Live data from Hacker News

Compromised Linode, thousands of BitCoins stolen

bitcoinmedia.com

221–230 of 249 posts

Re: Compromised Linode, thousands of BitCoins stolen

#221
post #93

Earlier quoted context omitted.

where do you keep the key to the crypto fs?

Written on a scrap of paper in your wallet. only the password and no other info should be on the scrap. If you can memorize it, it is a bad password.

What the? If you write it down, it's a bad password. Make it a pass phrase, make it long. And possibly store it in an encrypted password database, protected by a master pass phrase.

Re: Compromised Linode, thousands of BitCoins stolen

#222

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

> from such causes beyond the direct and exclusive control of Linode.com.

But isn't access to the customer service portal under direct and exclusive control of Linode.com?

Re: Compromised Linode, thousands of BitCoins stolen

#223
post #212

Earlier quoted context omitted.

Sorry for asking a noob question. But what really is a bit coin? I mean in physical existence. Is it just a file(plain text) with some data/metadata? And stealing it means copying those files, and then deleting the source? Which in case how is this any different than traditional bank account. My money in the bank is basically DB record. And that can be stolen. The bank can then just say to every one 'look this transa…

A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin…

makes the currency safe from inflation

There's an economic myth that inflexible supply of a commodity gives that commodity when treated as money, stability. It does not, as looking at this graph of US inflation/deflation time shows (1944 is when the dollar stopped being gold convertible):

http://en.wikipedia.org/wiki/File:US_Historical_Inflation_An...

A few points:

1. The money supply around a currency not only contains the mined/minted instances of that currency, but also liquid currency-denominated assets, like customer bank balances. So money supply is not necessarily bounded.

2. Inflation/deflation can be considered measures of the change in demand for the currency. In times of deflation, holding money is valuable because it becomes more valuable.

3. From the above graph, you see that during the gold standard, inflation tended to be mostly balanced out by deflation in the long-term, so long-term inflation was low. But in the short term, prices were very unstable as inflation jumped all over the place, and far more unstable even than fiat money in the past three turbulent years that we've seen.

4. From the point of view of an economy, inflation and deflation are not symmetric; because of the value of sitting on money during periods of deflation, savers do not tend to invest their money but move money from investments to cash savings. This undermines economic activity. But in an economy with a rich range of investment opportunities, moderate inflation does not penalise acquisition of money and does encourage investment.

If you want a non-performing store of value and don't mind big fluctuations in value, gold is there and we know how to secure gold rather well. Bitcoins are another non-performing store of value with far more drastic fluctuations in value, and securing it involves the double vulnerability: physical security of storage media, information security of computations involving bitcoins. And it is much easier to accidentally lose bitcoins than gold, pirate tales notwithstanding.

Re: Compromised Linode, thousands of BitCoins stolen

#224

Earlier quoted context omitted.

"please think for a second what liability you would want for any mistakes that you make with your web startup or idea" It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best p…

"Is there a way to secure a bitcoin wallet on a machine someone else has root access to (either your datacenter's staff with physical access, or the people with hypervisor access to the hardware your vm is running on)?" Probably not, _maybe_ trusted computing could help[1]. But it might secure enough if you had a special piece of hardware that stored the bitcoin-key and did all the signing operations. I believe thing…

You're thinking of a hardware security module (HSM). These are standard for e.g. certificate authorities. To the best of my knowledge, they have never been used by bitcoin outfits, but that is certainly possible, in principle.

Of course, sane people don't mix HSMs and VMs.

Re: Compromised Linode, thousands of BitCoins stolen

#225
post #156
post #105

" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…

I can put a "not responsible for stolen items" sign in my restaurant, but if the coat check employee bolts out the door when you hand them your coat, I'm buying you a new one.

What if the person had a $100,000 worth of cash in his coat pocket -- would you reimburse that, too?

Re: Compromised Linode, thousands of BitCoins stolen

#226

Earlier quoted context omitted.

Bad comparison in my opinion, BitCoins can be stolen (taken away and become unrecoverable) whilst your project you've been working on is recoverable. Also the value something is worth is what someone else will pay for it. You can't value a project you're working on as your hourly rate * hours worked, it doesn't really work like that.

1) Recoverable: Only if I have backups (which I excluded in my comparison, and would be a fault on my side. But go with me here..). Otherwise I'd need to invest (see the word I used here?) time to create it from scratch. That's equivalent to an amount of money (the exact amount is hard to define, granted). 2) 'You can't value a project you're working on as your hourly rate * hours worked, it doesn't really work like…

Point 1 isn't really debatable in my opinion, you make work, you back it up and if someone deletes it off your server you just move it back on. Bitcoins by design don't allow you to recover them.

Point 2, back in the day when currency was backed by gold reserves would you have said the coins and notes people had were also worthless? As they are not 'sold' yet into gold?

Also I don't say a project on your disk has no value, a project on your disk has worth, the amount it's worth is how much someone will pay for it. Because the project on your disk doesn't really abide by any fixed standards you will probably find it's quite difficult to sell it.

Re: Compromised Linode, thousands of BitCoins stolen

#227
post #223

Earlier quoted context omitted.

A 'bit coin' is a space on a block chain that everyone has a copy of. You lock the coin with a cryptographpic key, which you need to store. Whoever has a copy of the key can unlock the bitcoin and re lock it with a different key, such that now only the new owner has a copy of the key. Everyone can still see the entire block chain, but only one account (that no one knows the owner of) has the ability to move that coin…

makes the currency safe from inflation There's an economic myth that inflexible supply of a commodity gives that commodity when treated as money, stability. It does not, as looking at this graph of US inflation/deflation time shows (1944 is when the dollar stopped being gold convertible): http://en.wikipedia.org/wiki/File:US_Historical_Inflation_An... A few points: 1. The money supply around a currency not only conta…

> physical security of storage media, information security of computations involving bitcoins

Only funds that you have daily access to need be vulnerable to the latter point, as physical security (air-gapping) is sufficient when you do not need to -send- funds.

> And it is much easier to accidentally lose bitcoins than gold, pirate tales notwithstanding.

Strongly disagree. Can you keep N redundant copies of your gold? Combined with secret splitting, you could require that at least K of N secure locations be accessed.

Re: Compromised Linode, thousands of BitCoins stolen

#228
post #206

Earlier quoted context omitted.

I don't see what's so conceptually new about bitcoin wallets. They're just plain text that you don't want people getting access to. It's no different than storing passwords in plain text: if someone copies them, they're completely compromised (until the user changes them). The solution is pretty simple: encrypt your own bitcoins with your own password (or more ideally, your private key). Then, if someone hacks your s…

Keys normally grant access so worst case once they're compromised you can take the server offline physically. Even private signing keys can be revoked though some damage may have been done. With Bitcoin, once it's copied, you can consider it gone forever, irrevocably, in totality.

I thought the idea was if someone copied your bitcoins it was essentially a race to be the first to spend them. I guess if you're stealing bitcoins, though, you're going to be quick to run them through a couple of transactions to claim ownership of them.

(Of course, my understanding might be completely off-base.)

Re: Compromised Linode, thousands of BitCoins stolen

#229
post #223

Earlier quoted context omitted.

makes the currency safe from inflation There's an economic myth that inflexible supply of a commodity gives that commodity when treated as money, stability. It does not, as looking at this graph of US inflation/deflation time shows (1944 is when the dollar stopped being gold convertible): http://en.wikipedia.org/wiki/File:US_Historical_Inflation_An... A few points: 1. The money supply around a currency not only conta…

> physical security of storage media, information security of computations involving bitcoins Only funds that you have daily access to need be vulnerable to the latter point, as physical security (air-gapping) is sufficient when you do not need to -send- funds. > And it is much easier to accidentally lose bitcoins than gold, pirate tales notwithstanding. Strongly disagree. Can you keep N redundant copies of your gold…

> Only funds that you have daily access to need be vulnerable to the latter point

I'm talking about protocol risk: e.g., the software that implements the protocol on some machine is flawed, so the cryptography can be effectively breached. Or there is some issue with the protocol, like but worse than the issue Kaminsky found with anonymity.

>Can you keep N redundant copies of your gold?

Have you ever found that your backups didn't contain what they were supposed to contain?

Gold gets stolen, but besides such things as costume jewellery, I think it doesn't often get lost.

Post reply on HN