Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“My PGP key is compromised, and at least many of my bitcoins stolen”

twitter.com

Post reply on HN
Print view View original

391–400 of 564 posts

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#391

Post by Nursie »

gruez wrote: post #311
pornel wrote: post #298

Earlier quoted context omitted.

His PGP key got stolen, so someone else could have been submitting code as him. Hopefully he didn't also lose any SSH keys with push rights to the repo.

except if you check the bitcoin core repo, all the PRs have extensive code reviews done before they're merged. the chance of a supply chain attack (eg. node-ipc) is low.

Are we sure that the code review process hasn’t been compromised if one of the core developers’ key has been?

It seems reasonable that some due diligence in this area be done in light of this discovery.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#392

Post by ec59cb1659 »

fshbbdssbbgdd wrote: post #286
gruez wrote: post #271

Earlier quoted context omitted.

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the intern…

So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? (I obviously don’t expect them to guarantee the value of the crypto, j…

It's not about money, it's about power. If you hold a physical item, you have the maximum power over it as possible. If you want to entrust someone else with it, go ahead, but at the end of the day your access to the item will be subject to their whims and those of the greater political establishment / woke clergy / corrupt and powerful.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#393

Post by oefrha »

qualudeheart wrote: post #383
gruez wrote: post #279

Earlier quoted context omitted.

> Exactly! if the experts can’t secure their accounts, what hope does anyone else have? A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affect…

Agreed. The average user owns zero servers.

There are posts about OP’s server being hacked, but there’s zero evidence that they put any leaked secret key on their server. Someone more connected to OP suggests that it might be backdoored desktop software.[1]

Your average user will install whatever crap they find on the Internet. Hell, a friend of mine (in their 20s, not a grandma) recently installed god knows what when “Windows support” called. And it’s not the first time a friend fell for this kind of scam.

[1] https://twitter.com/peterktodd/status/1609655629903265795

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#394

Post by Galanwe »

fshbbdssbbgdd wrote: post #286
gruez wrote: post #271

Earlier quoted context omitted.

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the intern…

So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? (I obviously don’t expect them to guarantee the value of the crypto, j…

> I have to secure a physical object that grants irrevocable ownership of my wealth

That's one way, but not the only one.

My preferred mean of storage is through a _vault_ smart contract, such as the "Gnosis safe".

It's basically a smart contract that you deploy, and send your assets to. You can then add some of your trusted friends as co-validators and require 2/3 validations for a withdrawal. You can also set a no-validation required threshold at $X/m for the day to day.

> I obviously don’t expect them to guarantee the value of the crypto, just that the broker doesn’t lose it

For the record, brokers rarely (if ever) store or guarantee client money.

Usually you have a custodian to hold your money (who will guarantee deposits, up to some limits), and your broker will unlock a credit line for you based on your collateral posted at the custodian.

There are custodians in crypto as well, "Paxos" and "Coinbase Custody" being the most well known. They will store your money on cold wallets with very strict guarantees (shamir split of the wallet keys among anonymous holders, strong entropy guarantees on key generation, proof of reserve, etc) and unlock it upon verifying your identity with real humans. It's costly though.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#395

Post by throwaway290 »

thebeardisred wrote: post #122
treeman79 wrote: post #25

Earlier quoted context omitted.

How on earth are normal people supposed to trust bit coin. When best practice is to treat it like paper money.

Technically, it's more like "treat it like any non-fungible asset". Plenty of "normal people" use combinations of physical security to protect their assets. Safes, deposit boxes, tamper proof materials etc.

What... paper money and gold bars are non-fungible now?

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#396

Post by [deleted] »

perihelions wrote: post #84
sosodev wrote: post #27

https://bitcoinhackers.org/@lukedashjr his mastodon feed indicates that one of his servers was physically compromised multiple times. Seems like he should have been more paranoid about securing his coins with that knowledge?

Speaking of paranoid, that link you've posted, isn't that a link to a server that's known to be compromised, and also an apparent watering hole for crypto wallet holders? Am I unreasonable in thinking that's a very scary link?

[deleted]

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#397

Post by im3w1l »

celticninja wrote: post #161
optimalsolver wrote: post #151

Earlier quoted context omitted.

>math and code were nearly perfect with zero peer review Bitcoin had to be forked in the early years due to critical errors in the original code. There was nothing perfect about it.

Yup, there was a bug that allowed the attacker to create an unlimited number of Bitcoin, it was fixed, but there seems to be this myth that SN provided complete bug free working code from the outset.

Where can I read more about this? Super interesting.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#398

Post by im3w1l »

throwaway9870 wrote: post #14
mccorrinall wrote: post #4

Would be interesting to know how his BTC were stolen. Because he is a BTC core developer, I believe he followed the best practices, like not writing down his password. So infection or keylogger?

I am not a security person, but I can't help but wonder where the advice of not writing things down comes from? I think my wife's password book on her desk is a lot more safe than most computer experts.

The biggest threat with this scheme is you. After that your kids, your house keeper, your friends and visitors.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#399

Post by bbbbb5 »

fshbbdssbbgdd wrote: post #342
bbbbb5 wrote: post #327

Earlier quoted context omitted.

You can definitely steal houses though. https://www.bbc.com/news/uk-england-essex-59069662 https://archives.fbi.gov/archives/news/stories/2008/march/ho... https://www.washingtonpost.com/local/public-safety/she-had-n... You can also steal stocks. https://www.bleepingcomputer.com/news/security/us-charges-ha... > The vast majority of wealth in developed countries doesn’t rely on physical security to maintain ownership I…

When this stuff happens, you can engage in a legal process that has the power to get your property back. The process to recover from this can be slow and difficult. I acknowledge that this is a failure of the institutions involved, which can and should be fixed. However, the existence of these avenues for recovery acts as a strong deterrent that limits the frequency of such crimes. That’s why I am slightly worried ab…

The same legal processes that can be used to recover funds stolen from your bank account or stocks stolen from your brokerage account can be used to recover cryptocurrency.

>When your crypto is stolen, the theft cannot be reversed, by design.

If someone sends you a phishing link, gets your info, logs into your online banking and sends all of your money overseas, that theft generally can't be reversed either. (You'll find that the CFPB recently updated their Reg E interpretation on this, but that interpretation isn't binding and directly contradicts decades of practice)

If you're a business and get hit by banking malware, you're similarly fucked.

Re: “My PGP key is compromised, and at least many of my bitcoins stolen”

#400

Post by midhhhthrow »

ec59cb1659 wrote: post #392
fshbbdssbbgdd wrote: post #286

Earlier quoted context omitted.

So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? (I obviously don’t expect them to guarantee the value of the crypto, j…

It's not about money, it's about power. If you hold a physical item, you have the maximum power over it as possible. If you want to entrust someone else with it, go ahead, but at the end of the day your access to the item will be subject to their whims and those of the greater political establishment / woke clergy / corrupt and powerful.

Trusting someone else: Well we do this every day with money in the bank, with all the risks that come with it
Post reply on HN