in the chart tells all.  The ratio is now above 500 to 1.

500 to 1.....

500 imaginary bars of gold to 1, actual, physical, real bar of gold...

Basel 3 set the asset (cash) to debt ratio of 8 to 1 for the debt banking system....

Bullion banks and the futures markets operate outside Basel 3....

A -scam- pure and simple of the highest order.

https://www.moneymetals.com/news/2016/05/16/silver-gold-futures-market-000868

MBH: If weapon manufacturing is the reason: why are the following renewable energy technologies being invested into heavily especially by Europe?

- Wind
- Batteries
- Geothermal
- Solar panels

None of these are used for weapon manufacturing. Also, a nuclear bomb is very tiny in comparison to a reactor.

Yes, a lot of money goes into maintenance and safety procedures and construction, but that's a very well known issue with nuclear reactors.

Thorium research wasn't asked to be destroyed. They were asked to decommission the facility, just like any tech that's no longer funded. It's mentioned in the report you sent about Oak Ridge Lab.

I'm glad you mentioned the ICO.

I don't understand why someone who found a solution to make Thorium MSREs finally feasible, isn't patenting and getting VC/gov funding directly?

Why do an ICO? No regulation here and can easily run off with money.

Why not establish a legitimate company and go through funding?

Where are the patents?

Nothing makes sense in a scientific approach nor a business approach.

I'm not familiar with nuclear fission requirements, but I'm free in Ramadhan and can read about it and debate this, or I can ask a cousin who is a nuclear power engineer.

However, I don't need to know those to answer my other obvious questions about mass production of a thorium msre and the business plan and getting gov funding for a working demo of a mass produced design, rather than ask people to give money.

I think my cousin has a PhD in nuclear power now.

Person: This is a following chart to my earlier text abt the gold and comparison with thorium , see this chart

(inserts chart showing Comex Gold Cover ration [Open Interest/Registered Gold]. Y-Axis: 0x to 600x and X-Axis: 2000 to 2016)
Comex Gold Cover ration [Open Interest/Registered Gold]

Yes, thorium is heavily financed by the governments of Russia, China and India. The congress of US recently made a new law allowing research into thorium energy, hence opening up government funding in that country also

We are very confident that with transparency and legitimacy brought to the table of the nuclear industry.  We'll start a similar run as Bitcoin did in 2009. Bitcoin revolutionised money. The Thorium network will revolutionise nuclear energy.

Are we going to face opposition: we sure are! But again it's a project worth pursuing because the benefits of transparency drives innovation faster and this drives price discovery, for the entire world to see, watch, monitor and report upon.

Get into the tech, it's complicated, but it's worth it.

Poor Thorium suffered a similar fate, and continues to do so.

Fortunately the technology to bring it to life is nearing completion with Copenhagen Atomics, They have developed cutting edge monitoring and control systems.

Plus there are another 100 or more companies busy working on LFTR technology. 

China is scheduling 2024 for a working commercial LFTR machine.

From an engineering point of view, the physical technology required for LFTR is actually less sophisticated than that required to extract nickel from nickel laterite ores. Something that pioneers in Australia at Anaconda Nickel did in the early 2000's. 

They took a huge technical risk and almost broke the company - it cost $1.6b to build when they budgeted only $1b. 

@ Murrin Murrin Ni-Co: High pressure, high temperature acidic slurry - really hard to deal with, but the plant has been successfully producing high grade nickle since 2005.

(a member of the ICO team was close to this nickel project, so has first hand knowledge of it)

MBH: I spoke to [redacted]. Neither of us is convinced. He mentioned power generated from Thorium is far less than that from Uranium.

He also directed me to look at International Atomic Energy Agency (iaea.org) and see if I can find a list of thorium based reactors. There are none that I could find listed there, and the agency lists ALL reactors around the world.

Research by IAEA members on Thorium dates to 2001, by member countries: France, Germany, India, Japan & Russia.

An article dating to 2016 titled "Advanced Nuclear Fuels and Fuel Cycles" stated the following countries are collaborating in seeing a long term research in using Thorium: Canada, China, Czech, Germany, India, Israel, Italy & USA. No output from this yet.

Finally, I still don't see how an ICO/coin is related to building thorium reactors, when country-level budgets are spent in early research phases.

So if anything, this whole ICO is nothing but a scam.

If you want to discuss great possibilities of Thorium as a fuel, we can do that in a separate place. Feel free to discuss the ICO itself and how it relates, as long as you provide solid proof and not long statements with scattered scientific jargon without proof.

Wednesday, November 15, 2017

Blockchain & Crypto Currency Introduction Seminar

In collaboration with Sirdab Lab, I'll be talking about something that I should've since 2010: Crypto currencies.

The introduction's title is: 'Intro to Crypto Currencies: Blockchain, Bitcoin & Other Bits' on Monday December 4th, 2017 at 6 PM (1800).

The content will be suitable for newbies, traders, bankers, investors, law makers and the generally curious.



Sirdab Lab's location: Dasman Complex Ground floor, Jaber Al-Mubarak St, Sharq, Kuwait City. (Google Maps).

Update:
The session was recorded and the slides & audio were merged into a video that's available now online: https://www.youtube.com/watch?v=_Mu9_PcyJi0

The description has links to the slides and the raw mp3 file, for those who want to listen to the audio online. The slides have notes under each slide for added discussion and elaboration.

Link to the slides: https://goo.gl/bcZFmi
Link to the mp3 audio file: https://goo.gl/bHTRmC

Friday, July 19, 2013

HOWTO: Tor2Web on Debian

What is Tor2Web?

Tor2Web is an open source software that allows the general public to browse Tor hidden services, which are servers running anonymously behind the Tor network. These servers could be web servers, email servers or any other services, and are normally accessed only via the Tor software, but if for some reason you cannot install it, or need a quick look, tor2web provides this kind of easy access via standard web browsers.

Tor's hidden services (HSs) usually look like this http://sx3jvhfgzhw44p3x.onion (Wikileak's HS), but with tor2web, you can create a general public proxy where people enter the HS like this https://sx3jvhfgzhw44p3x.tor2web.org/ or bind your tor2web node to a specific HS (yours or someone else's) so that when someone accesses your tor2web domain name, it will only view your specific HS.

In all cases, Tor2Web cannot be used alone. You still need a 2nd node that has the HS running on it. This guide will not cover how to setup a HS. You can refer to Tor's guide for that. Never run both the HS & tor2web on the same node!

Why Use Tor2Web?

Tor2Web is part of a bigger project called GlobaLeaks, but one can use tor2web to provide access to banned/blocked material or provide services anonymously, not related to whistle-blowing, like an anonymous chat service. Taking down the tor2web node doesn't affect the HS & it's always easy to bring up a new tor2web node.

Another reason is to simply hide your stuff. With news of governments snooping on everyone and everything, one doesn't feel safe anymore. They could use anything against you at any point in the future. So, by running a HS, you can run your own email server or file server, and not worry about some law enforcement goons seizing your hardware and disrupting your work, even if you're collateral damage (like when Mega Upload servers were seized, many other websites were also affected).

Of course, one cannot attain full anonymity without taking all possible precautions such as registering the host/VPS/domain name using Tor to not be tracked to you, paying for the services using Bitcoins, and SSH into your system from behind Tor.

Requirements

  1. Debian Squeeze (6) or Wheezy (7)
  2. tor
  3. python2.7
  4. python-Twisted version 13.1.x
  5. tor2web
tor2web v3.0 uses Python Twisted as a webserver rather than a standalone webserver like Nginx.

Note: This guide has slight differences from the Tor2Web guide. Feel free to refer to both and modify as you please.

1) Debian

Some Virtual Private Server (VPS) providers do not support Wheezy, but tor2web needs packages only available in Wheezy. You will have to install a lot of packages from Wheezy to be able to use python2.7 and its requirements, but you don't need to run a dist-upgrade. So, in the end, your distribution will still be Squeeze.

If you're already running Wheezy, then you can simply ignore the parts about adding Wheezy's specific repositories and removing them later.

1.1) Initial Sources

Modify the file /etc/apt/sources.lst with your favorite editor (vi, vim, emacs, nano, pico)
deb http://ftp.uk.debian.org/debian             squeeze main contrib non-free
deb http://ftp.uk.debian.org/debian-security    squeeze/updates main contrib non-free
deb http://ftp.uk.debian.org/debian-backports squeeze-backports main
deb http://ftp.uk.debian.org/debian-backports squeeze-backports-sloppy main
deb http://deb.torproject.org/torproject.org squeeze main
deb http://dl.bintray.com/globaleaks/deb /

Replace "squeeze" with "wheezy" if that's what you're running, but ignore the backports lines as you don't need them.

Your sources above could be from a different mirror for Debian's packages. Always use the closest mirror to your host.

1.2) Upgrading the box

You need to be root to run these commands, or have "sudo" installed with the correct privileges.

The last command will upgrade your host to the latest packages of your distribution. It's always good to stay up to date and avoid buggy packages.

sudo apt-get update
sudo apt-get upgrade

1.3) Add Wheezy repositories

Modify the file /etc/apt/sources.lst with your favorite editor (vi, vim, emacs, nano, pico) again, and add Wheezy repos
deb http://ftp.uk.debian.org/debian             wheezy main contrib non-free
deb http://ftp.uk.debian.org/debian-security    wheezy/updates main contrib non-free

2) Tor

Import Tor's keyring to authenticate the packages and install Tor.

Note: If you're running as root, or you don't have sudo installed, simply remove "sudo" from the 2nd command above.

sudo apt-get update
sudo apt-get install debian-keyring debian-archive-keyring
sudo apt-get update

gpg --keyserver keys.gnupg.net --recv 886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

sudo apt-get install deb.torproject.org-keyring
sudo apt-get update
sudo apt-get install tor

Now you should have tor installed. You check the service status using: service tor status

3) Python

Check if you already have python installed and which version:
python --version
python2.7 --version

Now to install python and some of its fellow packages:
sudo apt-get install -t wheezy python2.7 python-pip python-dev wget ca-certificates

If you're running Squeeze, you'll be asked to also install glibc, and during the install you'll be asked to restart the services associated with it. If this is a fresh host, it's safe to say "Yes" if it's a production box with services running live, choose "No." This will also upgrade & install a lot of packages from Wheezy, as python-pip is dependent on them.

If you have multiple versions of python installed (2.6, 2.7 & 3.x), you'll need to change the default to 2.7:
update-alternatives --install /usr/bin/python python /usr/bin/python2.7 10

If you need to change the default later on, run this:
update-alternatives --config python

4) Tor2Web

First to grab the tor2web requirements and install them:
wget https://raw.github.com/globaleaks/GLBackend/master/requirements.txt
sudo pip install -r requirements.txt
sudo apt-get install tor2web
sudo service tor2web status
sudo service tor2web stop

Now that you have tor2web installed, and stopped, you need to create certificates for session encryption between the tor2web node and the user's browser.

when running the 2nd openssl command, make sure the Common Name (FQDN) is the same as the domain name that will be used to access the tor2web server. If you're planning to access it by IP, use the IP here.

The 3rd command will create a certificate valid for a year (365 days). If you want it to live longer, increase the number of days.

The last command will take a long time to generate the file. If your computer is faster than your host, run it on your computer then copy it there.

cd /home/tor2web/certs/
openssl genrsa -aes256 -out tor2web-key.pem 4096
openssl req -new -key tor2web-key.pem -out tor2web-csr.pem
openssl x509 -req -days 365 -in tor2web-csr.pem -signkey tor2web-key.pem -out tor2web-intermediate.pem
openssl dhparam -out tor2web-dh.pem 4096

Don't change the file names as tor2web is coded to use them as is.

The certificates created will require you to enter the password whenever you [re]start the tor2web service. This is good in case your server was hijacked & your certs were taken, they cannot be used unless someone knows the password (which shouldn't be the same as the root password!).

If you don't care, then you can create a certificate without a password:
openssl rsa -in tor2web-key.pem -out tor2web-key.pem.insecure
mv tor2web-key.pem tor2web-key.pem.secure
mv tor2web-key.pem.insecure  tor2web-key.pem

5) Configuring Tor and Tor2Web

Limit tor to the local host IP and prevent external connections, by modifying /etc/tor/torrc and add this line:
SocksPort 127.0.0.1:9050

Copy the example file into a new one:
cp /etc/tor2web.conf.example /etc/tor2web.conf

Modify /etc/tor2web.conf
nodename = whatever you want here. It can be the IP since it's unique

listen_ipv4 = IP of your VPS
listen_ipv6 = IP of your VPS, if you want to use IPv6
Change these to the IPs. If you don't want to bind by IPv6 or IPv4, comment the line out by adding a # sign at the beginning of the line. One of them must be present.

listen_port_http = 80
listen_port_https = 443
You cannot comment out http port, as tor2web will automatically redirect to https, but you can change the default ports.

basehost = this should be the root domain name (example.com not www.example.com or any subdomain, unless you happen to be running behind a subdomain). It can also be an IP. If you do not use the exact name/IP that the tor2web service will be accessed from, tor2web will not function.

Sockshost = 127.0.0.1
socksport = 9050
These should match the SocksPort config in /etc/tor/torrc file.

cipher_list = DHE-RSA-AES256-SHA
I do not trust the others, as DSS is not quite common and is only used by Microsoft for some reason, and RC4 can be misused at times.

mode = TRANSLATION
onion = hidden service name: name.onion (jntlesnev5o7zysa.onion - piratebay's HS)
blockcrawl = True
Using mode Translation means you'll bind tor2web to a specific hidden service defined in the onion option. If you want tor2web to function as a general proxy, leave the default options. The blockcrawl option blocks search engines.

I commented out the email notification options as I don't really care about notifications.

#mirror = ...
comment it out unless you happen to be running multiple tor2web nodes and want this one to list them in the banner.

6) Clean Up & Run the Services

If you're running Squeeze, remove the Wheezy main repo and only keep the security one to prevent upgrading the entire host to Wheezy.

Now run the tor2web service: (it will run tor for you)
service tor2web restart

You'll be asked to input the password of the certificate every time you [re]start the service, unless you have removed the password. Read the caution about it above.

It's always a good idea to NEVER ssh into your hidden service node using its real IP from your tor2web node. Should your tor2web node ever get seized or compromised, you do not want anyone looking at the logs or history to find the IP of your hidden service, as it won't hidden anymore.

7) Help

If you need my help setting up a HS, never contact me with your personal email and do not ask for help in the comments section. Create a fake email or use tormail.org. I don't want to know why you're setting it up or what kind of material you're hosting. The less I know, the better for the both of us.

You can ask anonymously on my blog about generic config or a problem you're having, but if you need specific help, send me an email with no details and then we'll agree on how to proceed.

8) Sources

Monday, June 20, 2011

MtGox Compromise And What It Means To Me

MtGox is a BitCoin Exchange Market for the BitCoin digital currency and I have read about BitCoin last year but waited for it to mature before stepping into the market.

About two weeks ago I invested in MtGox about $880 USD and 2 days later a Distributed Denial of Service (DDoS) attack was launched at MtGox. I did some reading and it wasn't the first time they were under attack and they had everything secured and well planned so I wasn't worried.

The market volume suddenly increased with massive quantities flooding the market, followed by a market crash (prices dropped to $13/BTC where the price previously was $17). MtGox closed the market and halted all transactions. Apparently, they were compromised.

I panicked at first as I couldn't access my account on MtGox (they froze all) and they said they were going to do a roll over, which means undo everything and return to the state before the crash.
I wasn't happy because I didn't know the state of my money & coins, and those who bought coins at cheap prices could have withdrawn the coins from the market which means there is no way to trace the coins nor return them.

I still don't know how will MtGox deal with those who bought cheap coins & withdrew them, but if they do a roll back, they'll get their money/coins back to what they had before the crash, in addition to the coins they withdrew! That means extra profit! Unless they monitored the withdrawn amounts from each account and will balance those out.

Anyway, I searched for my username on Google in relation to MtGox but nothing came up. Maybe Google didn't have time to index all pages, they're underground or maybe my user wasn't affected. Either way, my account will be rolled back and the password I used was unique to MtGox itself, so the attackers can't access my email or any other service associated with my email.

Moreover, MtGox has switched to an obscenely secure password hashing scheme: SHA-512, along with contacting GMail and providing them with a list of compromised email addresses so GMail could block them and require a password reset before accessing them (I was one of those affected).

MtGox keeps updating its post with news of what they're doing so they've not neglected their customers, even when under such a big stress.

In my opinion, I'm sticking with them because only at rough times you'll see what a good company can do for its customers, and while there are inconveniences, the overall success of containing the situation was successful.
Perhaps people would have felt much better had MtGox shared how it manages its systems and what kind of security schemes are implemented so that we know they can be trusted. I hope they do that soon.

Away from MtGox, and in general, those who know me well know pretty well that I'm a paranoid person when it comes to computers and being online. Below are some of my practices for staying safe:

  • Different passwords for different accounts.
  • If I forgot a password, it's OK, I request a password reset.
  • Passwords are at least 10 camel-cased alpha numeric and special characters.
  • My passwords are a mixture of meaningful words forming a non-meaningful sentence: R0undTomatoe$Insid3Triangl3Whalez
  • Always check my emails from my own systems & never someone else's (not even family or friends).
  • GMail shows you the list of IPs of who last accessed your account & alerts you on suspicious access.
  • When you create an account at a new site, request a password reset; if they send you the exact password in plaintext, close your account. They're not securing their database & don't care about your account security.
    If they send you a link to reset the password, or email you a randomly generated password, then you're fine.
  • Use different browsers: One for your accounts and another browser for everything else.
    I use Chrome for GMail and Twitter. All links in emails or tweets are opened in Incognito mode (separate/isolated processes from the main) or in Firefox.
  • I use Linux. No Windows or Mac for me, and please don't laugh at Windows if you're a Mac fanboy, Mac OSs are less secure than Windows but aren't targeted as much because you're a minority.
  • If you have to use Windows, use a good antivirus. I put Kaspersky on my family members' machines. I had used it for companies and fully trust it.
  • Do not open emails from strangers.
  • Emails that say they're from good & honest people are most likely aren't.
  • Email that come from addresses of people you know aren't necessarily from them. The addresses can be spoofed, i.e., I can send you an email from your account without accessing your account. Magic.
  • If someone you know asks you for your password or to install something you don't know about, call them and ask them in person.
  • If you read online about a nice service that you use that isn't secure, you better not shrug it off and say that you won't be affected. That's how everyone gets slapped in the end.

I probably have other habits that don't come to mind right now. If you have any suggestions, leave a comment (you can do so anonymously) and I'll be more than happy to add it to the list.

Live paranoid. Live safe.