Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Stole a User's Siacoin

mtlynch.io

Post reply on HN
Print view View original

61–70 of 73 posts

Re: How I Stole a User's Siacoin

#61

Post by lloeki »

ktta wrote: post #14
dantillberg wrote: post #4

I often wish that password entry for things fully under your control (i.e. when there are no retry limits aside from brute computational power) would come with limited brute forcing support. Such password dialogs could just let you type your best effort, and they could use the things you type to inform the guessing process; you could fat-finger a character or two, and it would just take a moment longer to log in as i…

(offtopic - misunderstood comment. Let's assume the parent comment said 'we should prevent bruteforcing') As the other commenter said, there's nothing you can do to prevent brute forcing. What you can do, is have a very expensive KDF. So for every password you enter the wallet will take a very long time to 'unlock', which is basically the process of deriving the key from the input. 'Expensive KDF' sounds cryptic, but…

Fun side effect of the su/sudo delay: typing in a wrong password feels punishingly interruptive while getting it correct feels satisfyingly brisk, triggering a reward that makes you learn to type it better and better. A bit like sl and gti commands.

Re: How I Stole a User's Siacoin

#62

Post by zulln »

laser wrote: post #58
anishathalye wrote: post #38

Earlier quoted context omitted.

Some people (e.g. Facebook) do this already. And it turns out that this doesn't really impact security all that much! Here's a recent research paper on the topic: pASSWORD tYPOS and How to Correct them Securely - http://www.ieee-security.org/TC/SP2016/papers/0824a799.pdf

Does Facebook do anything beyond capitalization correction?

Think they remove ending space.

Re: How I Stole a User's Siacoin

#63

Post by feelix »

bubbabojangles wrote: post #3

I used to mine Bitcoin back in 2011 and I lost my wallet.dat file (through several stupid moves on my part). It's got approx 103 BTC in it, anyone is welcome to it, I've given up trying. https://blockchain.info/address/166BuLPWHUjqoqiYp5rGE3B5r5Am...

do you have any spinning disks around that once may have had the unencrypted keys on it? I could modify the commercial data recovery software I wrote (https://macosxfilerecovery.com/) to scan your drive for the private keys

Re: How I Stole a User's Siacoin

#64

Post by bubbabojangles »

feelix wrote: post #63
bubbabojangles wrote: post #3

I used to mine Bitcoin back in 2011 and I lost my wallet.dat file (through several stupid moves on my part). It's got approx 103 BTC in it, anyone is welcome to it, I've given up trying. https://blockchain.info/address/166BuLPWHUjqoqiYp5rGE3B5r5Am...

do you have any spinning disks around that once may have had the unencrypted keys on it? I could modify the commercial data recovery software I wrote ( https://macosxfilerecovery.com/ ) to scan your drive for the private keys

Thanks for the offer, I kept the drive I stored the TrueCrypt container on. I think it was like a bad drive arm or PCB. I'd considered paying for a service to move the platters to a good drive, but at the time the service cost more then Bitcoin worth and there was no guarantee of recovery. I ended up throwing the drive away (another dumb move). Never in my wildest dreams did I think it would increase in value like it did. I think I would have sold a lot sooner if I had access to the wallet file for the whole time.

Re: How I Stole a User's Siacoin

#65

Post by zulln »

jacquesm wrote: post #39
diegoprzl wrote: post #11

Earlier quoted context omitted.

It's more like: "I bought a painting for 20$ at flea market. 6 years later I learned it was from Van Gogh but sadly I don't know where it is now."

My dad actually bought a painting for $25 at a flea market in Amsterdam and it turned out to be a Paul Citroen, we ate pretty good for a couple of years because of that. Not quite a Van Gogh but still, a good catch.

What was the market value of the painting? I fail to find any result corresponding with the comment.

Re: How I Stole a User's Siacoin

#66

Post by zulln »

illumin8 wrote: post #43
sweettea wrote: post #33

Earlier quoted context omitted.

Did he try Dropbox support to see if they have a backup?

Oh yeah, completely exhausted that route - it was over a year before he realized it and way past their retention period...

"Hi Dropbox support! You get $1m USD if you figure this out."

Re: How I Stole a User's Siacoin

#67

Post by creepydata »

averagewall wrote: post #56
kyle-rb wrote: post #41

Earlier quoted context omitted.

I don't know, I think transferring it was the reasonable thing to do, rather than leaving it in the compromised wallet. It's like if you find someone's (real) wallet, and you pick it up and contact the owner to ask where to drop it off. Rather than leaving it there and just telling the owner what street corner it's on.

I recently heard about a guy who was arrested and charged for exactly that. He took a phone home that he found in a carpark, the owner texted it saying "please return to Subway" He went there the next day to hand it in and the police were waiting! Apparently he was supposed to have turned it in to any nearby business at the time he found it. Not tried to find out who owned it the next day.

Any nearby business? I thought lost property was to be turned into the police station​. Otherwise the owner could call the cops on the business employees "I was never at Dunkin Donuts yesterday."

Re: How I Stole a User's Siacoin

#68

Post by markc » 

    A wise wife tagged and jagged and nagged
    Her aptitude had altitude to push the lush
    He bore the brunt with a grunt and tonic
    His music was ionic sonic
    Their topic too toxic to adapt
    And they, too adept to adopt

Re: How I Stole a User's Siacoin

#69

Post by jacquesm »

zulln wrote: post #65
jacquesm wrote: post #39

Earlier quoted context omitted.

My dad actually bought a painting for $25 at a flea market in Amsterdam and it turned out to be a Paul Citroen, we ate pretty good for a couple of years because of that. Not quite a Van Gogh but still, a good catch.

What was the market value of the painting? I fail to find any result corresponding with the comment.

It fetched ~50K Guilders in an auction by Mak van Waay, which in the 1970's was a lot of money.

Re: How I Stole a User's Siacoin

#70

Post by zuck9 »

illumin8 wrote: post #31
bubbabojangles wrote: post #3

I used to mine Bitcoin back in 2011 and I lost my wallet.dat file (through several stupid moves on my part). It's got approx 103 BTC in it, anyone is welcome to it, I've given up trying. https://blockchain.info/address/166BuLPWHUjqoqiYp5rGE3B5r5Am...

My brother accidentally deleted his wallet.dat from Dropbox a few years ago - he had given it a random filename and encrypted it with GPG so it was unrecognizable to hackers (and apparently him as well). It had 1,000 BTC in it! He had received them from a generous Bitcoin contributor in the early days who said "here you go, hold on to it, it will be worth something someday." I still give him a hard time about his $3…

Generous bitcoin contributor may be thinking that he made a wrong choice of giving away.
Post reply on HN