Live data from Hacker News

“My PGP key is compromised, and at least many of my bitcoins stolen”

twitter.com

141–150 of 564 posts

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#141
post #86

Would this happen if his wallet was a hardware wallet like a ledger or trezor?

999,999 times out of a million, the answer is no. the 1 time out of a million is when an attacker manages to intercept the hardware wallet being shipped to the victim and tamper with it.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#142
Could this be a "boating accident" since it's tax season? Or maybe only his Twitter was hacked? No info from him at his mastodon https://mastodon.social/@lukedashjr@bitcoinhackers.org

If true this is absolutely devastating. Somewhat funny too, but devastating.

edit: Well, it's confirmed. Insane.

https://twitter.com/peterktodd/status/1609655629903265795

https://twitter.com/peterktodd/status/1609666001251229696

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#143

Earlier quoted context omitted.

Speaking of paranoid, that link you've posted, isn't that a link to a server that's known to be compromised, and also an apparent watering hole for crypto wallet holders? Am I unreasonable in thinking that's a very scary link?

1. Disable JavaScript. 2. Access (almost) any website in the internet 3. ????? 4. Profit edit: Mastodon doesn't work without JavaScript, holy hell. We truly are living in a dystopia. Thankfully you can still access his profile from another trusted instance such as mastodon.social at https://mastodon.social/@lukedashjr@bitcoinhackers.org

I always have JavaScript disabled by default (uMatrix policy), but (0) there's many other attack vectors, to my layman understanding, and (1) at any rate that one's a Mastodon instance and those are blank pages without JS.

I'm electing to add new URL regexps to my uBlock filters, to reduce the risk of accidentally clicking a link similar to this. I don't think I want to visit any web domain that caters to people who hold crypto wallets.

    /.*coin.*/
    /.*crypto.*/
    /.*eth.*/

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#145
post #60

Earlier quoted context omitted.

Say your wife is a well known Bitcoin billionaire. And your wife bought something from my eBay store. Now I have your home address. And if I am a ruthless character then I quietly break into your house one day with th3e objective of leaving no sign I was ever there. Search for written down passwords, take a photo, leave.

Okay, so assuming you get past this theoretical billionaire's physical security (at a minimum gated fences and an alarm system; if they're actually a billionaire, probably 24/7 armed private security as well) and into their mansion, how long do you think it would take you to search their 7 bedroom 10000 square foot mansion for these written down passwords which you have no information as to whether they even exist?

You get hired as a cleaner

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#147

Earlier quoted context omitted.

Experts make mistakes all the time, fail to see hidden risks, like Challenger explosion. This will never see mainstream adoption at this rate. If the hacker is smarter, being smart is not good enough.

This is not quite the same. Experts did make mistakes for the challenger explosion, but they did much better than the average person. Put 1000 people at complete random into a room and say design and build a rocket, I suspect they won't even get to the build phase after several years. When it comes to something everyone should be able to do, an expert making a mistake is a bad omen for the rest of us.

The vast majority of people do not get hacked, because they are not worth being hacked. But being a big target means hackers will devote more resources to getting your coins.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#148

Earlier quoted context omitted.

How on earth are normal people supposed to trust bit coin. When best practice is to treat it like paper money.

If BTC is $1/coin , it is fine to not be paranoid. $16,000+ changes the game completely.

That's not how it works at all. "Bitcoin" is just a unit of measure, except for the brief moment of mining a new one. Would you be less paranoid if your savings were denominated in pennies vs dollars?

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#149

Just for a little context luke jr was infamous on cryptocurrency forums for being adamant that the sun revolved around the earth, all religions other than catholicism are evil, there is an "ethical aspect to slavery" and that bitcoin's 1 KB/s throughput was too much and should be cut down even further. https://archive.is/sS5Ml https://archive.is/DrP83 https://np.reddit.com/r/Christianity/comments/36w6nw/why_did... ht…

Someone in the bitcoin parody group r/Buttcoin compiled this "gigathread" of all his hair-raising quotes

https://www.reddit.com/r/Buttcoin/comments/4936kw/lukejr_is_...

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#150

Apparently his servers keep getting hacked, which doesn’t reflect well on his security practices: https://twitter.com/LukeDashjr/status/1606885577843957762

Assuming this physical access claim is truthful (and i have doubts), I would feel at this point its budget letting him down. If your threat model includes "targeted attacks from people with physical access", it's time to run a vm on aws or azure and use the tooling they make available to secure it further. If you want tonnes of resourcing at a quite low budget, there's only a certain amount of "calling out" the group…

I believe most of these "physical attacks" are datacenter support teams being socially engineered and not state-level actors. They hook up a USB rescue drive to "help" you back into your server, using full disk encryption or locking down the BIOS can thwart such attacks.
Post reply on HN