Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“My PGP key is compromised, and at least many of my bitcoins stolen”

twitter.com

Post reply on HN
Print view View original

281–290 of 564 posts

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#281

Post by arcticbull »

gruez wrote: post #279
spicymaki wrote: post #76

Earlier quoted context omitted.

Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.

> Exactly! if the experts can’t secure their accounts, what hope does anyone else have? A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affect…

If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again.

Every random walk down the timeline results in 100% of coins lost or stolen.

[edit] You can only blame the user so many times before you have to really look inward haha.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#283

Post by arcticbull »

willnonya wrote: post #255
spicymaki wrote: post #76

Earlier quoted context omitted.

Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.

"This is why lack of consumer protections suck" So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over?

> So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over?

Yes. Every time you make a foolproof system the world brings us a bigger fool. I'd rather a few irresponsible people get a do-over than otherwise responsible people getting rekt like this.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#284

Post by petesergeant »

r1ch wrote: post #150
technion wrote: post #85

Earlier quoted context omitted.

Assuming this physical access claim is truthful (and i have doubts), I would feel at this point its budget letting him down. If your threat model includes "targeted attacks from people with physical access", it's time to run a vm on aws or azure and use the tooling they make available to secure it further. If you want tonnes of resourcing at a quite low budget, there's only a certain amount of "calling out" the group…

I believe most of these "physical attacks" are datacenter support teams being socially engineered and not state-level actors. They hook up a USB rescue drive to "help" you back into your server, using full disk encryption or locking down the BIOS can thwart such attacks.

Sure, perhaps, but parent’s point still stands that AWS techs are not plugging USB drives into servers, because their threat-model already includes state-sponsored attacks.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#285

Post by rkho »

lern_too_spel wrote: post #199
rkho wrote: post #94

Earlier quoted context omitted.

And yet they did: https://www.bloomberg.com/news/articles/2022-02-17/police-be...

That's the point. If you're a criminal, you don't get to keep the proceeds of your crime. In this case, people were blocking streets and creating nonstop noise disturbances in order to get donations from foreigners who wanted to shut down the city. Or do you think I should be able to pay a trucker to block your driveway and honk their horn all night? If so, the way to solve it isn't to let anybody get money for any i…

> If you're a criminal

That's a big "if", and it's operating under the assumption that it was objectively correct for the Prime Minister of a civilized nation which claims to be a democracy to invoke emergency powers and declare a group of protestors to be criminals, bypassing due process that a civilized nation which claims to be a democracy should be using to reach that conclusion.

Is that the kind of democracy you'd like to live in, where any group of people can suddenly be declared criminals without due process?

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#286

Post by fshbbdssbbgdd »

gruez wrote: post #271
samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the intern…

So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad.

Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? (I obviously don’t expect them to guarantee the value of the crypto, just that the broker doesn’t lose it).

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#287

Post by giardia »

gruez wrote: post #271
samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the intern…

The implication of your comment is that Bitcoin is developed in part by someone who acts like an idiot.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#288

Post by resonious »

phphphphp wrote: post #33

Apparently his servers keep getting hacked, which doesn’t reflect well on his security practices: https://twitter.com/LukeDashjr/status/1606885577843957762

> Evidence suggests the attacker installed 2-3 remote shell backdoors, but didn't touch anything else.

Well, I guess he now has evidence that maybe they touched something else.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#289

Post by s1artibartfast »

arcticbull wrote: post #281
gruez wrote: post #279

Earlier quoted context omitted.

> Exactly! if the experts can’t secure their accounts, what hope does anyone else have? A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affect…

If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again. Every random walk down the timeline results in 100% of coins lost or stolen. [edit] You can o…

Who is foisting anything here? I'm not aware of anyone who has been forced to use crypto

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#290

Post by arcticbull »

s1artibartfast wrote: post #289
arcticbull wrote: post #281

Earlier quoted context omitted.

If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again. Every random walk down the timeline results in 100% of coins lost or stolen. [edit] You can o…

Who is foisting anything here? I'm not aware of anyone who has been forced to use crypto

Anyone with a direct or indirect stake in one of the few companies silly enough to throw it on their balance sheet. Since TSLA made the S&P that's basically everyone with a market investment, an IRA, a 401(k), a pension. CPPIB invested in FTX. CDPQ in Celsius. Everyone in El Salvador. It's a bit of a cancer.

Anyways those doing the foisting also includes all the shills, the laser-eyed, the influencers. [edit] It's not enough to say because they weren't forced at gunpoint, it's not coercive or immoral. We don't accept that behavior from people shilling penny stocks. And of course Salvadoran shopowners were in fact coerced with force.

Post reply on HN