While this is flatout insane, it does not speak toward crypto's security directly. If you personally decide that you want a company to hold your crypto that's your decision and a poor one at that. You have the ability to create your own wallet and hold your funds in it securely. Some exchanges like Coinbase even have wallet apps so the transition is super easy to make.
FTX stored private keys to crypto assets in plaintext, without access controls
131–140 of 222 posts
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#132Earlier quoted context omitted.
> A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. Former FTX US President Reportedly Quit After ‘Protracted Disagreement’ With Bankman-Fried - https://www.coindesk.com/business/2023/04/09/former-ftx-us-p... > ... > According to the report, another employ…
> We sometimes find $50m of assets lying around that we lost track of; such is life. I want that life. No, seriously, let me find even just $5M laying around, just once. I mean, what do you need to have between your ears to even remotely consider losing, and then finding, 50 millions of someone else's money as normal? Such is life? Where? Other than in government agencies, of course.
And that might be equivalent to a penny to a significant chunk of the global population that doesn't have more than $2-4 to their name
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#133It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#134Earlier quoted context omitted.
> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…
That conclusion doesn't necessarily follow. A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. However, money is an exception in this regard, and many cryptocurrency advocates argue that it could be better managed outside of government control. This does not imply that a justice system is unnecessary; rather, it emphasizes diverse role…
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#135Earlier quoted context omitted.
> Every bank check lists the bank account number, which serves as the only information needed for a party to issue a request to withdraw money from that account. The same principle (i.e. knowing an account number means being able to debit it) works surprisingly well in many European countries for direct debits, and the account number is considered even less of a secret than it is in the US. For example, many freelanc…
This does have a minor drawback on the service provider side as allowing people to sign up for a service with direct debit is hard to get right, so many services prefer to offer credit card payment even if it is more expensive. There is no way for you to verify that a person signing up is actually the account holder save for doing the "we debited 1c on your account" thing, which takes a few days.
> the "we debited 1c on your account" thing
This doesn't actually work with SEPA Direct Debits, since there is no such thing as "disputing a reversal" or "compelling evidence": If the accountholder says "funds back, please", the involved banks have to oblige.
In fact, direct debits are so reversible/non-final that it's SOP for bankruptcy managers to claw back all of the last 8 weeks' worth of direct debits drawn on a bankrupt person's or entity's account, which can be quite surprising for debtors.
In other words, it's possibly a better mental model to think of direct debits as a request for a wire in 8 weeks that gets earmarked for approval by default if enough funds are present, but that accountholders can cancel at any point in time, as far as finality (but not liquidity) is concerned.
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#136Earlier quoted context omitted.
This is mostly unique to the US. Where I'm from, we don't use our SSNs as passwords , bank checks and direct debit are simply not a thing, and credit cards have two-factor authentication for online purchases.
2FA for online purchases is, at least in Germany, is not always a thing. I don't know how it's decided, but I'd say only about 50% -70% of online purchases trigger the 2fa of my bank.
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#137Earlier quoted context omitted.
Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.
The still living members of the Silent Generation would disagree. They still don't trust banks and the banks have once again proven themselves to be untrustworthy.
Never heard of them. They are incredibly effective at living up to their name.
> They still don't trust banks
Neither do I. I also don't trust my cell phone provider or the grocery store or the company that makes the web browser I use.
> the banks have once again proven themselves to be untrustworthy.
That's because they are. That's why we have a system of laws and regulations in place which kinda work at keeping them from screwing over most people, most of the time. But not always and not everyone. It is a work in progress.
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#138Earlier quoted context omitted.
You are imagining a false dichotomy where things like fast and final settlement, or self custody are forced onto every user, and pointing out the obvious problems with that scenario. They are not good defaults, but they are great to have as options to protect customers against a fraudulent or over leveraged system. It is a bit like any protected right-- you don't have to directly make use of it for it to be valuable,…
Not really. Fast (immutable) settlement is terrible for humans. Self custody is more or less incompatible with our modern world. And despite that, there are ways to do both without crypto—hand someone stacks of cash and keep gold in a safe under the floorboard. Both of these options exist.
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#139Earlier quoted context omitted.
> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…
Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.
Re: FTX stored private keys to crypto assets in plaintext, without access controls
#140Earlier quoted context omitted.
i was okay with the fraud and the crime. it was the hierarchical polyamory that pushed me over the line.
That was just ironic I am sure Just like the “very easy math” that they all touted that was all that was needed to manage the entire thing