Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Crypto drainer” template facilitates theft

blog.confiant.com

Post reply on HN
Print view View original

101–110 of 228 posts

Re: “Crypto drainer” template facilitates theft

#101

Post by uoaei »

pcthrowaway wrote: post #44
uoaei wrote: post #25

Earlier quoted context omitted.

You don't need to have the education to understand NFTs to have the knowledge not to put bets down on things you don't understand.

Most people don't understand things they invest in/buy. Most people buying stocks don't understand the company as well as someone who works in the sector. Most casual art appreciators don't know how to tell if a painting they're buying is a forgery. Most people buying a house don't know how to assess the foundation, and even if they get a professional assessment, they don't have the same knowledge of the housing mark…

It appears crypto bros are on the verge of re-inventing market regulation!

Re: “Crypto drainer” template facilitates theft

#102

Post by trompetenaccoun »

infotogivenm wrote: post #97
trompetenaccoun wrote: post #88

Earlier quoted context omitted.

It turns out you're not the first person to realize that this is an issue. If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits. Basically the fraud described is a twist on the classic "Musk giving away BTC" scam that's all over Youtube…

> The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Yes, so simple! Just put your coins into this website’s smart contract and you’ll be much more secu…

It's not a website. Read this if you're unsure what a smart contract is: https://ethereum.org/en/developers/docs/smart-contracts/

Btw yes, from a user perspective it actually is very simple and easy to use. It's a good wallet for beginners. Most who're more active and understand the tech have hardware wallets. You could combine the two solutions as well.

Re: “Crypto drainer” template facilitates theft

#103

Post by uoaei »

drc500free wrote: post #80
uoaei wrote: post #25

Earlier quoted context omitted.

You don't need to have the education to understand NFTs to have the knowledge not to put bets down on things you don't understand.

If every transaction required perfect understanding by both parties, there would be no markets. We have regulations to reduce the amount of understanding needed to participate in markets without getting fleeced, which makes the markets function.

Precisely the point!

Re: “Crypto drainer” template facilitates theft

#104

Post by xwolfi »

mrep wrote: post #77
spinny wrote: post #68

Earlier quoted context omitted.

the wallet in question is probably metamask, a browser extension. it injects a web3 provider in `window.ethereum`. connecting the wallet is done by calling `window.ethereum.enable()`, this pops up a dialog asking you to connect an address to the website. it just tels the extension that the website is allowed to interact with the extension This article is about phishing in the context of cryptos. Silent signing doesn'…

I have a CS degree and have worked at FAANG for 6 years and that was straight gibberish to me. I guess maybe because I have only worked at FAANG using traditional tech and not crypto startups?

I work in a 100yo investment bank and am quite familiar with how it all works and yet, even if I didnt just work in a technical-centric company like you but a business and finance-centric one at that, I still think it's gibberish.

Worse, I learned to decode what they refer to talking like that and I still dont see a point: to the gibberrish or to the whole concept.

Re: “Crypto drainer” template facilitates theft

#105

Post by cdiddy2 »

Barrera wrote: post #93
dcolkitt wrote: post #64

Earlier quoted context omitted.

All connecting a wallet does is allow the app to see your public keys. Private keys are not directly exposed. The app can then request the user sign transactions, but they must be explicitly approved by the user. Where fraud typically happens is when a user thinks they're signing an innocuous transaction, when in fact they're signing a malicious one. This is generally a hard problem, but it's very clear from the wall…

Where do the private keys reside in this scenario?

Depends on the type of wallet. If its a web wallet the keys are in the browsers data store that the wallet extension handles. The keys could also be on a separate hardware wallet that is completely separate from the computer you interact with and requires physical button presses on the hardware device. Could also be that you are in a view only mode and just connecting with an address and you don't even have the keys on you.

Re: “Crypto drainer” template facilitates theft

#106

Post by davidmurdoch »

gowld wrote: post #66
dcolkitt wrote: post #62

Earlier quoted context omitted.

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?

I'm currently building in the ability to inspect a transaction's effects before it is run directly into MetaMask. So... we'll alleviate some of the problem Soon (TM)

Re: “Crypto drainer” template facilitates theft

#107

Post by a4isms »

api wrote: post #91
zeven7 wrote: post #82

Earlier quoted context omitted.

It depends on the website and the wallet, but either way the wallet app tells you what permissions it's giving the website. My guess is people don't pay attention or think about it. But it's not as parent described "the way the crypto community designed it". It's actually the opposite. The crypto community designed wallets that give you control over what third parties are allowed to do with your accounts. It's a lot…

> My guess is people don't pay attention or think about it. This is a well known fact in secure system design. Most people just click through dialogs. If you must get their attention you have to make the dialog huge and scary but then people will usually just turn back instead of reading. Scary dialogs make it seem like you should never say OK.

And not just secure system design.

“Undo” is powerful in any app, not just because it can roll a change back with a single click, but because scary dialog boxes (“Really, really REALLY delete this file? It can not be recovered once deleted, so check this box saying you know what you’re doing before clicking OK”) don’t work for regular apps, either.

Re: “Crypto drainer” template facilitates theft

#108

Post by daniel-cussen »

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

This is why you use a reputable website, like Coinbase, despite the outrageous fees. They have a brand as collateral if they fuck up. They had that crazy early growth rate, and at the very least the dot-com of a word Satoshi coined, and he's coined more wealth than literally anybody. Modern day Croesus of Lydia. Literally as rich as Croesus.

Re: “Crypto drainer” template facilitates theft

#109

Post by jensvdh »

davidmurdoch wrote: post #106
gowld wrote: post #66

Earlier quoted context omitted.

What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?

I'm currently building in the ability to inspect a transaction's effects before it is run directly into MetaMask. So... we'll alleviate some of the problem Soon (TM)

Problems that have been solved by regular banking decades ago. Jesus Christ the stupidity of crypto amazes me every day.

Re: “Crypto drainer” template facilitates theft

#110

Post by xur17 »

melony wrote: post #83
PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

Yeah they should pay Plaid a grand a month for that privilege instead.

Oh man.. don't get me started on Plaid. The fact that we normalized entering your bank login details in random apps is absolutely insane to me.
Post reply on HN