Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

bitcoincharts.com

Post reply on HN
Print view View original

181–190 of 262 posts

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#181

Post by burgerbrain »

aquarin wrote: post #167
aquarin wrote: post #160

Earlier quoted context omitted.

I should say it again: This monetary system have no authority behind it and as such is going to nowhere. Disclaimer: I work as financial analytic and at least have some knowledge of how money work.

Let me explain what I mean: "Real" money are just a tokens, transferring the "Trust" between one market participant to authority and other market participant to authority. By "trust" I mean that every participants believe that Rules in the market will be followed. When you have N market participants you have N*(N-1)/2 ways to exchange "trust". If I understand correctly Bitcoin is N to N system. When you have Authorit…

Accidentally upvoted this... HNs really needs to have an undo vote feature, even if it is as blunt as slashdots "undo moderation".

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#183

Post by marshray »

sukuriant wrote: post #177
marshray wrote: post #104

Earlier quoted context omitted.

I agree. If one ever needed an example of why Mt. Gox or Bitcoin shouldn't be taken seriously. They had a withdrawal limit of $1000 per day, too. This was simply to save one more day of that. It makes you wonder if Mt. Gox actually had the hard currency to back up everyone's account balance.

I was under the understanding that not even real banks have all the money of their users on hand. What point are you trying to make?

"Real banks" are highly regulated and in the US are backed up by the US government. I don't know of too many other entities that can handle other people's assets with such low reserve requirements without being considered fraudulent. If there are any, I suspect they're heavily regulated or at least exempted as a speculative private fund.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#184

Post by rorrr »

lubos wrote: post #163
jtchang wrote: post #156

Earlier quoted context omitted.

They look like salted hashes to me.

you can recognize salted hashes from unsalted ones just by looking at them? open the file and search for 5f4dcc3b5aa765d61d8327deb882cf99, at least 1,600 passwords in that list are unsalted. (those without $1$)

5f4dcc3b5aa765d61d8327deb882cf99 = md5("password")

for those who don't know

Man, these programmers are fucking amateurs. It's a FUCKING TRADING PLATFORM.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#185

Post by wcoenen »

bradleyland wrote: post #157
soult wrote: post #152

Earlier quoted context omitted.

I can confirm that the alleged dump is the real deal. Some passwords are md5 hashes, some are salted md5 hashes (utilizing the crypt[0] function). I did not log in for a long time and my password was still unsalted, so I assume that converting to salted passwords was done either automatically on login or on password changes. 0: http://www.kernel.org/doc/man-pages/online/pages/man3/crypt....

I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.

To give some context, that financial exchange had a trading volume of less than 1000 dollars/day six months ago. http://i.imgur.com/HHlnd.png

The original author sold the site in March before things got really serious.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#186

Post by marshray »

michaelf wrote: post #172
Hawramani wrote: post #169

Earlier quoted context omitted.

Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?

A great place to start is "Applied Cryptography" by Bruce Schneier. http://www.schneier.com/book-applied.html Edit: Note, this really barely scratches the surface for building secure software. AC says how to apply cryptographic primitives correctly. It won't teach you how to avoid vulnerabilities specific to particular application domains (like CSS, SQL injection, etc...).

That book is old, and though still basically correct, there's much better ways to learn about the practice of developing secure systems. I recommend "Cryptography Engineering" by Ferguson, Schneier, Kohno which is a more modern descendant of Schneier's AC.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#187

Post by nokcha »

Hawramani wrote: post #169
bradleyland wrote: post #157

Earlier quoted context omitted.

I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.

Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?

For web security, I'd recommend checking out this question on Stack Overflow: http://stackoverflow.com/questions/72394/what-should-a-devel...

Also the OWASP top ten vulnerabilities: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#188

Post by sunchild »

encoderer wrote: post #174
rmc wrote: post #144

Earlier quoted context omitted.

So if you had already done a legitimate trade it's gone? "Sorry you made some money there, but someone else got affect by something else, so we've undone that". So much for "There are no chargebacks on BitCoin"

I don't understand all the anger at the idea of rolling-back. Hasn't anybody trading bitcoins been watching how major equities exchanges have worked for decades? Take the flash-crash last year. Yes, if you were a lucky one who bought GE at $3/share then hell yes you wanted that trade to count. But to have an exchange it takes everybody acting in the interest of the group as well as themselves. The value to that over…

Just to be clear, I'm not taking a position, only asking a question: how does the exchange layer affect the fundamental goals of bitcoin, esp. the notion that no centralized authority controls monetary policy?

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#189

Post by marshray »

burgerbrain wrote: post #180
marshray wrote: post #104

Earlier quoted context omitted.

I agree. If one ever needed an example of why Mt. Gox or Bitcoin shouldn't be taken seriously. They had a withdrawal limit of $1000 per day, too. This was simply to save one more day of that. It makes you wonder if Mt. Gox actually had the hard currency to back up everyone's account balance.

The whole point of the exchange is that what you have is only worth what others participating in the exchange are willing to pay. "It makes you wonder if The New York Stock Exchange actually had the hard currency to back up everyone's account balance." That doesn't make any sense either.

The point of an exchange is that you can trade one thing for another. E.g., US dollars for bitcoins.

Mt. Gox seems to act like both an exchange and a brokerage. Presumably people have an "account" in which they can deposit and withdraw various currencies.

"It makes you wonder if The New York Stock Exchange actually had the hard currency to back up everyone's account balance." That doesn't make any sense either.

I guess you don't have an account with any brokers participating in the NYSE or other exchanges. You can't open an account without writing them a check. Once you've given them money, you can trade NYSE stocks which may gain or lose value. But the dollars you deposit into your account you should be able to get them out again with low risk.

Each currency or security should represent a zero-sum balance sheet for the exchange as a whole. Unless Mt. Gox spent the hard cash for themselves and hoped the market for bitcoins stayed healthy.

Who do they think they are, a Wall Street investment bank?

I agree it doesn't make any sense (but for a different reason).

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#190

Post by Ixiaus »

SeanLuke wrote: post #165
olex wrote: post #126

Earlier quoted context omitted.

They were hashed using the standard php crypt() method, it generates a salt for every password encrypted. I'm in that database and was able to generate the exact hash. Luckily I use one-time passwords with such things...

Wait. The effective exchange for bitcoins worldwide is using PHP internally? People are actually trusting this with thousands of dollars in cash?

Haha. I came from PHP and won't ever go back, but, you would be surprised what people use PHP for.
Post reply on HN