Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Those 500K Bitcoins that caused the flash crash weren't real

mtgox.com

Post reply on HN
Print view View original

131–140 of 176 posts

Re: Those 500K Bitcoins that caused the flash crash weren't real

#131

Post by khafra »

boyter wrote: post #124
bcl wrote: post #59

Earlier quoted context omitted.

1st rule of cryptography - don't try it at home. You'll get it wrong. There are any number of standard ways to protect passwords, there's no need for them to be reaching for the bottle of Snake Oil.

Rocky Heckman who is a security specialist as Microsoft http://blogs.msdn.com/b/rockyh/ summed it up in the best way I have heard so far. "Don’t write your own Crypto algorithms unless you have a Doctorate in Cryptography."

I think Thomas Ptacek takes it a necessary step further: "Don't implement crypto." Even if you're using a good algorithm, your implementation of it will have holes. The trouble is that the normal exploratory programming technique that gets a MVP up and running doesn't find security holes.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#132

Post by icebraining »

rick888 wrote: post #56
kristianp wrote: post #33

Earlier quoted context omitted.

You're saying MTGox is a bank, they're not, they are an exchange.

It seems they like to use this term, so bitcoin can claim it's still decentralized. Since it's obvious we do need banks for bitcoin (or a safe way to store our currency) and it's not very anonymous, what's the point of using it again? I would rather just use credit cards or cash.

You can keep your wallet file secure. Encrypt it, store it in a pen drive and secure it as you want.

The decentralization has more to do with the fact that no government can control the currency.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#133

Post by ignifero »

latch wrote: post #31
Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

don't disagree with most of what you said, but...you sure about this part? I would know that I could still withdraw my money because they have enough cash on hand for me to do so. http://en.wikipedia.org/wiki/Fractional-reserve_banking Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).

OK we are taking about vastly different scales here, but there is no absolutely trusted scheme in the world. The US has been printing money since 2008 to cover the losses of the Crisis, so the real world has an advantage here.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#134

Post by 16s »

MattBearman wrote: post #101
walkon wrote: post #95

Earlier quoted context omitted.

Not sure why I'm downvoted, SHA-512 is obviously better than MD5 and we don't know the details. The constant spewing that bcrypt is the only way to hash a password is getting old fast. Ok, whatever, keep downvoting, fuckers.

And bcrypt is better than sha512, why use an inferior option when you don't have to? bcrypt both exists and is free.

Many are forced to use insecure hashing for compatibility reasons with outside vendors. Google email for orgs/colleges has two options for hash exchange (or used too... it may be different now) MD5 and SHA1. So you could not migrate user accounts unless the hashes were MD5 or SHA1.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#135

Post by RockyMcNuts »

wiredfool wrote: post #17

What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…

That's the whole point of an unregulated currency, right?

Banks can do whatever they want, they're not subject to reserve requirements, or for that matter any kind of oversight.

I'm not sure how regulated fractional reserve banking is a terrible thing, but a completely unregulated bank is a better thing.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#136

Post by bnr »

daeken wrote: post #22
wiredfool wrote: post #17

What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…

By using floating point values for a user's balances (per-currency) in the DB, they effectively did make themselves a fractional reserve bank, even if the spread was likely small. Most every transaction would've added a tiny bit of an error value -- given enough time, this would've added up pretty considerably.

IIRC that was Bitcoin7, another exchange, called out for using floats to store balances.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#137

Post by eli »

rmc wrote: post #119
StavrosK wrote: post #13

Earlier quoted context omitted.

It wasn't thieves, was it? It was just a guy who bought bitcoins during the crash and withdrew some. That's perfectly legal, from where I'm standing. EDIT: It looks like the guy I'm talking about only withdrew 640ish coins, so this must be someone else.

No, MtGox said that the thief was able to make a larger withdrawal (approximately 2000 BTC) before our security measures stopped further action.

I wonder if they don't really mean, "2000 of the coins created by the thief and then sold to buyers were withdrawn before we could shut things down"

Re: Those 500K Bitcoins that caused the flash crash weren't real

#138

Post by owenmarshall »

Jach wrote: post #35
gojomo wrote: post #28

Earlier quoted context omitted.

Not necessarily. Let's say the salt is a combination of a per-user salt in the database, a per-user salt from a file on disk, and a per-system salt that's entered at the console at startup and held in memory. A DB compromise doesn't reveal the other 2 salts. A full filesystem image doesn't reveal the third salt. Even an interactive root compromise would need to know to take an image of the running system's memory to…

That's very clever. Though I doubt this is what Mt. Gox is actually doing...

That idea is absolutely not clever. It's a system that would be difficult to implement, fragile, and most importantly would provide almost no added security.

Programmers: shut the fuck up and use a well known password derivation function. Stop the NIH wanking -- homebrew cryptography is about as useful as seeing the local witch doctor for a heart attack.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#139

Post by SlipperySlope »

chc wrote: post #82
Andys wrote: post #63

Earlier quoted context omitted.

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

Is a site inherently safer if you use Java?

The Java language is designed for safety, above performance, and ease of creating code. So it is more expensive to create a Java financial system. But safer.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#140

Post by rick888 »

wmf wrote: post #68
rick888 wrote: post #56

Earlier quoted context omitted.

It seems they like to use this term, so bitcoin can claim it's still decentralized. Since it's obvious we do need banks for bitcoin (or a safe way to store our currency) and it's not very anonymous, what's the point of using it again? I would rather just use credit cards or cash.

Mt.Gox really is an exchange; the whole point of the site is to convert between BTC and USD. If you wanted a bank, you'd use something else. It's also not clear to me that it's safer to store BTC on a server.

It is an exchange, but hackers are having a field day. People are realizing what the world realized many years ago: we need banks. I feel like bitcoin is going through all of the growing pains and making the same exact mistakes we already learned about currency.
Post reply on HN