Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

131–140 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#131

Post by krono »

lxgr wrote: post #119
krono wrote: post #46

> Creating good randomness is a daunting task - Ledger devices rely on dedicated silicon logic in our certified smartcard chips that have been the gold standard of secure industries for the past 40 years to guarantee high quality randomness and tamper resistance. Which is worthless and entirely irrelevant when they keep leaking their customers' personal and purchase data (which they claimed not to collect or keep, an…

These data leaks are indeed very bad, but in what way do they make the actual core product and its security goals "worthless and entirely irrelevant"?

What good is all this super reliable gold-standard encryption when its provider has shown to be so incredibly careless with the exact sort of information this solution is meant to protect?

Whatever security goals they claim to pursue exist only in their marketing copy.

Re: Funds of every Trust Wallet browser extension could have been stolen

#132

Post by renewiltord »

krono wrote: post #46

> Creating good randomness is a daunting task - Ledger devices rely on dedicated silicon logic in our certified smartcard chips that have been the gold standard of secure industries for the past 40 years to guarantee high quality randomness and tamper resistance. Which is worthless and entirely irrelevant when they keep leaking their customers' personal and purchase data (which they claimed not to collect or keep, an…

Wait, that's neither worthless nor irrelevant. You can't take all my money using my personal and purchase data.

Re: Funds of every Trust Wallet browser extension could have been stolen

#133

Post by doodlesdev »

4gotunameagain wrote: post #24
_trampeltier wrote: post #3

Why is in something so new (WASM), a such bad random generator?

Because if you read the article, you would have been informed that through WASM they did not have access to existing PRNG (e.g. /dev/urandom), and had to roll a mersenne twister. Which should not be used. It is about implementation, not about WASM

Couldn't they have used CryptMT [0] instead of MT19937 (or whatever mersenne twister implementation they had)? Saying mersenne twister should not be used is a bit misleading as it all depends on the specific implementations and needs of the application.

Anyhow, they could still have used webcrypto through WASM or even through JavaScript (as they can send the data back). This is really not a problem with WASM but moreso with the stupid implementation of this wallet.

edit: According to this PR they were indeed using std::mt19937 [1]. In fact I would go further ahead and say this is a general issue of C++ itself which just does not provide good PRNGs in the stdlib at all, with multiple ways of achieving different (but similarly broken) PRNG results.

[0]: https://en.m.wikipedia.org/wiki/CryptMT

[1]: https://github.com/trustwallet/wallet-core/pull/2240

Re: Funds of every Trust Wallet browser extension could have been stolen

#134

Post by codedokode »

latchkey wrote: post #125
codedokode wrote: post #116

Earlier quoted context omitted.

It's rate is not arbitrary, it is maintained at specific level, as they say, for better economy development. But it is unclear whether you will win from that or somebody else, what is certain that you lose money every year because of this. You had 100 dollars and year later they are only worth 98 dollars. What is it if not stealing?

Those 100 are worth less, not because it was stolen, but because it was devalued / diluted through minting of more magic beans. Not all loss is theft.

So, by printing money the government takes money from citizens' pockets. Cryptocurrency is protected from this by design.

Re: Funds of every Trust Wallet browser extension could have been stolen

#135

Post by mrkstu »

codedokode wrote: post #98
mrkstu wrote: post #35

Earlier quoted context omitted.

They (i.e. materials like gold/silver) have inherent value as being relatively difficult to obtain without significant work and being useful in creating valuable objects. Because of those properties they become a store of value (representing the work and rarity) which then makes them a useful proxy for trading that value, which increases their rarity/value by taking it out of circulation when used as a store of value…

Can we conclude that gold is similar to cryptocurrency because of this?

As a store of work, sure,

The difference being the currency in this case has no inherent value to fall back upon.

Re: Funds of every Trust Wallet browser extension could have been stolen

#136

Post by detrites »

jakelazaroff wrote: post #86
detrites wrote: post #20

Earlier quoted context omitted.

The flaw here was in a dependency introduced by targeting WASM, and could apply to any project of any kind relying on random number generation for a cryptographic purpose. It is not a "crypto-currency" specific problem.

You don't think that your bank would get your money back if this happened to them?

Which bank? SVB? FRB?

You raise an important point though: crypto is not for the faint-hearted. "Be your own bank" has exactly that much responsibility attached. Many don't fully appreciate that.

Re: Funds of every Trust Wallet browser extension could have been stolen

#137

Post by detrites »

veeti wrote: post #72
detrites wrote: post #20

Earlier quoted context omitted.

The flaw here was in a dependency introduced by targeting WASM, and could apply to any project of any kind relying on random number generation for a cryptographic purpose. It is not a "crypto-currency" specific problem.

The flaw was not in a dependency but Trust Wallet's first party code [1]. They decided that Mersenne Twister would be sufficient for generating cryptographically random data and specifically called it "secure" [2]. Very unfortunate. [1] https://github.com/trustwallet/wallet-core/blob/3.1.0/wasm/s... [2] https://github.com/trustwallet/wallet-core/pull/2240

Yes, a terrible decision - but still a decision left up to any developer in a similar position - which, with the trend to WASMify things may well happen again in other projects, until it's better addressed at the source.

Honestly, it's so bad it makes me wonder if a bad actor could have had influence over such a decision in this case. Reports of Trust Wallet accounts being randomly pilfered without some plausible other cause might go some way to figuring that out.

Re: Funds of every Trust Wallet browser extension could have been stolen

#138

Post by itsoktocry »

latchkey wrote: post #128
kristianc wrote: post #127

Earlier quoted context omitted.

I understand that anything I buy is backed by ownership in an institution, that there are onerous regulatory and reporting requirements, centralized institutions managing it, ample liquidity if I want to get out at any point at that people get sent to prison if they try to manipulate it…

Is that a no?

You are asking the wrong question.

"Do you have a sufficient understanding of stock markets?"

For most people that's a "yes". They know what stocks are, what they represent, who the big players are to buy stocks on your behalf, and can be assured that the money is going to get to the right place.

This is just not the case for crypto (yet), not remotely. Tons of tech people hardly know how these things work.

Re: Funds of every Trust Wallet browser extension could have been stolen

#139

Post by BlandDuck »

latchkey wrote: post #122
kristianc wrote: post #120

I’m not sure why there is such fascination with this tech when it’s complex to understand and implement, prone to break in a thousand different ways, and has an ecosystem which is absolutely crammed with bad actors. This requires a deep understanding of cryptography to even understand if you’re safe. Why do people take the risk? Is it because they like to feel smart?

Do you have a deep understanding of how the stock market works?

In the stock market there is a long history of regulatory protection of unsophisticated investors, starting with the Securities Act of 1933 and Securities and Exchange Act of 1934. The whole point of these acts is to protect unsophisticated investors so they can invest in the stock market without fully understanding the details of how it works.

Re: Funds of every Trust Wallet browser extension could have been stolen

#140

Post by Retric »

olalonde wrote: post #101
justinator wrote: post #78

Earlier quoted context omitted.

Not to be snarky, but this sounds real convenient. Why don’t we just admit these tools are just fundamentally broken?

Compared to what? The only realistic alternative here is mailing cash, which is arguably more inconvenient.

Why not use those gift credit cards loaded with cash if you want anonymity for less effort?
Post reply on HN