“My PGP key is compromised, and at least many of my bitcoins stolen” • Hacker News Board

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#301

Post by throwaway290 » Mon, Jan 02, 2023, 1:59 AM UTC

gruez wrote: post #271

samwillis wrote: post #42

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the intern…

Your argument doesn't negate the point though...

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#302

Post by johnklos » Mon, Jan 02, 2023, 2:00 AM UTC

MonkeyMalarky wrote: post #116

SkyMarshal wrote: post #106

Earlier quoted context omitted.

Looks like possibly a supply chain attack targeted specifically at Luke Jr's server: https://twitter.com/naka_frodo/status/1609655813789949959/ph...

The salty posts about his hosting provider are confusing to me. He is paying $55/month and is expecting aid in forensics and audits? Is that normal for a low cost provider? Edit: Also it sounds like he didn't immediately shut down the server after the first hack? That is completely insane. I understand you want to investigate but you are leaving yourself wide open leaving the system running. It's been compromised. En…

To be fair, even if he was only paying $5 a month, if there was a tiny chance that the compromise was done by an employee, any reasonable provider would be all over it.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#303

Post by [deleted] » Mon, Jan 02, 2023, 2:01 AM UTC

CyberDildonics wrote: post #79

Just for a little context luke jr was infamous on cryptocurrency forums for being adamant that the sun revolved around the earth, all religions other than catholicism are evil, there is an "ethical aspect to slavery" and that bitcoin's 1 KB/s throughput was too much and should be cut down even further. https://archive.is/sS5Ml https://archive.is/DrP83 https://np.reddit.com/r/Christianity/comments/36w6nw/why_did... ht…

[deleted]

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#304

Post by gruez » Mon, Jan 02, 2023, 2:04 AM UTC

arcticbull wrote: post #281

gruez wrote: post #279

Earlier quoted context omitted.

> Exactly! if the experts can’t secure their accounts, what hope does anyone else have? A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affect…

If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again. Every random walk down the timeline results in 100% of coins lost or stolen. [edit] You can o…

>If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake.

Except in this case, it seems like he went out of his way to make it less secure, by putting his wallet on his server. This isn't a case of someone losing his mattress savings in a random home burglary, this is a case of someone leaving a duffle bag of cash in the seat of a car.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#305

Post by Jach » Mon, Jan 02, 2023, 2:05 AM UTC

foobarian wrote: post #278

jeroenhd wrote: post #47

Earlier quoted context omitted.

Password books are basically physical password managers. The only problem I have with them is that the passwords in most password books I've seen aren't very creative or random. As long as you write down randomly generated passwords instead of permutations of the names of your kids/pets/parents, I don't know what people are panicking about. The perfect password book is combined with a word you remember but don't writ…

My fear with a password book (wife has one, different than OP) is it getting lost or destroyed.

I worry about this more with things like hardware keys / flash storage

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#306

Post by woodruffw » Mon, Jan 02, 2023, 2:05 AM UTC

int_19h wrote: post #252

woodruffw wrote: post #227

Earlier quoted context omitted.

Sure; I'm curious which intelligence organization you (or the GP) think is most likely, then. Keep in mind that (1) most intelligence organizations and clandestine services operate with even less oversight than the US's, and (2) all available evidence points to Satoshi Nakamoto being an L1 English speaker who was mostly active in Western European timezones.

If you're assuming that Satoshi was a spook, wouldn't the use of L1 English and Western timezones more likely to be an attempt to obfuscate?

This results in logical regress: any positive evidence that Nakamoto was a native-English speaking Westerner can be spun into negative evidence of an exceptionally advanced adversary.

In other words, it's "that's just what they want you to think!" logic. And that can be true, but it's not exceptionally convincing.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#307

Post by johnklos » Mon, Jan 02, 2023, 2:05 AM UTC

technion wrote: post #99

tinus_hn wrote: post #95

Earlier quoted context omitted.

If he has enough Bitcoins for it to be possible for ‘many of them’ to be stolen, he doesn’t have a small budget.

Just makes this thread stranger. I know if I had over $3m in btc and was working professionally with them I wouldn't state my top budget was $55. Edit: his tweets specifically talk about not using "cloud nonsense " and states getting your own key to a rack is too expensive for him.

My goodness. Really? He refers to "cloud nonsense", then uses a "dedicated server"? That's a new kind of special.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#308

Post by arcticbull » Mon, Jan 02, 2023, 2:06 AM UTC

gruez wrote: post #304

arcticbull wrote: post #281

Earlier quoted context omitted.

If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again. Every random walk down the timeline results in 100% of coins lost or stolen. [edit] You can o…

>If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. Except in this case, it seems like he went out of his way to make it less secure, by putting his wallet on his server. This isn't a case of someone losing his mattress savings in a random home burglary, this is a case of someone leaving…

At the risk of murdering this dead horse there's a reason nobody positions duffle bags of cash as the future of finance no matter where located. Precisely because they can be stolen without recourse. Had that money been safely in a bank account they'd still have it in both these examples.

I mean this guy is already demanding the FBI get involved when the FBI's position is you should just put it in a bank account and not need to call us in the first place.

https://www.newyorker.com/humor/daily-shouts/l-p-d-libertari...

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#309

Post by woodruffw » Mon, Jan 02, 2023, 2:07 AM UTC

Phlarp wrote: post #265

woodruffw wrote: post #232

Earlier quoted context omitted.

You're placing way more value on this than makes sense: Bitcoin makes use of good primitives, but no better than any expected familiar with the SoTA in the late 2000s would have selected for a greenfield project. Maybe the most unusual primitive selection in Bitcoin is secp256k1 for ECDSA, instead of one of the more common NIST curves. But even that is understandable, given that Nakamoto was active in the cypherpunk…

The primitive selection looks rather informed with the hindsight of NSA compromising the security of NIST curves

As far as I know, there's no concrete evidence that the NSA has compromised the security of the NIST curves. That would be weird for them to do, since they use those curves internally to encrypt data classified at Secret and higher.

Are you thinking of Dual EC?

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#310

Post by gruez » Mon, Jan 02, 2023, 2:08 AM UTC

arcticbull wrote: post #290

s1artibartfast wrote: post #289

Earlier quoted context omitted.

Who is foisting anything here? I'm not aware of anyone who has been forced to use crypto

Anyone with a direct or indirect stake in one of the few companies silly enough to throw it on their balance sheet. Since TSLA made the S&P that's basically everyone with a market investment, an IRA, a 401(k), a pension. CPPIB invested in FTX. CDPQ in Celsius. Everyone in El Salvador. It's a bit of a cancer. Anyways those doing the foisting also includes all the shills, the laser-eyed, the influencers. [edit] It's no…

>Anyone with a direct or indirect stake in one of the few companies silly enough to throw it on their balance sheet

Sure, there are institutional investors holding crypto, but how is this related to the current discussion of securing crypto? They're not exactly keeping their crypto holdings in a software wallet connected to the internet. They typically outsource that to companies that specialize in crypto custody, which presumably have better security practices than the OP.