111–120 of 167 posts
Earlier quoted context omitted.
It is impossible by design. Adding that 'feature' takes away the core principle of decentralized currency. Allowing government to reverse transactions will also allow them to seize assets. Then it is just a regular currency (for better and worse).
Didn’t ethereum fork to rollback a hack they didn’t like?
https://www.bitdegree.org/tutorials/ethereum-vs-ethereum-cla...
Earlier quoted context omitted.
Didn’t ethereum fork to rollback a hack they didn’t like?
Do you mean this? https://www.bitdegree.org/tutorials/ethereum-vs-ethereum-cla...
Earlier quoted context omitted.
Sizable, like 2%?
I looked it up. 6% of Americans don’t have a bank account. Doesn’t say whether they could go ahead and get one, or they choose not to. Sizable?
They do NOT have the technical skill to manage a bitcoin wallet. If anything it points even MORE to why we should not use crypto.
Many folks shit on the modern financial system, with its centralization and Government-coupling, but things like this are actually trackable and reversible in that ecosystem. The safeguards have evolved over centuries. I am curious when crypto will get there. Maybe 10 years or so?
But I generally agree with the advice that the service banks and fiat currency provide is probably worth the cost for almost everyone.
Earlier quoted context omitted.
In order to do anything with Bitcoin, which appears to be what the author wanted, you would have to be connected to the Internet. Keys being stored in hardware wallet sure, but the gold bars are still in public view. Hardware wallets aren't without their flaws. With an application-level vulneravility in a hardware wallet, you are still screwed. Here is just one example: https://www.ledger.com/improving-the-ecosystem-…
You can sign transactions offline and hand deliver the file if you felt so inclined. Signed transactions cant be modified. Someone needs to make sure nodes see it that transaction and add it to the database, eventually. This user experience has not been refined, but is very possible. A system with fewer nodes, like if the internet was attacked and not available, would still work for this currency.
How big is that signature/file? Can it be encoded in a QR code or something simpler to bridge the airgap?
Stuff like this is why you shouldn't use a lightweight wallet and should use the official wallet, or at least host a full node. Read more here: Full nodes: https://en.bitcoin.it/wiki/Full_node Lightweight nodes: https://en.bitcoin.it/wiki/Lightweight_node
What about an hardware wallet like Ledger?
Hardware wallets are relatively new and uncommon, so not much is known about their security risks. That said, there are no glaring, obvious issues and you could use one if you want.
Read: https://en.bitcoin.it/wiki/Hardware_wallet#Security_risks
As always, do not take advice from strangers on the internet about storing your crypto without doing extensive research on your own. The Bitcoin wiki is a great starting point: https://en.bitcoin.it/
As far as I can understand 1. The user had 1,400 BTC in an old wallet using this software 2. An old version of the software was vulnerable to phishing 3. The user attempted to use the software, and was phished 4. Massive payday for the scammers Really unfortunate - and goes to show with software you manage yourself you need to be diligent about making sure it's updated. For all the shit coinbase gets, it's difficult…
It was my understanding that the user had installed a version of the Electrum wallet that was not from the official source at electrum.org. (But agree - it was really difficult to identify the core issue from this string of GitHub comments.)
Earlier quoted context omitted.
You can sign transactions offline and hand deliver the file if you felt so inclined. Signed transactions cant be modified. Someone needs to make sure nodes see it that transaction and add it to the database, eventually. This user experience has not been refined, but is very possible. A system with fewer nodes, like if the internet was attacked and not available, would still work for this currency.
> You can sign transactions offline and hand deliver the file if you felt so inclined. How big is that signature/file? Can it be encoded in a QR code or something simpler to bridge the airgap?
As far as I can understand 1. The user had 1,400 BTC in an old wallet using this software 2. An old version of the software was vulnerable to phishing 3. The user attempted to use the software, and was phished 4. Massive payday for the scammers Really unfortunate - and goes to show with software you manage yourself you need to be diligent about making sure it's updated. For all the shit coinbase gets, it's difficult…
> For all the shit coinbase gets, it's difficult to lose your coins in this manner. Aside from U2F, Coinbase offers TOTP and SMS-based 2FA, both of which are vulnerable to phishing. So no, Coinbase is not immune to losing coins in this manner. If Coinbase wanted to prevent being vulnerable to phishing they would i) only allow U2F 2FA, and ii) make U2F mandatory for all accounts.
2. The vector of the attack isn't important. The user ultimately lost his coins because he wasn't running the latest version of the software. He could have have easily lost his shirt from an RCE. That is much more difficult on a managed SaaS platform.