Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

131–140 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#131

While this is flatout insane, it does not speak toward crypto's security directly. If you personally decide that you want a company to hold your crypto that's your decision and a poor one at that. You have the ability to create your own wallet and hold your funds in it securely. Some exchanges like Coinbase even have wallet apps so the transition is super easy to make.

[deleted]

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#132
post #45

Earlier quoted context omitted.

> A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. Former FTX US President Reportedly Quit After ‘Protracted Disagreement’ With Bankman-Fried - https://www.coindesk.com/business/2023/04/09/former-ftx-us-p... > ... > According to the report, another employ…

> We sometimes find $50m of assets lying around that we lost track of; such is life. I want that life. No, seriously, let me find even just $5M laying around, just once. I mean, what do you need to have between your ears to even remotely consider losing, and then finding, 50 millions of someone else's money as normal? Such is life? Where? Other than in government agencies, of course.

I've found a $100 bill I misplaced before, and to me that represents a higher percentage of my net wealth than $5M would to most billionaires

And that might be equivalent to a penny to a significant chunk of the global population that doesn't have more than $2-4 to their name

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#133

It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…

- Banks not doing their due diligence to make sure they are lending to the correct person, and then being allowed to blame the victim for it.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#134

Earlier quoted context omitted.

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

That conclusion doesn't necessarily follow. A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. However, money is an exception in this regard, and many cryptocurrency advocates argue that it could be better managed outside of government control. This does not imply that a justice system is unnecessary; rather, it emphasizes diverse role…

I think the contradiction is that if you don't allow the government access to the financial system then there is little it can do for you to get your money back or investigate financial crimes.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#135
post #74

Earlier quoted context omitted.

> Every bank check lists the bank account number, which serves as the only information needed for a party to issue a request to withdraw money from that account. The same principle (i.e. knowing an account number means being able to debit it) works surprisingly well in many European countries for direct debits, and the account number is considered even less of a secret than it is in the US. For example, many freelanc…

This does have a minor drawback on the service provider side as allowing people to sign up for a service with direct debit is hard to get right, so many services prefer to offer credit card payment even if it is more expensive. There is no way for you to verify that a person signing up is actually the account holder save for doing the "we debited 1c on your account" thing, which takes a few days.

Yes, and that's arguably by design. If you need confirmation of funds, cardholder/accountholder authentication, and a dispute mechanism that doesn't side with the customer in 100% of scenarios, SEPA Direct Debit is probably not the payment method you want.

> the "we debited 1c on your account" thing

This doesn't actually work with SEPA Direct Debits, since there is no such thing as "disputing a reversal" or "compelling evidence": If the accountholder says "funds back, please", the involved banks have to oblige.

In fact, direct debits are so reversible/non-final that it's SOP for bankruptcy managers to claw back all of the last 8 weeks' worth of direct debits drawn on a bankrupt person's or entity's account, which can be quite surprising for debtors.

In other words, it's possibly a better mental model to think of direct debits as a request for a wire in 8 weeks that gets earmarked for approval by default if enough funds are present, but that accountholders can cancel at any point in time, as far as finality (but not liquidity) is concerned.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#136

Earlier quoted context omitted.

This is mostly unique to the US. Where I'm from, we don't use our SSNs as passwords , bank checks and direct debit are simply not a thing, and credit cards have two-factor authentication for online purchases.

2FA for online purchases is, at least in Germany, is not always a thing. I don't know how it's decided, but I'd say only about 50% -70% of online purchases trigger the 2fa of my bank.

My understanding is that it is related to the fraud prevention capabilities (incidence?) of the other party and the amount.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#137

Earlier quoted context omitted.

Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.

The still living members of the Silent Generation would disagree. They still don't trust banks and the banks have once again proven themselves to be untrustworthy.

> The still living members of the Silent Generation would disagree.

Never heard of them. They are incredibly effective at living up to their name.

> They still don't trust banks

Neither do I. I also don't trust my cell phone provider or the grocery store or the company that makes the web browser I use.

> the banks have once again proven themselves to be untrustworthy.

That's because they are. That's why we have a system of laws and regulations in place which kinda work at keeping them from screwing over most people, most of the time. But not always and not everyone. It is a work in progress.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#138

Earlier quoted context omitted.

You are imagining a false dichotomy where things like fast and final settlement, or self custody are forced onto every user, and pointing out the obvious problems with that scenario. They are not good defaults, but they are great to have as options to protect customers against a fraudulent or over leveraged system. It is a bit like any protected right-- you don't have to directly make use of it for it to be valuable,…

Not really. Fast (immutable) settlement is terrible for humans. Self custody is more or less incompatible with our modern world. And despite that, there are ways to do both without crypto—hand someone stacks of cash and keep gold in a safe under the floorboard. Both of these options exist.

You are repeating the same false dichotomy by stating again that final settlement and self custody are bad defaults for the entire world. That isn't want I'm saying, I am saying a choice is better than no choice at all. I'm also not saying anything about crypto. Gold and cash are also useful instruments that should be financial instruments for everyone also.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#139

Earlier quoted context omitted.

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.

So it is OK to have your jeans made by children and in a factory that pours toxic waste into a river used for drinking water?

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#140
post #35

Earlier quoted context omitted.

i was okay with the fraud and the crime. it was the hierarchical polyamory that pushed me over the line.

That was just ironic I am sure Just like the “very easy math” that they all touted that was all that was needed to manage the entire thing

The math gets REALLY easy when you do none of it.
Post reply on HN