171–180 of 262 posts
Earlier quoted context omitted.
Very sloppy. When you're dealing with actual money, industry-standard practices like this shouldn't be considered optional.
Legally, they're not. Bitcoin just isn't actual money in any country. Someone should buy sealand and change the national currency to bitcoin...
Earlier quoted context omitted.
I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.
Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?
http://www.schneier.com/book-applied.html
Edit: Note, this really barely scratches the surface for building secure software. AC says how to apply cryptographic primitives correctly. It won't teach you how to avoid vulnerabilities specific to particular application domains (like CSS, SQL injection, etc...).
Earlier quoted context omitted.
> Of course it might be possible that the computer of the person who sold the Bitcoin was cracked. But that's not the fault of Bitcoin. Just like it's not the fault of the dollar if someone mugs you at gunpoint. Except robbing someone typically requires you to take physical risks and (threaten to) use violence. I'll be very curious to see any effective way of tracking down bitcoin thieves. If you have to be a securit…
You don't necessarily have to be a security expert to use Bitcoins, just if you want to run the client by yourself. If you don't have the required knowledge just pay a little bit to a "Bitcoin bank" that handles the task for you. In the real world you also don't carry your money with you all the time, but store it on a bank.
- Centralized money is bad! We need to create a perfectly decentralized, distributed economy!
- Oh no! It turns out that the average Joe will get burned really badly by this new decentralized system!
- But wait! What if we created these things called "banks" and provide people peace of mind and security by taking on some of this risk?!
- ...?
- Um... not profit.
Earlier quoted context omitted.
It is pretty clear that Mt Gox rolled back all trades from now to the first big unauthorized trade.
So if you had already done a legitimate trade it's gone? "Sorry you made some money there, but someone else got affect by something else, so we've undone that". So much for "There are no chargebacks on BitCoin"
Take the flash-crash last year. Yes, if you were a lucky one who bought GE at $3/share then hell yes you wanted that trade to count.
But to have an exchange it takes everybody acting in the interest of the group as well as themselves. The value to that over purely selfish motivations is that it creates a liquid market which benefits everybody involved.
Part of this is the acceptance of situations like this. In cases of attack or software defect, the only real viable option is to rollback. The only people this hurts are the 1% who tried to profiteer on the situation. Not rolling back would harm the other 99%. It's an easy call.
The only real tragedy would be if they cannot rollback accurately. You'd think this wouldn't be possible, but you never know... It seems as tho this site has had a known CSRF bugs for a while. This is not a hard thing to fix. It doesn't shine well upon their competence.
We shouldn't be surprised by this. This monetary have no authority behind it.
Earlier quoted context omitted.
You don't necessarily have to be a security expert to use Bitcoins, just if you want to run the client by yourself. If you don't have the required knowledge just pay a little bit to a "Bitcoin bank" that handles the task for you. In the real world you also don't carry your money with you all the time, but store it on a bank.
> In the real world you also don't carry your money with you all the time, but store it on a bank. In the real world, the banks are subject to regulation.
Earlier quoted context omitted.
> Someone sold a huge amount of Bitcoins. The market acted accordingly. It doesn't seem very free market to rollback the market and cancel all the free market trades that happened.
I agree. If one ever needed an example of why Mt. Gox or Bitcoin shouldn't be taken seriously. They had a withdrawal limit of $1000 per day, too. This was simply to save one more day of that. It makes you wonder if Mt. Gox actually had the hard currency to back up everyone's account balance.
Newest update: Apparently someone got the whole user account database of Mt.Gox I wont publish the link to it though for obvious reasons. Quick analysis: the database is legit, it contains user id, username, email if set, and a bcrypt hash. The hashes seem salted with a global salt.
Something weird is going on. I just downloaded the CSV file and my account was in there(I don't really have any bitcoins at the moment, so that's OK). But I just got a message when trying to log into GMail about 'suspicious' activity being detected on my account. My guess is that someone might have tried logging into my mail. Luckily my email password is unique, so I don't think anyone got in. I hope that other peopl…
Earlier quoted context omitted.
Trades are internal to Mt. Gox until you withdraw your money either as bitcoins or as USD. The compromised account had a $1000 per day withdraw limit, so the thief could only withdraw $1000 after selling all those coins. The rest of the cash is still within Mt. Gox, and therefore the state of the Mt. Gox DB can be rolled back to before all the coins were sold.
which makes me think mtgox got very lucky. I mean the hacker could overcome $1000 limit a day (roughly 80 bitcoins) by creating thousands of bogus accounts, putting on the market bid orders at $0.01 in all accounts, drive the market to the bottom like he did to fill his orders and quickly transfer 80 bitcoins from each account out of the exchange. he could get away with bitcoins worth of millions irreversibly and com…
Earlier quoted context omitted.
> Someone sold a huge amount of Bitcoins. The market acted accordingly. It doesn't seem very free market to rollback the market and cancel all the free market trades that happened.
I agree. If one ever needed an example of why Mt. Gox or Bitcoin shouldn't be taken seriously. They had a withdrawal limit of $1000 per day, too. This was simply to save one more day of that. It makes you wonder if Mt. Gox actually had the hard currency to back up everyone's account balance.
"It makes you wonder if The New York Stock Exchange actually had the hard currency to back up everyone's account balance."
That doesn't make any sense either.
