Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Stole a User's Siacoin

mtlynch.io

Post reply on HN
Print view View original

51–60 of 73 posts

Re: How I Stole a User's Siacoin

#51

Post by Scaevolus »

Taek wrote: post #40
jancsika wrote: post #16

So what are both "ionic" and "tonic" in the same dictionary for a human readable entropy library?

Good question. I'm the author of that library and I can say I just borrowed the word list from another project. Luckily, that library only cares that you get the first three letters of each word correct, so we can update the word to 'tonsil' or 'tongue' without breaking compatibility.

Using ngram or part-of-speech data could create better mnemonics: https://rmmh.github.io/abbrase/

Filtering the list to require a minimum edit distance of 2 or 3 would be quite easy, too!

Re: How I Stole a User's Siacoin

#52

Post by tylersmith »

bubbabojangles wrote: post #3

I used to mine Bitcoin back in 2011 and I lost my wallet.dat file (through several stupid moves on my part). It's got approx 103 BTC in it, anyone is welcome to it, I've given up trying. https://blockchain.info/address/166BuLPWHUjqoqiYp5rGE3B5r5Am...

Dave the wallet recovery guy might be able to help if you have any sort of hints as to what your key might be. Obviously do some research to verify I'm not scamming you. Good luck. https://walletrecoveryservices.com

Re: How I Stole a User's Siacoin

#53

Post by tylersmith »

awalton wrote: post #24

So I can overlook the misdemeanor pocketing of a few bucks with the intent on giving it back, but you basically admit and brag about breaking the Computer Fraud and Abuse Act as some kind of exercise of how clever you are for doing a dictionary attack against a weak and exposed key? Good luck sir.

The alternative is leaving their money sitting in a compromised address. The options are take it and give it back, take it and keep it, or let some random person take it.

Re: How I Stole a User's Siacoin

#54

Post by andai »

kyle-rb wrote: post #41
IanCal wrote: post #37

Earlier quoted context omitted.

Reasonable, but not an invitation to transfer the entire amount then setup an automated process to transfer any remaining amount to your own address.

I don't know, I think transferring it was the reasonable thing to do, rather than leaving it in the compromised wallet. It's like if you find someone's (real) wallet, and you pick it up and contact the owner to ask where to drop it off. Rather than leaving it there and just telling the owner what street corner it's on.

Makes sense! Like when your neighbor leaves their door unlocked and you steal all their stuff just in case.

Re: How I Stole a User's Siacoin

#55

Post by rspeer »

tonyhb wrote: post #21
jancsika wrote: post #16

So what are both "ionic" and "tonic" in the same dictionary for a human readable entropy library?

EFF has a new wordlist which can be used for things like this. It focuses on phonetic and spelling differences across each word so that this doesn't happen, plus it prevents words from "duplicating" when you combine them (ie the two words `in put` and `input` being the same). https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

Nice! As I started reading about it, I idly wondered if they talked to Marc Brysbaert, who is very serious about researching which words people know. And the answer is yes, they did.

Re: How I Stole a User's Siacoin

#56

Post by averagewall »

kyle-rb wrote: post #41
IanCal wrote: post #37

Earlier quoted context omitted.

Reasonable, but not an invitation to transfer the entire amount then setup an automated process to transfer any remaining amount to your own address.

I don't know, I think transferring it was the reasonable thing to do, rather than leaving it in the compromised wallet. It's like if you find someone's (real) wallet, and you pick it up and contact the owner to ask where to drop it off. Rather than leaving it there and just telling the owner what street corner it's on.

I recently heard about a guy who was arrested and charged for exactly that. He took a phone home that he found in a carpark, the owner texted it saying "please return to Subway" He went there the next day to hand it in and the police were waiting! Apparently he was supposed to have turned it in to any nearby business at the time he found it. Not tried to find out who owned it the next day.

Re: How I Stole a User's Siacoin

#57

Post by CPUstring »

awalton wrote: post #24

So I can overlook the misdemeanor pocketing of a few bucks with the intent on giving it back, but you basically admit and brag about breaking the Computer Fraud and Abuse Act as some kind of exercise of how clever you are for doing a dictionary attack against a weak and exposed key? Good luck sir.

This comment is unhelpful and negative for no reason. Somebody helping somebody else should not be dismissed but instead rewarded.

Re: How I Stole a User's Siacoin

#58

Post by laser »

anishathalye wrote: post #38
dantillberg wrote: post #4

I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with limited brute forcing support. Such password dialogs could just let you type your best effort, and they could use the things you type to inform the guessing process; you could fat-finger a character or two, and it would just take a moment longer to log in as i…

Some people (e.g. Facebook) do this already. And it turns out that this doesn't really impact security all that much! Here's a recent research paper on the topic: pASSWORD tYPOS and How to Correct them Securely - http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf

Does Facebook do anything beyond capitalization correction?

Re: How I Stole a User's Siacoin

#59

Post by [deleted] »

laser wrote: post #58
anishathalye wrote: post #38

Earlier quoted context omitted.

Some people (e.g. Facebook) do this already. And it turns out that this doesn't really impact security all that much! Here's a recent research paper on the topic: pASSWORD tYPOS and How to Correct them Securely - http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf

Does Facebook do anything beyond capitalization correction?

[deleted]

Re: How I Stole a User's Siacoin

#60

Post by 6c75726b6572 »

lend000 wrote: post #50
bubbabojangles wrote: post #3

I used to mine Bitcoin back in 2011 and I lost my wallet.dat file (through several stupid moves on my part). It's got approx 103 BTC in it, anyone is welcome to it, I've given up trying. https://blockchain.info/address/166BuLPWHUjqoqiYp5rGE3B5r5Am...

Any hints on how you generated you key/passphrase? Did you use Satoshi's original Bitcoin client? Will reward information which results in successful discovery :)

Wondering the same thing. Was a passphrase used to generate the private key?
Post reply on HN