Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

101–110 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#101

Post by olalonde »

justinator wrote: post #78
nintendo1889 wrote: post #62

Earlier quoted context omitted.

Which is why we transfer small amounts to the wasabi hot-wallet, coinjoin, and then spend. Each spend is then joined with another spend to obfuscate every purchase. It requires careful budgeting for future purchases (as the coin-join takes time). Trezor now has experimental support for directly coin-joining bitcoin that is stored on the cold-wallet, but I don't think anyone should trust it.

Not to be snarky, but this sounds real convenient. Why don’t we just admit these tools are just fundamentally broken?

Compared to what? The only realistic alternative here is mailing cash, which is arguably more inconvenient.

Re: Funds of every Trust Wallet browser extension could have been stolen

#102

Post by codedokode »

edent wrote: post #97
codedokode wrote: post #90

Earlier quoted context omitted.

I believe that is wrong. If you keep your money as cash or in a bank deposit then you lose several percents every year because Western governments maintain a certain inflation rate. But inflation is basically stealing from everyone who has cash or bank deposits. You had 100 dollars and next year they become equivalent to 98 dollars. Cryptocurrency is different. No government is able to steal your Bitcoins by printing…

As opposed to having 100% stolen by poor security - the subject of this discussion - or fraudulent exchanges, or heavily pump-and-dumped new coins, or... the list goes on.

So maybe instead of outlawing exchanges we should have more legitimate exchanges? Also could you please describe a better way to protect your savings from printing money by governments?

Re: Funds of every Trust Wallet browser extension could have been stolen

#103

Post by SkyMarshal »

justinator wrote: post #78
nintendo1889 wrote: post #62

Earlier quoted context omitted.

Which is why we transfer small amounts to the wasabi hot-wallet, coinjoin, and then spend. Each spend is then joined with another spend to obfuscate every purchase. It requires careful budgeting for future purchases (as the coin-join takes time). Trezor now has experimental support for directly coin-joining bitcoin that is stored on the cold-wallet, but I don't think anyone should trust it.

Not to be snarky, but this sounds real convenient. Why don’t we just admit these tools are just fundamentally broken?

They’re broken b/c they’re having difficulty doing something no other electronic payment even attempts to do?

Re: Funds of every Trust Wallet browser extension could have been stolen

#104

Post by eric-hu »

lxgr wrote: post #88
jonkho wrote: post #70

Earlier quoted context omitted.

Would you be annoyed if you owned shares of a company and the company prints new shares to dilute the value of your holdings?

Why would I? Either the company's board and leadership are trustworthy (i.e. are acting in the best interest of all, not just majority or voting, shareholders), in which case they'll have carefully weighed the cost (dilution) and benefits (additional capital) of issuing new shares. Or they aren't – in which case dilution is one of many problems and it's questionable why I'd want to continue owning shares in that comp…

You’ve just connected the hypothetical question to the current behavior in play on the global scale. USD is still technically the worlds reserve currency, meant to be the base unit of all petroleum transactions. Countries have been motivated to keep USD on hand for decades for that reason.

In 2009 and 2021, the USD’s “board and leadership” has shown it’s willing to massively inflate its existing liabilities to help it solve its severe problems.

It’s very questionable why any country with large trade surpluses would want to hold US treasuries at this point. That’s precisely why China has brokered energy deals denominated in RMB, and BRICS is exploring a basket of their currencies to act as a new reserve.

Re: Funds of every Trust Wallet browser extension could have been stolen

#105

Post by ravenstine »

rchaud wrote: post #19
louison11 wrote: post #8

Why anyone would hold any significant amount in a chrome extension is beyond my understanding. Even if you’re using Metamask, use it in hybrid mode with a Ledger.

Because it is used by people , not cybersecurity experts. From the vendor's website[0]: > Our position is simple: Your wallet. Your keys. Your crypto. Built-in private key encryption and a password-protected login means you’re always in complete control. An average person that reads this wouldn't think about needing to add more protections. [0]: https://trustwallet.com/browser-extension/

Still, it's disappointing how (understandably) inept the average person is at reasoning where they should and shouldn't be placing trust in tech. It's also disappointing to be involved worth the tech industry, broadly speaking, and frequently witness shit shows of security incompetence and outright charlatanism. We can all do better, right? How we do that is definitely a question.

Re: Funds of every Trust Wallet browser extension could have been stolen

#108

Post by wingshayz »

codedokode wrote: post #90
mellosouls wrote: post #54

Earlier quoted context omitted.

That kind of argument can be applied to any value-based systems. s/crypto/ with /banks/, /religion/, /houses/. No. False equivalence. The other examples have a long history of applications that add value to people's lives (as well as disbenefits depending on your viewpoint and ideology). Crypto-currency has never yet demonstrated any significant value to normal people, though plenty of the latter.

I believe that is wrong. If you keep your money as cash or in a bank deposit then you lose several percents every year because Western governments maintain a certain inflation rate. But inflation is basically stealing from everyone who has cash or bank deposits. You had 100 dollars and next year they become equivalent to 98 dollars. Cryptocurrency is different. No government is able to steal your Bitcoins by printing…

Do you really think inflation is the government's way of stealing from the population?

Re: Funds of every Trust Wallet browser extension could have been stolen

#109

Post by lxgr »

_trampeltier wrote: post #45
4gotunameagain wrote: post #24

Earlier quoted context omitted.

Because if you read the article, you would have been informed that through WASM they did not have access to existing PRNG (e.g. /dev/urandom), and had to roll a mersenne twister. Which should not be used. It is about implementation, not about WASM

Yes, that's my point. WASM is new. So why does it not just have strong cryptographic functions from the very beginning? Strong random generators are super important today. Why don't they just demand strong crypto functions in every implementation? I mean, this calls just for endless troubles, if you don't can trust a random generator in WASM (depending on the implementation).

WASM is a "pure" VM/execution environment without any standard system calls or library functions. Given that, you'll need to provide your own seed and your own cryptographically-secure PRNG implementation.

Trust Wallet seems to have botched the latter [1] (in fact, it looks to me like they aren't even understanding the implications of that decision based on the PR description [2]). How is that WASMs fault?

[1] https://github.com/trustwallet/wallet-core/pull/2240

[2] They say that their choice of using the Mersenne Twister is "inspired by emscripten", which does no such thing.

Re: Funds of every Trust Wallet browser extension could have been stolen

#110

Post by [deleted] »

api wrote: post #64
tyingq wrote: post #12

Earlier quoted context omitted.

I don't know...multi-level marketing still seems alive and kicking.

... as are casinos. I don't think it will collapse. It has found product-market fit: mostly gambling, some money laundering and crime, and some legitimate use for international wires and payments under oppressive political conditions (this last part is the smallest amount by volume). There will occasionally be attempts to pump some new use case (e.g. NFTs), but these are just casino advertising. They'll draw in some…

[deleted]
Post reply on HN