Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoinica MtGox account compromised

bitcointalk.org

Post reply on HN
Print view View original

31–40 of 108 posts

Re: Bitcoinica MtGox account compromised

#31

Post by sneak »

biff wrote: post #25

This is starting to prove -- the hard way -- why regulations, certifications, and all that other stuff that feels like meaningless overhead the majority of the time has become a grudgingly accepted part of our lives. It comes back to the most difficult problem: you inevitably need to trust someone, so how do you minimize your risk in that trust? I always thought the Bitcoin trust issues would revolve around the inabi…

> that providers in this market might not be driven to produce quality and reliability because somehow there isn't the demand for it

Also, the market is young and small and very inefficient as yet. The tools for allowing market participants to reasonably evaluate trustworthiness of service providers don't really exist yet.

You can't really blame that on "lack of demand for quality and reliability". Give it five years and try your analysis again.

Re: Bitcoinica MtGox account compromised

#32

Post by nullc »

bnr wrote: post #21
Smrchy wrote: post #4

This might explain the unusual rise of BTC vs. USD. The thief might have just traded those dollars to bitcoins which makes them harder to trace.

Another possible explanation for the increasing rate is that someone is offering 7% interest on BTC: https://bitcointalk.org/index.php?topic=50822.0 If that offer is really enough to make the price rise, this might be exactly what this guy is speculating on.

You mean 3372% interest— The 7% number is _per-week_.

Re: Bitcoinica MtGox account compromised

#33

Post by sneak »

0x0 wrote: post #6

I can't believe people entrust virtual money to sites like these which in general - but consistently - seem to be run by amateurs.

People still regularly fall for 419 scams, or the emails would stop.

I got one the other day for a "scam victim restitution fund", asking for personal details. The mind reels.

Re: Bitcoinica MtGox account compromised

#35

Post by kiba »

biff wrote: post #25

This is starting to prove -- the hard way -- why regulations, certifications, and all that other stuff that feels like meaningless overhead the majority of the time has become a grudgingly accepted part of our lives. It comes back to the most difficult problem: you inevitably need to trust someone, so how do you minimize your risk in that trust? I always thought the Bitcoin trust issues would revolve around the inabi…

But it's unsettling to see that breaches like this don't evidently leave the impression with the Bitcoin community that a believer in the free market might hope they would, that providers in this market might not be driven to produce quality and reliability because somehow there isn't the demand for it.

This time, It's simply bitcoinica users are caught waiting for a refund after the second breach. They ARE NOT using bitcoinica, at all. The site have been offline for months.

Re: Bitcoinica MtGox account compromised

#36

Post by _delirium »

sneak wrote: post #29
biff wrote: post #25

This is starting to prove -- the hard way -- why regulations, certifications, and all that other stuff that feels like meaningless overhead the majority of the time has become a grudgingly accepted part of our lives. It comes back to the most difficult problem: you inevitably need to trust someone, so how do you minimize your risk in that trust? I always thought the Bitcoin trust issues would revolve around the inabi…

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?" Seriously. Knock that shit off. It's a red herring. You can't abstract away the personal process of choosing trust anchors and metrics, no matter how hard you try. Changing your trust anchor to "the government" just means you end up getting fucked on a larger scale, over a la…

I think it's considerably more complex than that, and not at all a red herring. I agree it's a coordination/network problem either way, but you would need actual evidence to argue that some methods of coordination are better than others.

I've read a reasonable amount about currency history, and the U.S. government's stewardship of currency in particular is not bad imo. Its stewardship of the banking system leaves more to be desired. I'm not sure its stewardship of the banking system is worse than what we had in the "free banking" era, though. You don't really have to be against markets to have an ordoliberal-style view (vaguely following Hayek) that markets work best within certain frameworks, as opposed to having a view that anarcho-capitalism will always produce the best solutions (more following Rothbard).

Re: Bitcoinica MtGox account compromised

#37

Post by morsch »

columbo wrote: post #28

I know nothing about bitcoin, can someone provide a tldr about why it is (seemingly) so difficult to build a secure site around exchanging these things? I don't get how you can simply "Loose" a few hundred grand without a horse head winding up at the food of your bed.

It's difficult to write secure code.

It's difficult to administrate a secure system.

It's a new market where release early, release often is important.

BTC transaction are largely untraceable and irreversible.

Re: Bitcoinica MtGox account compromised

#38

Post by ajross »

> Unbeknownst to us, Tihan was using the mtgox api key as the password for a website called LastPass.

Unbelievable. They decide to use a password escrow service... and use a duplicate password to secure it. This is 100% cargo cult security. Clearly whoever did this had no idea what the value of LastPass was, just that it was what all the cool security kids were doing. The choice of the high-value BtGox key was (staggeringly) unfortunate, but any dupulicate would be equally ignorant.

Just unbelievable.

Re: Bitcoinica MtGox account compromised

#39

Post by raganwald »

sneak wrote: post #29
biff wrote: post #25

This is starting to prove -- the hard way -- why regulations, certifications, and all that other stuff that feels like meaningless overhead the majority of the time has become a grudgingly accepted part of our lives. It comes back to the most difficult problem: you inevitably need to trust someone, so how do you minimize your risk in that trust? I always thought the Bitcoin trust issues would revolve around the inabi…

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?" Seriously. Knock that shit off. It's a red herring. You can't abstract away the personal process of choosing trust anchors and metrics, no matter how hard you try. Changing your trust anchor to "the government" just means you end up getting fucked on a larger scale, over a la…

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?”

A common sentiment: “Big Government doesn’t work.” No, it doesn’t work. But in many cases, it’s less broken then no government a/k/a The Free Market. I’m reminded of Winston Churchill’s quip: "It has been said that democracy is the worst form of government except all the others that have been tried.”

It could be that trusting democratic governments to manage a monetary system is fundamentally unsound. I’m listening: What alternative do you propose, and how is it going to scale beyond protecting the few wealthy info-elite that can protect themselves?

Re: Bitcoinica MtGox account compromised

#40

Post by epscylonb »

columbo wrote: post #28

I know nothing about bitcoin, can someone provide a tldr about why it is (seemingly) so difficult to build a secure site around exchanging these things? I don't get how you can simply "Loose" a few hundred grand without a horse head winding up at the food of your bed.

If you run a service where you need to pay bitcoins out to users then that means your systems have to respond to user input and send money to them.

It turns out this is pretty tricky to secure.

The current popular strategy is to have hot and cold wallets. A hot wallet is online and can make payouts automatically.

A cold wallet is kept offline (airgap) and brought online by a human being to refill the hot wallet when it is running low. This only really makes sense if your service needs to secure large amounts of bitcoin for a long time without using them.

This recent bitcoinica hack is pretty inexplicable, they were keeping a large amount of coin in an account at an exchange called MtGox. This is effectively a hot wallet.

Post reply on HN