Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

111–120 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#111

Post by overthrow »

LapsangGuzzler wrote: post #68
reisse wrote: post #22

Earlier quoted context omitted.

One thinks about crypto as a clownworld only until one had to work with or inside the real financial system. Techincally, it is in no way better than crypto. The only difference is that in real financial system there is a strong legal cover for all the technical and security fuckups. Like, stealing from bank by exploiting their 10-years old Windows XP ATM connected to the internet is 10-years-in-jail offence, while s…

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#112

Post by klibertp »

shagie wrote: post #45
logicalmonster wrote: post #23

Earlier quoted context omitted.

> That crosses the line and goes deep into "willful negligence" territory, in my view. A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. They could have preplanned this behavior. If they were ever caught doing anything really bad, they had "plausible denia…

> A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. Former FTX US President Reportedly Quit After ‘Protracted Disagreement’ With Bankman-Fried - https://www.coindesk.com/business/2023/04/09/former-ftx-us-p... > ... > According to the report, another employ…

> We sometimes find $50m of assets lying around that we lost track of; such is life.

I want that life. No, seriously, let me find even just $5M laying around, just once.

I mean, what do you need to have between your ears to even remotely consider losing, and then finding, 50 millions of someone else's money as normal? Such is life? Where? Other than in government agencies, of course.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#114

Post by pcthrowaway »

themagician wrote: post #81
willio58 wrote: post #14

While this is flatout insane, it does not speak toward crypto's security directly. If you personally decide that you want a company to hold your crypto that's your decision and a poor one at that. You have the ability to create your own wallet and hold your funds in it securely. Some exchanges like Coinbase even have wallet apps so the transition is super easy to make.

Wallet "apps" are not secure. It's an illusion of security. Unless the source is open AND verifiable there is no reason to trust it more than trusting FTX. I 100% guarantee that there will be a major hack, from a major app, at some point in the future where it turns out that all seed generation was not in fact random. Honestly, it's probably already happened multiple times and they just haven't gotten caught. Those s…

I've never heard of a crypto wallet that was not open source. The coinbase one certainly is.

That doesn't mean there won't be hacks and backdoors though.

You also need to build them from the codebase yourself if you want to be completely sure that you're running the code that's visible (though maybe there's a better way to verify this with Android/iOS apps?)

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#115

Post by mnky9800n »

h2odragon wrote: post #34
mnky9800n wrote: post #30

Earlier quoted context omitted.

i was okay with the fraud and the crime. it was the hierarchical polyamory that pushed me over the line.

> the hierarchical polyamory that pushed me over the line. Really. At that point one should have the decency to declare your outfit a religion, and stop paying taxes.

you are obviously too clever to have been employed at FTX.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#116

Post by themagician »

datadata wrote: post #100
themagician wrote: post #88

Earlier quoted context omitted.

Honestly, I don't really see this. Small personal transactions happen via Cash, Venmo, PayPal, Zelle, etc. without much issue or friction. As far as the general consumer is concerned it is instant. Large business transactions generally (not always, obviously) do not have the sense of urgency that would require fast settlement. There's some market maker stuff that benefits from fast settlement, but that's not exactly…

You are imagining a false dichotomy where things like fast and final settlement, or self custody are forced onto every user, and pointing out the obvious problems with that scenario. They are not good defaults, but they are great to have as options to protect customers against a fraudulent or over leveraged system. It is a bit like any protected right-- you don't have to directly make use of it for it to be valuable,…

Not really. Fast (immutable) settlement is terrible for humans. Self custody is more or less incompatible with our modern world. And despite that, there are ways to do both without crypto—hand someone stacks of cash and keep gold in a safe under the floorboard. Both of these options exist.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#117

Post by [deleted] »

overthrow wrote: post #111
LapsangGuzzler wrote: post #68

Earlier quoted context omitted.

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.

[deleted]

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#118

Post by themagician »

pcthrowaway wrote: post #114
themagician wrote: post #81

Earlier quoted context omitted.

Wallet "apps" are not secure. It's an illusion of security. Unless the source is open AND verifiable there is no reason to trust it more than trusting FTX. I 100% guarantee that there will be a major hack, from a major app, at some point in the future where it turns out that all seed generation was not in fact random. Honestly, it's probably already happened multiple times and they just haven't gotten caught. Those s…

I've never heard of a crypto wallet that was not open source. The coinbase one certainly is. That doesn't mean there won't be hacks and backdoors though. You also need to build them from the codebase yourself if you want to be completely sure that you're running the code that's visible (though maybe there's a better way to verify this with Android/iOS apps?)

How do I know the code running on my iPhone is the same as what is on Github? I don't.

There is every incentive for someone to cheat here. There is very little risk, and the potential reward is basically infinite. I can slip a few lines of code in that grant me access to every wallet generated. Worst case I get caught and fired. Best case no one ever knows.

Assuming your employer isn't in on it and you get caught, what are they going to do? Seriously, think about it. If they acknowledge this in anyway the company is OVER. The best course of action is fire you, push a new release and just pray that you don't drain the wallets of the victims in a way that raises too much suspicion.

You either generate seeds from source you audited or maybe trust a hardware wallet that has been sufficiently audited. App-based wallets get new releases on a daily basis. The security is a joke.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#119

Post by olalonde »

LapsangGuzzler wrote: post #68
reisse wrote: post #22

Earlier quoted context omitted.

One thinks about crypto as a clownworld only until one had to work with or inside the real financial system. Techincally, it is in no way better than crypto. The only difference is that in real financial system there is a strong legal cover for all the technical and security fuckups. Like, stealing from bank by exploiting their 10-years old Windows XP ATM connected to the internet is 10-years-in-jail offence, while s…

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

That conclusion doesn't necessarily follow. A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. However, money is an exception in this regard, and many cryptocurrency advocates argue that it could be better managed outside of government control. This does not imply that a justice system is unnecessary; rather, it emphasizes diverse roles of government.

In other words, one can agree with certain roles for government (e.g. justice system) while not agreeing with others (e.g. managing money). I don't see the irony or the contradiction.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#120

Post by WeylandYutani »

reisse wrote: post #22
skyechurch wrote: post #5

When reading crypto clownworld stories like this, it is easy and fun to observe that cryptocurrency is a satire of the real (or "fiat", if you prefer) financial system. Less fun, but far more important, is to note how incredibly (infinitely?) subtle this satire is: https://news.ycombinator.com/item?id=22352840

One thinks about crypto as a clownworld only until one had to work with or inside the real financial system. Techincally, it is in no way better than crypto. The only difference is that in real financial system there is a strong legal cover for all the technical and security fuckups. Like, stealing from bank by exploiting their 10-years old Windows XP ATM connected to the internet is 10-years-in-jail offence, while s…

Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.
Post reply on HN