Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Those 500K Bitcoins that caused the flash crash weren't real

mtgox.com

Post reply on HN
Print view View original

31–40 of 176 posts

Re: Those 500K Bitcoins that caused the flash crash weren't real

#31

Post by latch »

Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

don't disagree with most of what you said, but...you sure about this part?

I would know that I could still withdraw my money because they have enough cash on hand for me to do so.

http://en.wikipedia.org/wiki/Fractional-reserve_banking

Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).

Re: Those 500K Bitcoins that caused the flash crash weren't real

#33

Post by kristianp »

wiredfool wrote: post #17

What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…

You're saying MTGox is a bank, they're not, they are an exchange.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#34

Post by Xk »

latch wrote: post #31
Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

don't disagree with most of what you said, but...you sure about this part? I would know that I could still withdraw my money because they have enough cash on hand for me to do so. http://en.wikipedia.org/wiki/Fractional-reserve_banking Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).

> don't disagree with most of what you said, but...you sure about this part?

Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there would be other serious problems.

> Or if you want a more practical example, keep watching Greece

If I was in Greece, I would not have my money in one of their banks.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#35

Post by Jach »

gojomo wrote: post #28
daeken wrote: post #15

Earlier quoted context omitted.

That would mean that logins would have to go through 3 different servers. If anything, I would be more worried about security in that case.

Not necessarily. Let's say the salt is a combination of a per-user salt in the database, a per-user salt from a file on disk, and a per-system salt that's entered at the console at startup and held in memory. A DB compromise doesn't reveal the other 2 salts. A full filesystem image doesn't reveal the third salt. Even an interactive root compromise would need to know to take an image of the running system's memory to…

That's very clever. Though I doubt this is what Mt. Gox is actually doing...

Re: Those 500K Bitcoins that caused the flash crash weren't real

#36

Post by jsprinkles »

rlpb wrote: post #6

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

What is the benefit of bcrypt over several million rounds of SHA-512? It seems to me that repeating the hash function is the adjustable work factor that bcrypt seeks to allow and SHA-2 is already in most languages without an additional library.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#37

Post by latch »

Xk wrote: post #34
latch wrote: post #31

Earlier quoted context omitted.

don't disagree with most of what you said, but...you sure about this part? I would know that I could still withdraw my money because they have enough cash on hand for me to do so. http://en.wikipedia.org/wiki/Fractional-reserve_banking Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).

> don't disagree with most of what you said, but...you sure about this part? Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there would be other serious problems. > Or if you want a more practical example, keep watching Greece If I was in Greece, I would not have my money in one of their banks.

I thought we were talking within the context of "serious problems". As for greece, well..it happened to Washington Mutual in 2008 - the largest savings in loan institution in the US. Of course, this is only one of many US banks which were not able to produce money when it was wanted in 2008.

There's a reason banks have a legal right to refuse a withdrawal, specifically because they may not have enough funds. That reason is: because it has and will happen.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#38

Post by [deleted] »

StavrosK wrote: post #13
lwat wrote: post #3

That 2000BTC the thieves made off with is worth about $32,000 at the moment.

It wasn't thieves, was it? It was just a guy who bought bitcoins during the crash and withdrew some. That's perfectly legal, from where I'm standing. EDIT: It looks like the guy I'm talking about only withdrew 640ish coins, so this must be someone else.

[deleted]

Re: Those 500K Bitcoins that caused the flash crash weren't real

#39

Post by tedunangst »

latch wrote: post #31
Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

don't disagree with most of what you said, but...you sure about this part? I would know that I could still withdraw my money because they have enough cash on hand for me to do so. http://en.wikipedia.org/wiki/Fractional-reserve_banking Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).

mtgox accounts are not FDIC insured.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#40

Post by zachanker »

Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

It was crypt-MD5, the fact that they call it MD5 with salt is generous at best. They seem to have made the decision to move to crypt-MD5. I don't really have any faith in their ability to secure the servers.
Post reply on HN