Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Those 500K Bitcoins that caused the flash crash weren't real

mtgox.com

Post reply on HN
Print view View original

81–90 of 176 posts

Re: Those 500K Bitcoins that caused the flash crash weren't real

#81

Post by zachanker »

tedunangst wrote: post #76
Locke1689 wrote: post #72

Earlier quoted context omitted.

Which means that they're not using bcrypt, which means they still have no idea what they're talking about and are probably insecure.

They could be using PBKDF2, but if they were, they probably should have said the magic words. Also, the iteration count is kind of important. If it's triple-iterated, that won't do much good.

Even with the iteration count, SHA512 is not exactly meant to be slow. They're taking the long way around to try and get the security of bcrypt... without just using bcrypt.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#82

Post by chc »

Andys wrote: post #63
Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

Is a site inherently safer if you use Java?

Re: Those 500K Bitcoins that caused the flash crash weren't real

#83

Post by tptacek »

chc wrote: post #82
Andys wrote: post #63

Earlier quoted context omitted.

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

Is a site inherently safer if you use Java?

Then if you use Wordpress? Yes.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#84

Post by hisabness »

TheSkeptic wrote: post #27

Everybody should give the people behind Mt. Gox a break. These guys make real banks look good - no small feat!

Something here is still real fishy:

March, 2011 – MtGox.com (Mt. Gox), now the world’s leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions. In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account’s credentials were obtained.March, 2011 – MtGox.com (Mt. Gox), now the world’s leading Bitcoin exchange, was purchased by Tibanne Co. Ltd. As part of the purchase agreement, for a period of time, Tibanne Co. Ltd was required to pay the previous owner a percentage of commissions. In order to audit and verify this percentage, the previous owner retained an admin level user account. This account was compromised. So far we have not been able to determine how this account’s credentials were obtained.

A quick search of Google for Tibanne Co Ltd leads to Tibanne.com:

DOMAIN: TIBANNE.COM

RSP: KalyHost

URL: http://www.kalyhost.com/

created-date: 2009-10-02 05:43:17

updated-date: 2011-05-25 15:15:09

registration-expiration-date: 2012-10-02 05:43:17

owner-organization:

owner-name: Mark Karpeles

Does this mean Mark sold Mt. Gox to himself and in the process created a superuser account so he could manipulate the exchange to his benefit? Sounds like he could be taking a page out of the Ultimate Bet / Absolute Poker playbook.

Probably would be willing to take him at his word if the explanation of the flash crash didn't change every few hours. And/or if he and others didn't mobb the guy who put in the low bid during the crash.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#85

Post by trafficlight »

Andys wrote: post #63
Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

Where might I find that plugin?

Re: Those 500K Bitcoins that caused the flash crash weren't real

#86

Post by davidhollander »

zachanker wrote: post #81
tedunangst wrote: post #76

Earlier quoted context omitted.

They could be using PBKDF2, but if they were, they probably should have said the magic words. Also, the iteration count is kind of important. If it's triple-iterated, that won't do much good.

Even with the iteration count, SHA512 is not exactly meant to be slow. They're taking the long way around to try and get the security of bcrypt... without just using bcrypt.

> Even with the iteration count, SHA512 is not exactly meant to be slow.

Increasing iteration count is synonymous with intending something to be slow. BCrypt itself uses a default of 2^10 iterations in most bindings. PBKDF2 + and an NIST studied hashing algo like SHA512 is a perfectly valid method.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#87

Post by chc »

tptacek wrote: post #83
chc wrote: post #82

Earlier quoted context omitted.

Is a site inherently safer if you use Java?

Then if you use Wordpress? Yes.

I meant than PHP. The implication seemed to be "WordPress is made with PHP, and WordPress isn't bank-quality software, so would you want to trust your money to something made with PHP?" I would trust the credentials of the people behind the site before I'd even give a second's thought to the programming language. (Of course, that doesn't help Mt Gox much either.)

Re: Those 500K Bitcoins that caused the flash crash weren't real

#88

Post by SeoxyS »

Andys wrote: post #63
Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

There's nothing inherently wrong about using the PHP language or the MySQL RDBMS to build a secure website. Most of the terrible code on the internet is in PHP/MySQL, and most of the PHP/MySQL code is terrible—but that is not a deficiency of the language, but rather a consequence of its ease of use and popularity.

That, though, in no way means that you can't build a good, secure website on the LAMP stack.

It's just a (rather obvious) fact that if you're a bad developer, then you're going to build an insecure site, most likely on LAMP. If you're a good developer, you're probably going to build a good site, which might be on a less common platform, but equally as (or more) likely on LAMP, too.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#90

Post by nowarninglabel »

eli wrote: post #48
kristianp wrote: post #33

Earlier quoted context omitted.

You're saying MTGox is a bank, they're not, they are an exchange.

An exchange. That accepts deposits. And holds your money for you. Like a bank.

A bank is a legally defined concept, this exchange is not one.
Post reply on HN