Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

121–130 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#121

Post by grishka »

datadata wrote: post #53

It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…

This is mostly unique to the US. Where I'm from, we don't use our SSNs as passwords, bank checks and direct debit are simply not a thing, and credit cards have two-factor authentication for online purchases.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#122

Post by arcticbull »

dang wrote: post #66
arcticbull wrote: post #13

Earlier quoted context omitted.

> That crosses the line and goes deep into "willful negligence" territory, in my view. Er, that's the thing that pushed you over the line? Not all the fraud and crime?

" Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. " https://news.ycombinator.com/newsguidelines.html

Ah sorry, I just meant that light-heartedly. I wasn't assuming ill intent of the parent at all - just FTX. I'll be more careful. Tone doesn't always carry well over the internet.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#123

Post by logicalmonster »

gleenn wrote: post #33
logicalmonster wrote: post #23

Earlier quoted context omitted.

> That crosses the line and goes deep into "willful negligence" territory, in my view. A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. They could have preplanned this behavior. If they were ever caught doing anything really bad, they had "plausible denia…

While I agree with most of this, keeping a small number of things secure for yourself is far easier than doing it for thousands/millions of accounts in an automated way. That's true of almost everything in software. For instance, just because I know how to use a password manager doesn't mean it's easy to get my whole family using a password manager. They were clearly dysfunctional and there may be some of this at pla…

> While I agree with most of this, keeping a small number of things secure for yourself is far easier than doing it for thousands/millions of accounts in an automated way.

Of course, but the qualifier I used is "make a case".

Obviously, nobody can ever read SBF's mind, but the government might have enough to prosecute him from this angle if they could prove that he knew better from his behavior with his own holdings, but didn't do things in a certain way for FTX's holdings.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#124

Post by WeylandYutani »

causality0 wrote: post #10
cs702 wrote: post #2

Wait, what ? Private keys were stored in unprotected plaintext files regularly opened by multiple people at the company? WTF? That crosses the line and goes deep into "willful negligence" territory, in my view. The physical equivalent would be stacking customer assets like dollar bills and gold bars in big piles inside a heavily trafficked room that has no lock. The term "irresponsible" doesn't quite do justice to it…

Personally I believe there's a strong correlation between how crazy you act on social media and how competent your internal security is.

There's a reason why all bankers from Nigeria to Japan wear boring gray suits in commercials.

Never understood what people saw in SBF.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#125

Post by organsnyder »

marcosdumay wrote: post #102
lxgr wrote: post #74

Earlier quoted context omitted.

> Every bank check lists the bank account number, which serves as the only information needed for a party to issue a request to withdraw money from that account. The same principle (i.e. knowing an account number means being able to debit it) works surprisingly well in many European countries for direct debits, and the account number is considered even less of a secret than it is in the US. For example, many freelanc…

> What makes it work is that, under the SEPA Direct Debit framework, the risk of fraud and insufficient funds is 100% on the party initiating the direct debit. It also helps that the accountholder has to allow each party that will debit money from their account. By default, those requests are denied. AFAIK, the US works the other way around.

> AFAIK, the US works the other way around.

"Positive pay" is available for checking accounts in the US, though I've never heard of it used outside of business accounts, and only then by request (and probably extra fees).

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#126

Post by japhyr »

dieselgate wrote: post #110
amanj41 wrote: post #87

Earlier quoted context omitted.

What's particularly astounding about the case of FTX is that it was rolling in cash (unlike many startups), and yet never cared enough to throw money at hiring tons of security-minded staff and engineers

Yeah have often thought the same but presumably they wouldn’t have been able to keep pulling all these shenanigans/fraud if they had proper security staff.

If you read through some of the other parts of the thread, there are stories where they fired competent people as soon as they called attention to these kinds of issues.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#127

Post by Semaphor »

grishka wrote: post #121
datadata wrote: post #53

It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…

This is mostly unique to the US. Where I'm from, we don't use our SSNs as passwords , bank checks and direct debit are simply not a thing, and credit cards have two-factor authentication for online purchases.

2FA for online purchases is, at least in Germany, is not always a thing. I don't know how it's decided, but I'd say only about 50% -70% of online purchases trigger the 2fa of my bank.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#128

Post by pcthrowaway »

datadata wrote: post #63
Quarrelsome wrote: post #52

As the tweet points out the bad practice and doesn't comment on the good practice how _should_ one store their keys? Specifically the tweet states that using a secret manager or password vault is a problem, so what is the solution?

A normal pattern is to tier storage into a hot wallet and a cold wallet. Hot wallet is used for daily operations and can have lower security, but has a very low percentage of value, so that if hacked the exchange and eat the loss. The cold wallet can have very very high security measures such as multisig, physical security, geographic distribution, etc, and only needs to be periodically accessed. Analogy in a old ban…

Yep. You can also put cold funds behind a multisig, which to use the vault in the back of the bank example, would require two managers to turn a key at the same time to open the vault.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#129

Post by anecdotal1 »

WeylandYutani wrote: post #120
reisse wrote: post #22

Earlier quoted context omitted.

One thinks about crypto as a clownworld only until one had to work with or inside the real financial system. Techincally, it is in no way better than crypto. The only difference is that in real financial system there is a strong legal cover for all the technical and security fuckups. Like, stealing from bank by exploiting their 10-years old Windows XP ATM connected to the internet is 10-years-in-jail offence, while s…

Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.

The still living members of the Silent Generation would disagree. They still don't trust banks and the banks have once again proven themselves to be untrustworthy.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#130

Post by lxgr »

marcosdumay wrote: post #102
lxgr wrote: post #74

Earlier quoted context omitted.

> Every bank check lists the bank account number, which serves as the only information needed for a party to issue a request to withdraw money from that account. The same principle (i.e. knowing an account number means being able to debit it) works surprisingly well in many European countries for direct debits, and the account number is considered even less of a secret than it is in the US. For example, many freelanc…

> What makes it work is that, under the SEPA Direct Debit framework, the risk of fraud and insufficient funds is 100% on the party initiating the direct debit. It also helps that the accountholder has to allow each party that will debit money from their account. By default, those requests are denied. AFAIK, the US works the other way around.

> By default, those requests are denied.

That's not the case in Germany, at least.

Post reply on HN