Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“My PGP key is compromised, and at least many of my bitcoins stolen”

twitter.com

Post reply on HN
Print view View original

271–280 of 564 posts

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#271

Post by gruez »

samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the internet. You're trying to paint a story of "well if a bitcoin core developer can't secure his coins, then who can!?!?", but in this case it looks like he was being an idiot. You can lead a horse to water, but you can't make him drink.

[1] https://bitcoin.org/en/choose-your-wallet

edit: on twitter he denied that he kept his wallet file on a server

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#272

Post by lrvick »

tsimionescu wrote: post #202
lampshades wrote: post #168

Earlier quoted context omitted.

That’s why you don’t store millions of dollars in your physical location. You break up the seed and disperse it among several bank lock boxes. (See https://en.m.wikipedia.org/wiki/Shamir's_Secret_Sharing) . Keep a small amount in a hot wallet for convenience and a larger amount (but not too large) in a cold wallet accessed via hardware. But the bulk shouldn’t be accessible without breaking into at least two lock vaul…

Why just two lock vaults and not some army bunkers, together with the nuclear codes preferably? At some point this level of care becomes more than absurd.

What do you think banks do? When you store a -lot- of value like a pile of gold bars, you are going to need more than a foam and aluminum hotel safe.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#273

Post by vbo »

Barrin92 wrote: post #54
vbo wrote: post #37

[flagged]

because it's a useless problem to solve. The affected person going "FBI help me please" is the definition of that 'Bike Fall' meme. The answer to these situations is, use a currency where you can call someone that can roll your transaction back.

That’s one answer. But the question also applies to non-cryptocurrency uses of cryptography where you need to guard your private keys (like identity) — ie how to best enable people to use their keys while keeping them safe and also allowing for some form of recovery.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#274

Post by lrvick »

green-eclipse wrote: post #40
jtchang wrote: post #18

If you hold a large amount of bitcoin your threat model should be way above the average person. It sounds like his infrastructure was specifically targeted. It can be very difficult to protect against targeted attacks from adversaries.

Incredibly difficult to defend against nation state attackers and such. North Korea is very persistent in crypto hacks, for example: https://www.npr.org/2022/12/22/1144996480/crypto-hacking-nor...

It is actually really simple, albeit tedious, to defend your bitcoin against remote state actors. Do keygen and signing with reproducibly built binaries on a reproducibly built minimal OS and never connect it to the internet.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#275

Post by ipython »

323 wrote: post #229
hgsgm wrote: post #188

Earlier quoted context omitted.

Great example of how "Bitcoin is trustless" means "Bitcoin only works is the trust is provided externally".

It's not just Goodness of heart. This case can fall under existing laws. You are not allowed to keep obvious transfer mistakes like these.

Who would enforce this? The Bitcoin police?

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#277

Post by numbsafari »

lrvick wrote: post #266
tmpburning wrote: post #185

Earlier quoted context omitted.

> These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Because no one can create secure software yet, Bitcoin isn't 100% secure.

This has nothing to do with the security of Bitcoin. No one has ever compromised the Bitcoin protocol. This is a case of someone expecting a single machine connected to the internet that had been compromised in the past, to not be compromised again. Very little software has rigorous security review, even the Linux kernel. Linux Odays sell for $50-100k. If you are storing anything more valuable than that on an interne…

Lol… “finance” is a social construct. People are the protocol. The Bitcoin protocol is subject to a vast number of people related hacks. Other financial markets aren’t perfect, but at least they have mechanisms and acknowledge reality.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#278

Post by foobarian »

jeroenhd wrote: post #47
throwaway9870 wrote: post #14

Earlier quoted context omitted.

I am not a security person, but I can't help but wonder where the advice of not writing things down comes from? I think my wife's password book on her desk is a lot more safe than most computer experts.

Password books are basically physical password managers. The only problem I have with them is that the passwords in most password books I've seen aren't very creative or random. As long as you write down randomly generated passwords instead of permutations of the names of your kids/pets/parents, I don't know what people are panicking about. The perfect password book is combined with a word you remember but don't writ…

My fear with a password book (wife has one, different than OP) is it getting lost or destroyed.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#279

Post by gruez »

spicymaki wrote: post #76
samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.

> Exactly! if the experts can’t secure their accounts, what hope does anyone else have?

A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affected the user with the most basic setup of a software wallet running on a computer behind a NAT firewall.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#280

Post by naikrovek »

bawolff wrote: post #262
spicymaki wrote: post #76

Earlier quoted context omitted.

Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.

Experts are also bigger targets and face more risks than ordinary people. Like in the non-crypto world, banks are the experts on storing money securely, but people still try and rob banks despite ordinary people being much easier targets.

except this wasn't a targeted attack, it was just a run of the mill shotgun approach to capture wallets.

cryptocurrency is stupid. regulation around banks is there for many very good reasons.

https://twitter.com/peterktodd/status/1609655629903265795

you won’t trust highly regulated banks, but you will trust random strangers on the internet whom you know want your wallet and all the coins in it, without any guarantees whatsoever that any security is in place. you only need to trust yourself, which is already 8-10 orders of magnitude less trustworthy than a bank, AT BEST.

even in the rare event that an established bank does go under, and it holds some of your money when it does, FDIC insurance will get you at least some of that money back. cryptocurrency has zero recourse if you are harmed.

i laugh when cryptobros and NFTbros lose money, because anyone with any critical thinking skills whatsoever saw these things as shams at the outset, and we tried to speak up, but none of those who have lost money even considered listening at the time.

it is hilarious to me when these things happen. i actually, literally, laugh out loud, without a single hint of remorse.

Post reply on HN