Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crypto.com accounts had unauthorized withdrawals

crypto.com

Post reply on HN
Print view View original

251–260 of 321 posts

Re: Crypto.com accounts had unauthorized withdrawals

#251

Post by IAmEveryone »

gitfan86 wrote: post #135
dogman144 wrote: post #124

Earlier quoted context omitted.

I do a bit of the same and this seems to be a silly thing to communicate as part of a security audit. Ok, step 1 SMB insurance company paying me to audit - by not being in Afghanistan, you have a severely reduced risk of business invasion and extortion. Seems like a really wonky way to communicate a risk profile and first-exposure to security professionals by a SMB. Plenty of SMBs with janky POS systems get pretty na…

I'm advising people at the executive level. They do not care about the details of hashing PII, they want to know how likely it is that they will be targeted and how likely that attack is to succeed. And the fact is that an insurance company gets targeted far less often than crypto companies.

That must be my mistake... I only ever advise companies on the parking level.

Re: Crypto.com accounts had unauthorized withdrawals

#253

Post by qqii »

ouid wrote: post #232

I'm confused. Ostensibly the tradeoff for crypto is that only you know the secret factors that allow you to spend money, but there is no possibility of reversing a fraudulent transaction. If you give the keys to someone else, you lose the first condition, which was the benefit, but keep the second condition, which was the drawback. There was no reason to give anyone anyone else your keys!

There's no reason you cannot construct a token that can be frozen and reversed - USDT (other issues as side) being an example. Accounts as we know them don't have to be at the level of public address-private key but rather a smart contract as seen by Loopring.

The difference is what was centralised is now decentralised, what was implicit and required trust is now explicit and requires formal verification.

Re: Crypto.com accounts had unauthorized withdrawals

#254

Post by KeAShizukuTio »

nefitty wrote: post #77
cornedor wrote: post #66

Earlier quoted context omitted.

Wouldn't this also allow an attacker to add his own 2FA?

This is hilarious. This company is literally at the apex of the crypto industry and this is the kind of mistake they make. Yeah, immutable smart contracts written by their fellow proponents will also save the world lol

Crypto bros versus banks that have been doing this for a 100 years.

Re: Crypto.com accounts had unauthorized withdrawals

#255

Post by thebean11 »

thehappypm wrote: post #250
thebean11 wrote: post #246

Earlier quoted context omitted.

I'm not sure, is the x86 instruction set too low level? Yes if you expect users to interact with it directly, but not for user facing products to be built on top of. You can point to centralized products built on top of blockchain, but also decentralized ones.

Yet the popular ones are centralized, no?

Uniswap is one of the biggest exchanges and is fully decentralized. Things are trending that way.

Re: Crypto.com accounts had unauthorized withdrawals

#256

Post by KeAShizukuTio »

Spoom wrote: post #128
thow-58d4e8b wrote: post #68

Earlier quoted context omitted.

Venture capital used to be about placing small, diverse bets on a lot promising startups - everybody in the process was trying to make the world a better place Since about 2018, VC game changed - now it's about brazenly placing massive bets on a small set of startups of increasingly questionable utility, using the funds and clout to ram their way through into monopoly positions. Not a speck of morality involved anymo…

It feels like a bubble to me. When I see Matt Damon shilling crypto, it reminds me of pets.com Superbowl ads. I think reality will catch up sooner or later.

I owned shares in a teak plantation in the late 1990s. We make mistakes when blinded by greed.

Re: Crypto.com accounts had unauthorized withdrawals

#257

Post by KeAShizukuTio »

sneak wrote: post #183
gilrain wrote: post #174

Earlier quoted context omitted.

I wonder what percentage of their total volume it is that “happens” to be used by hackers.

People who are not criminals deserve transaction privacy, as well.

Haha tell that to the IRS they'd love it.

Re: Crypto.com accounts had unauthorized withdrawals

#259

Post by dragonwriter »

arcticbull wrote: post #233
dragonwriter wrote: post #227

Earlier quoted context omitted.

> Banks do not work this way Yes, they do. > Banks have insurance policies, both private and federal, that would cover the losses. The federal insurance policy covers you if, after operating this way (or for some other reason) the bank ends up without money to cover your account (and, the regulation that comes with the insurance means that it's more likely that the Federal government will force the sale of your bank…

Banks do not take money from other accounts to cover operating losses, lol, thats almost certainly several crimes. [citation needed]. > But banks still operate as described (and using some of their pool of assets to buy private insurance is functionally the same as just adjusting the balances of people it is compensating for losses and increasing risk to others by doing so, except it smooths things a bit over time at…

> Banks do not take money from other accounts to cover operating losses

Banks don't keep money segregated in accounts.

Banks have reserves, and accounts basically record the right of people to draw money.

When they cover a fraud loss from one account by increasing the balance for that account to make the owner whole, they are doing exactly what crypto.com would be doing. Neither involves taking balances from others accounts, but both increase the risk of inability to cover accounts (including those of other people) as a result. Now, yes, banks provide consumers with more protection against the risk this creates, and are regulated in ways which make them less likely to do it to an extent which would create as much risk as a hype driven crypto exchange in the first place, but in terms of the basic mechanics, it is not any different than what has been suggested.

The model of money actually being held segregated in an account works for things like lawyers holding client funds and a very few other specific things, but it doesn't really capture what goes on with banks at all.

Re: Crypto.com accounts had unauthorized withdrawals

#260

Post by matheusmoreira »

nefitty wrote: post #77
cornedor wrote: post #66

Earlier quoted context omitted.

Wouldn't this also allow an attacker to add his own 2FA?

This is hilarious. This company is literally at the apex of the crypto industry and this is the kind of mistake they make. Yeah, immutable smart contracts written by their fellow proponents will also save the world lol

> This company is literally at the apex of the crypto industry

Cryptocurrency was not even supposed to have these pseudobanks called exchanges leading this space. It wasn't even supposed to be an "industry".

People were supposed to mine cryptocurrency on their own commodity hardware and use that to transact amongst themselves.

Post reply on HN