Those 500K Bitcoins that caused the flash crash weren't real • Hacker News Board

Re: Those 500K Bitcoins that caused the flash crash weren't real

#41

Post by tedunangst » Fri, Jul 01, 2011, 1:38 AM UTC

latch wrote: post #37

Xk wrote: post #34

Earlier quoted context omitted.

> don't disagree with most of what you said, but...you sure about this part? Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there would be other serious problems. > Or if you want a more practical example, keep watching Greece If I was in Greece, I would not have my money in one of their banks.

I thought we were talking within the context of "serious problems". As for greece, well..it happened to Washington Mutual in 2008 - the largest savings in loan institution in the US. Of course, this is only one of many US banks which were not able to produce money when it was wanted in 2008. There's a reason banks have a legal right to refuse a withdrawal, specifically because they may not have enough funds. That rea…

I had my "life savings" in WaMu. Now it's in Chase. I didn't lose a penny. At no point was I unable to withdraw my money.

What happened with Washington Mutual is not what's going to happen if there's a run on Mt Gox.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#42

Post by chc » Fri, Jul 01, 2011, 1:38 AM UTC

MaxGabriel wrote: post #30

patrickyeon wrote: post #24

Earlier quoted context omitted.

Probably because it adds nothing to the discussion of the article at hand.

Yeah but its not like there's a discussion thread anywhere to critique the UI of MtGox's website, and these complaints have to be made so that these problems can be fixed. (I had this same problem)

There's a contact link at the bottom of Mt Gox's site. That would be the best place to address your "Dear Mt Gox" messages.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#43

Post by uxp » Fri, Jul 01, 2011, 1:40 AM UTC

gojomo wrote: post #28

daeken wrote: post #15

Earlier quoted context omitted.

That would mean that logins would have to go through 3 different servers. If anything, I would be more worried about security in that case.

Not necessarily. Let's say the salt is a combination of a per-user salt in the database, a per-user salt from a file on disk, and a per-system salt that's entered at the console at startup and held in memory. A DB compromise doesn't reveal the other 2 salts. A full filesystem image doesn't reveal the third salt. Even an interactive root compromise would need to know to take an image of the running system's memory to…

Why reinvent the wheel using engineering techniques you only have cursory knowledge of from reading an encyclopedia?

There is a standard method of securing online accounts, using known methods that are currently known to be perfectly safe in every application from financial institutions to the latest social networking site. Triple-salting passwords is not that method.

http://codahale.com/how-to-safely-store-a-password/

http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...

Re: Those 500K Bitcoins that caused the flash crash weren't real

#44

Post by tedunangst » Fri, Jul 01, 2011, 1:43 AM UTC

kristianp wrote: post #33

wiredfool wrote: post #17

What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…

You're saying MTGox is a bank, they're not, they are an exchange.

When people are unable to get their money out of an exchange, they don't much care about the difference.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#45

Post by harshpotatoes » Fri, Jul 01, 2011, 1:46 AM UTC

latch wrote: post #37

Xk wrote: post #34

Earlier quoted context omitted.

> don't disagree with most of what you said, but...you sure about this part? Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there would be other serious problems. > Or if you want a more practical example, keep watching Greece If I was in Greece, I would not have my money in one of their banks.

I thought we were talking within the context of "serious problems". As for greece, well..it happened to Washington Mutual in 2008 - the largest savings in loan institution in the US. Of course, this is only one of many US banks which were not able to produce money when it was wanted in 2008. There's a reason banks have a legal right to refuse a withdrawal, specifically because they may not have enough funds. That rea…

I don't know of a single person unable to withdraw their money from WaMu as it went under. All of WaMu's accounts were then passed on to chase, and chase honord them. If WaMu went under, the savings accounts would have been FDIC insured. None of that will happen if Mt Gox is compromised in some catastrophic way.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#46

Post by tedunangst » Fri, Jul 01, 2011, 1:47 AM UTC

jsprinkles wrote: post #36

rlpb wrote: post #6

"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?

What is the benefit of bcrypt over several million rounds of SHA-512? It seems to me that repeating the hash function is the adjustable work factor that bcrypt seeks to allow and SHA-2 is already in most languages without an additional library.

Not much. You are perhaps a little more likely to find super-tuned GPU/FPGA implementations of SHA2 than pessimized blowfish, but it's not inconceivable for someone to write the latter. bcrypt is easier to pronounce than PBKFD2.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#47

Post by latch » Fri, Jul 01, 2011, 1:53 AM UTC

tedunangst wrote: post #41

latch wrote: post #37

Earlier quoted context omitted.

I thought we were talking within the context of "serious problems". As for greece, well..it happened to Washington Mutual in 2008 - the largest savings in loan institution in the US. Of course, this is only one of many US banks which were not able to produce money when it was wanted in 2008. There's a reason banks have a legal right to refuse a withdrawal, specifically because they may not have enough funds. That rea…

I had my "life savings" in WaMu. Now it's in Chase. I didn't lose a penny. At no point was I unable to withdraw my money. What happened with Washington Mutual is not what's going to happen if there's a run on Mt Gox.

There are stories (see consumerist.com) of cash withdrawals not being possible.

I admit I got a little off track though. My parent specifically stated withdraw money when he wants. There's plenty of evidence that at the peak of the crisis, some people had problems. But I agree, it seemed to have been few, and in the context of Mt Gox, it isn't really relevant.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#48

Post by eli » Fri, Jul 01, 2011, 1:55 AM UTC

kristianp wrote: post #33

wiredfool wrote: post #17

What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…

You're saying MTGox is a bank, they're not, they are an exchange.

An exchange. That accepts deposits. And holds your money for you. Like a bank.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#49

Post by latch » Fri, Jul 01, 2011, 1:58 AM UTC

tedunangst wrote: post #39

latch wrote: post #31

Earlier quoted context omitted.

don't disagree with most of what you said, but...you sure about this part? I would know that I could still withdraw my money because they have enough cash on hand for me to do so. http://en.wikipedia.org/wiki/Fractional-reserve_banking Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).

mtgox accounts are not FDIC insured.

I understand that. I am curious how effective insurance deposite works in the face of a country-wide breakdown. I know Greece has a deposit fund, I'm curious to see how effective it'll be (does it actually cover 100% of the deposited money (up to the maxium per account)?)

Re: Those 500K Bitcoins that caused the flash crash weren't real

#50

Post by drivebyacct2 » Fri, Jul 01, 2011, 2:18 AM UTC

latch wrote: post #49

tedunangst wrote: post #39

Earlier quoted context omitted.

mtgox accounts are not FDIC insured.

I understand that. I am curious how effective insurance deposite works in the face of a country-wide breakdown. I know Greece has a deposit fund, I'm curious to see how effective it'll be (does it actually cover 100% of the deposited money (up to the maxium per account)?)

It doesn't. The FDIC doesn't have a fraction of the money needed to insure a fraction of the money that is supposedly FDIC-insured. More over, the United States likely lacks the gold to back our current currency, let alone the currency needed to prop up those who lose money in the situation of the decreasing number of banks failing.