Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Crypto drainer” template facilitates theft

blog.confiant.com

Post reply on HN
Print view View original

111–120 of 228 posts

Re: “Crypto drainer” template facilitates theft

#111

Post by jensvdh »

giaour wrote: post #69
PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

Users might think to themselves, I give my credit card number to all kinds of sites; how is this any different? The internet has kind of conditioned all of us to be OK with passing around complex payment instruments without paying too much attention. If you're a hardcore believer in cryptocurrency as a political project, you almost certainly understand the difference and see the "code is law" dark forest as a feature…

Because credit cards have consumer protection and laws and regulations. Crypto has none of that.

Re: “Crypto drainer” template facilitates theft

#112

Post by jensvdh »

trompetenaccoun wrote: post #102
infotogivenm wrote: post #97

Earlier quoted context omitted.

> The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Yes, so simple! Just put your coins into this website’s smart contract and you’ll be much more secu…

It's not a website. Read this if you're unsure what a smart contract is: https://ethereum.org/en/developers/docs/smart-contracts/ Btw yes, from a user perspective it actually is very simple and easy to use. It's a good wallet for beginners. Most who're more active and understand the tech have hardware wallets. You could combine the two solutions as well.

Good luck explaining that to the supposedly unbanked crypto is trying to reach.

Re: “Crypto drainer” template facilitates theft

#113

Post by Gigachad »

jensvdh wrote: post #111
giaour wrote: post #69

Earlier quoted context omitted.

Users might think to themselves, I give my credit card number to all kinds of sites; how is this any different? The internet has kind of conditioned all of us to be OK with passing around complex payment instruments without paying too much attention. If you're a hardcore believer in cryptocurrency as a political project, you almost certainly understand the difference and see the "code is law" dark forest as a feature…

Because credit cards have consumer protection and laws and regulations. Crypto has none of that.

The crypto space is rediscovering the financial system from first principals. At least by the end they can hopefully appreciate that the original government controlled system actually works the way it does for a reason.

Re: “Crypto drainer” template facilitates theft

#114

Post by davidmurdoch »

jensvdh wrote: post #109
davidmurdoch wrote: post #106

Earlier quoted context omitted.

I'm currently building in the ability to inspect a transaction's effects before it is run directly into MetaMask. So... we'll alleviate some of the problem Soon (TM)

Problems that have been solved by regular banking decades ago. Jesus Christ the stupidity of crypto amazes me every day.

I'm not Jesus Christ, but I understand your sentiment.

(let's keep the discussions civil)

Re: “Crypto drainer” template facilitates theft

#115

Post by Gigachad »

rattlesnakedave wrote: post #58
mNovak wrote: post #51

Earlier quoted context omitted.

Unless I'm misunderstanding something, I don't think it can. Your ownership of NFTs and ETH balance is public info on chain, and the site can construct a malicious transaction giving them away, but it ultimately has to trick the user into signing it. Not really sure what leeway they have to manipulate how the wallet UI presents the tx to the user though.

Metamask presents a big red warning when it requests a signature for a hex ETH transaction. But most people don’t read. Or they request token approvals users don’t bother to modify.

"requests a signature for a hex ETH transaction."

What an earth does that even mean? It's no wonder people keep messing this up. You need to spend half your life keeping up with the tech just to not get scammed.

Re: “Crypto drainer” template facilitates theft

#116

Post by Gigachad »

politician wrote: post #27
xwdv wrote: post #9

Earlier quoted context omitted.

Crypto is a net negative for the world, so anyone should feel free to pillage crypto assets and redistribute them to other more noble causes. People must learn to avoid crypto. We can teach them why.

What other things do you disapprove of that absolve people of the crime of theft? PS: Read your HN profile: Submitting stories is by far the best way to earn karma. Comments are small potatoes.

Not strictly theft, but I approve of people criminally obstructing actions which are bad for the environment. Destruction or obstruction of coal power mining/generation or smaller movements like deflating the tires of luxury SUVs.

If the law doesn't take environmental action seriously then individuals have to take control. Destroying the entire crypto market, even criminally, would be a benefit to the world.

Re: “Crypto drainer” template facilitates theft

#117

Post by caylus »

Others in the thread have mentioned that the MetaMask wallet provides a warning prior to allowing a site like this to access the wallet.

For reference, this appears to be an example of that warning: https://github.com/MetaMask/metamask-extension/issues/11337

Transcript: "Signing this message can have dangerous side effects. Only sign messages from sites you fully trust with your entire account. This dangerous method will be removed in a future version."

Presumably part of the issue is that a legitimate "NFT mint" transaction might also carry the same warning.

Re: “Crypto drainer” template facilitates theft

#118

Post by wp381640 »

MomoXenosaga wrote: post #57
PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

Banking the unbanked lol.

More unbanking the banked recently

Re: “Crypto drainer” template facilitates theft

#119

Post by trompetenaccoun »

jensvdh wrote: post #112
trompetenaccoun wrote: post #102

Earlier quoted context omitted.

It's not a website. Read this if you're unsure what a smart contract is: https://ethereum.org/en/developers/docs/smart-contracts/ Btw yes, from a user perspective it actually is very simple and easy to use. It's a good wallet for beginners. Most who're more active and understand the tech have hardware wallets. You could combine the two solutions as well.

Good luck explaining that to the supposedly unbanked crypto is trying to reach.

Do you explain TLS to casual internet users? I'd like to see that.

The regular non-tech savvy user doesn't necessarily have to understand the details. That's why people are working on such solutions in the first place. Someone experienced with blockchains would never connect their wallet to a random stranger's and approve draining their funds. However the massive hype around them has brought in a lot of new users.

Wallets have come a long way from people writing their private key on a piece of paper back in the early days. The above complaint is bizarre in this context, because what they described is the exact opposite of what's actually happened. Every reputable wallet team has worked hard on improving security over the past years using strategies like social recovery, multi sig, cold storage of keys, etc.

Re: “Crypto drainer” template facilitates theft

#120

Post by sdenton4 »

zeven7 wrote: post #82
dcolkitt wrote: post #62

Earlier quoted context omitted.

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

It depends on the website and the wallet, but either way the wallet app tells you what permissions it's giving the website. My guess is people don't pay attention or think about it. But it's not as parent described "the way the crypto community designed it". It's actually the opposite. The crypto community designed wallets that give you control over what third parties are allowed to do with your accounts. It's a lot…

Last year I had about $6k stolen via a compromised debit card and spent on some fly-by-night crypto exchange. The money was rolled back to me by the bank; no idea what happened on the crypto exchange side.
Post reply on HN