Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

dzoba.com

Post reply on HN
Print view View original

131–140 of 157 posts

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#131

Post by wpietri »

claudius wrote: post #36
nwh wrote: post #28

Earlier quoted context omitted.

I'm still getting almost daily phishing/malware from the Mt Gox leak in 2011, and I never even signed up for anything more than to see what it's interface was like. Can't imagine how that will be with people having copies of passports (supposedly).

My spam folder is also full of, well, spam addressed to the email address I supplied to Dropbox (and only Dropbox) when I first signed up there sometime in 2011 and later leaked (I think 2012). Sometimes I wish data privacy laws were stricter, but it appears that not even financial services laws are sufficiently strict, as just demonstrated here.

Please contact Dropbox support about this. Mine vendor-tagged address leaked on or before 3 Feb 2014, as that's when I got the first spam. I'm currently in the middle of persuading them that they have a security issue, and more people expressing the problem would be helpful.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#132

Post by claudius »

wpietri wrote: post #131
claudius wrote: post #36

Earlier quoted context omitted.

My spam folder is also full of, well, spam addressed to the email address I supplied to Dropbox (and only Dropbox) when I first signed up there sometime in 2011 and later leaked (I think 2012). Sometimes I wish data privacy laws were stricter, but it appears that not even financial services laws are sufficiently strict, as just demonstrated here.

Please contact Dropbox support about this. Mine vendor-tagged address leaked on or before 3 Feb 2014, as that's when I got the first spam. I'm currently in the middle of persuading them that they have a security issue, and more people expressing the problem would be helpful.

The spam to mine goes back to at least March 2013 (yeah, I like to keep spam, makes it easier to train filters later one…), possibly earlier, so I don’t think that it is a recent leak.

I have stopped using Dropbox shortly after receiving the first such spam email, so I cannot comment on more recent leaks.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#133

Post by claudius »

Cthulhu_ wrote: post #83
claudius wrote: post #36

Earlier quoted context omitted.

My spam folder is also full of, well, spam addressed to the email address I supplied to Dropbox (and only Dropbox) when I first signed up there sometime in 2011 and later leaked (I think 2012). Sometimes I wish data privacy laws were stricter, but it appears that not even financial services laws are sufficiently strict, as just demonstrated here.

> Sometimes I wish data privacy laws were stricter I think the laws and awareness are good enough atm, but no laws and probably no amount of knowledge or auditing will stop a data leak from indadvertedly occurring.

It happens relatively rarely that a large multinational food company poisons half its customers (or so I like to think), hence I would assume that laws and proper auditing can stop such problems.

In summary I have spent at least five to ten minutes (and likely more) on spam brought to me by Dropbox without any compensation. How about a fixed payout of, say, 100€ per leaked detail (username, password, email etc.), payable immediately to each customer? At least companies with bad security would be out-of-business soon.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#134

Post by acdha »

LandoCalrissian wrote: post #125
acdha wrote: post #108

Earlier quoted context omitted.

> The first thing you do when hacking together a stupid exchange for a joke e-currency isn't writing unit tests. As soon as you write anything where a bug causes money to change hands, even on a laugh, you write some tests.

No kidding, I would be so freaked out not writing tests the second money is involved. I just don't understand why he didn't bother to hire some help when things got bigger.

That's the part I don't understand – I'd be scared witless at the thought of not having tests for anything moving money out of my accounts. When you have millions in those accounts, even a really expensive developer is cheap insurance…

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#135

Post by aryastark »

nathan_f77 wrote: post #8

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

I signed up for Mint.com once. I liked the concept in theory. But then after an hour of using it, I realized just how incredibly stupid it is giving a third party total access to all your bank accounts. Then I immediately went and changed the passwords on all my bank accounts.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#136

Post by twistedpair »

ssg_rolson wrote: post #45
jychang wrote: post #5

Earlier quoted context omitted.

They have passport scans? I'm impressed by how hard MtGox is fucking up.

I am sure it said that they will 'dispose' of the scans after 2 weeks. Looks like they fucked up again!

On the interwebs 'temporary' is forever.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#137

Post by twistedpair »

aryastark wrote: post #135
nathan_f77 wrote: post #8

Wow, that's a lot of my personal data leaked in these last months. My email and encrypted password in the adobe breach, my user id and part of my mobile number via SnapChat, and now hackers potentially have scans of my passport courtesy of Mt. Gox. I'm probably forgetting about some leaks, and who knows how many security breaches were never discovered. The internet is not a safe place.

I signed up for Mint.com once. I liked the concept in theory. But then after an hour of using it, I realized just how incredibly stupid it is giving a third party total access to all your bank accounts. Then I immediately went and changed the passwords on all my bank accounts.

For most large banks it's read only access through purpose built scraping API's. Mint won't be stealing your funds. Generally this is due to Regulation of the financial information space.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#138

Post by twistedpair »

kijin wrote: post #78
negamax wrote: post #67

Earlier quoted context omitted.

Can you explain what's wrong with this? If I had 1 million in $info[ 'balance' ]? Would $bean->Coins overflow?

If this is 32-bit PHP, any amount above 21 bitcoins will overflow the integer range (2^31) and will be converted to float. That's bad. If this is 64-bit PHP, any realistic bitcoin amount multiplied by 100000000 would still be within the integer range (2^63 - 1) and can be passed around without any loss of precision ... ... unless $info['balance'] has anything below the decimal point. As soon as you're dealing with fr…

I hate it when types get coerced behind my back.

Re: Mt. Gox Has Been Hacked by People Trying to Find Out What Happened?

#140

Post by snorkel »

McGlockenshire wrote: post #19

The code is ... interesting. Smells organic, not designed. Comments are rare but usually useful. Highly coupled. Static methods everywhere. Violates SOLID principles. Basically, ignores current best practices. Clearly not designed for any sort of automated testing, which should be the first damn thing you do when there's any sort of money involved. Hell, even when there isn't money involved. We'd already guessed that…

I'd be less concerned about code quality and technical best practices and more interested in knowing if Mt Gox had any internal notion of preventing common stock market manipulation tricks such as wash trades and chandelier bidding. I bet a lot of bitcoin startups don't know what those terms mean and thereby shouldn't be operating a finance exchange.
Post reply on HN