In this paper, we first introduce the privacy and security requirements in public forums, which include anonymity, traceability, impossibility of impersonation, unforgeability, verifiability, fairness, easy anonymity revocation, and un-involvement of authorities. We then propose an anonymous and secure forum protocol based on a concept of alias certificate with detailed analysis to show that our scheme satisfies all these requirements. In particular, participants only need to register once with the authorities and the authorities are not involved during message postings, yet the anonymity of participants and the traceability of malicious information can be achieved. This can greatly increase the usability and efficiency as participants often post messages frequently.