Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

111–120 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#111

Post by egeozcan »

Tarilo wrote: post #10
egeozcan wrote: post #4

I quite like the JVM but I think it should be stopped from running inside a browser.

The thing is that it's easy to stop Java applets from executing. Even better most browser prevent this by default. Including chrome, which he was probably using as indicated by the screenshot. Looks like this was entirely his own fault, though it still sucks. Wouldn't hope for a refund though t.b.h.

Yes, I guess you're right. Am I being evil when I think that it would have been great if we could publish security patches for humans? =)

Re: How I got robbed of 34 btc on Mt.Gox today

#112

Post by pilgrim689 »

ConceitedCode wrote: post #67
tripzilch wrote: post #54

So, how about if you could have a Linux boot image onna stick, properly secured, no Java, several BitCoin apps preinstalled and optimized to boot extremely quickly into what would basically be a sort of BitCoin Wallet dashboard interface. You could plug in the USB, hibernate, flip the switch and be Bitcoin banking within seconds. Then unhibernate and get on with whatever you were doing on your day-to-day OS. That way…

The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

A workaround: the device you connect to has a bitcoin client running just to keep the block chain up to date. The USB key, upon connecting, syncs that block chain with the one stored on the key. When you connect to a new device, the block chain from the key is synced onto that new device. Depending on how often you switch device / how often you use the key, this might or might not be a useful workaround :P.

Re: How I got robbed of 34 btc on Mt.Gox today

#113

Post by Intermernet »

wereHamster wrote: post #98

"site is loaded with a java script" - srsly? You do ebanking (or ebitcoining) on a computer which has java installed?

I hate to say it, but (at least in Australia) many banks require Java to do business banking.

This should change (at the glacial rate banks change things) as they realise that Java in the browser is risky business.

This may change if Oracle pull their finger out, stop being dicks about the licensing, and try to promote the language again.

Honestly, I think they've left it too late and the majority of "Java" you're going to see in the near future is going to be related to Android (and hence not running on Oracle's stack).

Re: How I got robbed of 34 btc on Mt.Gox today

#114

Post by unreal37 »

cookiecaper wrote: post #91
ConceitedCode wrote: post #67

Earlier quoted context omitted.

The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

Nothing possibly could go wrong downloading the blockchain from a torrent site....

Re: How I got robbed of 34 btc on Mt.Gox today

#116

Post by jack_trades »

How useful is a "currency" if it 1) has volatility like a penny stock and 2) raises the stakes on 0-day defense to something ridiculous?

When I hear interviews where people (bitcoin founder) suggest that you don't transfer into bitcoins any state currency you aren't willing to lose... it sort of peels the "inflation-hedge" covers off the whole thing. How unstable and unsecure does a currency have to be to be nearly worthless? USDollars look pretty safe again.

This is so much a game of hacker gambling. A great experiment. Too bad it consumes so much productive time and energy.

The beautiful narrative of the reclusive, open-society, eastern hacker that designs this thing which grows to be the godzilla it is... The story arc on bitcoin is borderline trite. Michael Bay is all over this in a year.

Re: How I got robbed of 34 btc on Mt.Gox today

#117

Post by mikeash »

mootothemax wrote: post #12

Mtgox has clearly not had time to respond, and I fear they will claim this is my fault as I have seen in other posts online that they say "report it to the police". They should compensate me 100%. This shows one of the fundamental problems with Bitcoin-related services: when people get taken advantage of, they expect to be compensated. While in the real world, banks will often compensate you if you're the victim of f…

I felt sorry for the guy up to this point. You have the notoriously insecure Java plugin enabled in the same browser you use to access your digital cash, and you click on random links in a chat full of people with accounts on the same digital cash site? No, that's your fault, not Mtgox's.

He goes on to say, "First because their site is not secured against such rudimentary attacks as has been demonstrated today." I can't fathom how they're supposed to protect from users' computers being taken over. The only real way to do that is to have two-factor authentication... which they offer, and this guy did not use.

It sucks to get robbed, certainly. But blaming Mtgox for this is uncalled-for.

Re: How I got robbed of 34 btc on Mt.Gox today

#118

Post by tripzilch »

cookiecaper wrote: post #91
ConceitedCode wrote: post #67

Earlier quoted context omitted.

The biggest issue I see would be updating the block chain for the wallet between uses. Seems like it takes longer and longer to update. Moved my wallet to a new computer last night and it's been going for the last 5 hours.

If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

This thread appears to have a download/torrent for a recent version of the blockchain data. It's about 4.7GB, apparently.

https://bitcointalk.org/index.php?topic=145386.0

So does that mean if you're not using BC via a wallet service, it requires at least 4.7GB of disk space in order to do its thing? How is this amount of data expected to grow in the future?

Re: How I got robbed of 34 btc on Mt.Gox today

#119

Post by jacquesm »

amalag wrote: post #108
dolphenstein wrote: post #105

Earlier quoted context omitted.

It didn't. "AdobeUpdate-Setup1.84.exe" is the executable that did the damage.

Yes, I understand the java applet executed the next file. How did the "AdobeUpdate-Setup1.84.exe" executable do the transfer?

If it has file access permissions it can scan for wallet.dat in a few likely locations and then simply upload that file to a server, then delete the original and you're pretty sure that you'll have time enough to register a transaction with the bitcoin network.

Re: How I got robbed of 34 btc on Mt.Gox today

#120

Post by tripzilch »

unreal37 wrote: post #114
cookiecaper wrote: post #91

Earlier quoted context omitted.

If you download the blockchain from the P2P wallet client it always takes forever. You should download the blockchain once, put it on a USB drive, and then copy it into .bitcoin before you bootstrap a new machine with a wallet. There are also sites that offer downloads of tar'd versions of the blockchain, or torrents. Pretty much anything is going to be faster than downloading via a bitcoin client.

Nothing possibly could go wrong downloading the blockchain from a torrent site....

According to the thread I linked above, the software verifies the data during import.
Post reply on HN