Those 500K Bitcoins that caused the flash crash weren't real • Hacker News Board

Re: Those 500K Bitcoins that caused the flash crash weren't real

#141

Post by JoeAltmaier » Fri, Jul 01, 2011, 1:44 PM UTC

So some Bitcoins are 'real'. Huh. And the rest are 'imaginary' I guess. From where I sit, they all look imaginary.

I haven't seen a 'real' stock certificate in 20 years either. But stocks are actually backed by something, somebody.

Bitcoins are backed by ... a sysadmin? An algorithm?

I'm reminded of when bond trading changed - folks stopped buying the bond, and instead just bought a 'coupon' representing the interest on the bond. Whaa? Kind of like betting on the horse, instead of owning the horse I guess.

So, bet on Bitcoins all you like. But when you get burned, its not very ingenious to complain about it.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#142

Post by Uchikoma » Fri, Jul 01, 2011, 2:14 PM UTC

nowarninglabel wrote: post #97

Uchikoma wrote: post #94

Earlier quoted context omitted.

I think you've meant: A bank is a legally defined concept where I live, this exchange is not one.

Not really no, a bank is a legally defined concept in pretty much every country in the world. Suggested reading: http://www1.law.nyu.edu/centralbankscenter/texts/order.html

Not sure about the logic: 1. All banks are defined 2. Me: You cannot claim banks are the same everywhere 3. "Pretty much every country" == not everywhere

So you agree, or you disagree? Sorry to stick with Aristotelian logic.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#143

Post by pnathan » Fri, Jul 01, 2011, 2:23 PM UTC

idlewords wrote: post #66

jsprinkles wrote: post #36

Earlier quoted context omitted.

What is the benefit of bcrypt over several million rounds of SHA-512? It seems to me that repeating the hash function is the adjustable work factor that bcrypt seeks to allow and SHA-2 is already in most languages without an additional library.

When talking about DIY crypto, the question should be turned around - what's the benefit of this over just using bcrypt?

Well, one example might be if you were implementing your crypto in a language that doesn't have bcrypt bindings.

So you would either have to port bcrypt or use existing crypto code to approximate bcrypt-level security.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#144

Post by jokermatt999 » Fri, Jul 01, 2011, 2:32 PM UTC

ubernostrum wrote: post #115

mcbarry wrote: post #55

A reminder that MTGOX originally stood for "Magic The Gathering Online eXchange". When a site designed for trading cards online turns into the world's biggest Bitcoin exchange you better believe there's not going to be an appropriate level of security underneath it.

A reminder that people who make sweeping generalizations about subcultures they like to make fun of aren't worth listening to. (also: http://news.ycombinator.com/item?id=2697975 )

It doesn't really seem like a dig at the MtG subculture, IMO. It's just natural that a trading card site probably would focus less on security than a financial institution. This has nothing to do with the people or the hobby involved, and more to do with the fact that pretty much nothing needs as much attention to safety as a bank/currency storage.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#145

Post by bradleyland » Fri, Jul 01, 2011, 2:36 PM UTC

yuhong wrote: post #73

drivebyacct2 wrote: post #51

Earlier quoted context omitted.

Yeah, when this very first happened, I was in the IRC room at onlyonetv interviewed Mark (via proxy). I kept shouting in IRC to ask them to use bcrypt and was told they were doing 1000xSHA-512. I later tweeted at MagicalTux to recommend bcrypt and was asked if multiple iterations of SHA-512 is good enough. He said that he was told bcrypt was not secure enough. How do these businesses succeed with business people that…

Don't confuse SHA-512 hashing once with SHA-512 hashing 1000 times though.

No one is confused. SHA-512 is designed to be very, very fast. I just ran a very rudimentary test comparing SHA-512 and BCrypt with these results.

BCrypt 1000 iteration test script: https://gist.github.com/1058610

# => That took 76.370953 seconds

BCrypt 1 iteration test script: (same as above but with `1.times do`)

# => That took 0.074209 seconds

SHA512 1000 iteration test script:

# => That took 0.004092 seconds

SHA512 at 1000 iterations is over 18,000 times faster than BCrypt at similar iterations; which, by the way, makes no sense to do.

BCrypt has a "cost" factor, which is used to adjust the computational complexity to your use case. This is why BCrypt makes so much more sense for password encryption than something like SHA512. Running SHA512 n times is just a cheap, ineffective imitation of BCrypt.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#146

Post by bxr » Fri, Jul 01, 2011, 2:36 PM UTC

with the permissions of that account was able to arbitrarily assign himself a large number of Bitcoins

Why the hell would any admin, let alone a former admin, have privileges to do that in a production system? (other than the unavoidable database admin account)

So its a bit unclear as to how, but it sounds like admins could create records of deposited money with no backing. Thats terrifying. I would understand if the privileges of that account exposed a yet-unseen sqli vulnerability, but that's not the way it reads. It sounds like this was a possibility Gox gave to the account.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#147

Post by lutorm » Fri, Jul 01, 2011, 2:46 PM UTC

Xk wrote: post #23

If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know t…

To be fair, you need to put your real money somewhere like a bank. You don't need to put your Bitcoin anywhere except your wallet, so there is no reason to keep your Bitcoin in Mtgox unless you are trading it. Keeping all your Btc in Mtgox is more like keeping all your money in your Paypal account, and who in their right mind would do that?

Re: Those 500K Bitcoins that caused the flash crash weren't real

#148

Post by wmf » Fri, Jul 01, 2011, 3:13 PM UTC

JoeAltmaier wrote: post #141

So some Bitcoins are 'real'. Huh. And the rest are 'imaginary' I guess. From where I sit, they all look imaginary. I haven't seen a 'real' stock certificate in 20 years either. But stocks are actually backed by something, somebody. Bitcoins are backed by ... a sysadmin? An algorithm? I'm reminded of when bond trading changed - folks stopped buying the bond, and instead just bought a 'coupon' representing the interest…

I don't think the analogies are helping you here. Real Bitcoins exist in the block chain, and fake ones don't.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#149

Post by JoeAltmaier » Fri, Jul 01, 2011, 3:24 PM UTC

wmf wrote: post #148

JoeAltmaier wrote: post #141

So some Bitcoins are 'real'. Huh. And the rest are 'imaginary' I guess. From where I sit, they all look imaginary. I haven't seen a 'real' stock certificate in 20 years either. But stocks are actually backed by something, somebody. Bitcoins are backed by ... a sysadmin? An algorithm? I'm reminded of when bond trading changed - folks stopped buying the bond, and instead just bought a 'coupon' representing the interest…

I don't think the analogies are helping you here. Real Bitcoins exist in the block chain, and fake ones don't.

Sure, and 'real' stock certificates exist in a database too. But they are backed by something. Currencies are backed by governments. Bonds are backed by the issuing entity which has assets.

Bitcoins are as real as grocery store coupons I guess. No, wait, grocery stores have inventory and bricks-and-mortar, so no, not that real.

Its misleading to call something as soft as a Bitcoin a 'currency'. There, no analogies at all.

Re: Those 500K Bitcoins that caused the flash crash weren't real

#150

Post by mcherm » Fri, Jul 01, 2011, 3:44 PM UTC

chc wrote: post #82

Andys wrote: post #63

Earlier quoted context omitted.

The reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?

Is a site inherently safer if you use Java?

The quality of your programmer makes more difference than your choice of language and libraries. But your choice of language and libraries has SOME effect. And Java tends to be safer than PHP.