Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

151–160 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#151

Post by germanier »

oblio wrote: post #149
lxgr wrote: post #130

Earlier quoted context omitted.

> By default, those requests are denied. That's not the case in Germany, at least.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

Yes, if you set up a direct debit agreement with a bank you can do that. If you'd actually try what you suggest it will be revoked quickly and charges filed as your identity is known.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#152

Post by oblio »

anecdotal1 wrote: post #129
WeylandYutani wrote: post #120

Earlier quoted context omitted.

Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.

The still living members of the Silent Generation would disagree. They still don't trust banks and the banks have once again proven themselves to be untrustworthy.

I come from a country which is under-banked.

It used to be non-banked, because in 1990 in Romania there were no commercial banks.

Trust me, being non-banked/under-banked is not better.

What you want is decent banks, not no banks at all.

The alternatives are all awful from a combination of peace of mind, convenience, etc.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#153

Post by LapsangGuzzler »

olalonde wrote: post #119
LapsangGuzzler wrote: post #68

Earlier quoted context omitted.

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

That conclusion doesn't necessarily follow. A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. However, money is an exception in this regard, and many cryptocurrency advocates argue that it could be better managed outside of government control. This does not imply that a justice system is unnecessary; rather, it emphasizes diverse role…

> A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy.

This just isn't true, government participation can be found throughout the entire US economy. Import and export controls, labor force participation and visas, a massive small business loan portfolio, R&D investments in things like clean technology (e.g. Tesla was initially funded by a government clean energy grant), on and on and on. The assertion that the government just lets the economy run itself is laughable.

> In other words, one can agree with certain roles for government (e.g. justice system) while not agreeing with others (e.g. managing money). I don't see the irony or the contradiction.

It's not a question of what the ideal role of government should be, the question hinges on the government's legitimacy and ability to do things like collect taxes (which is an important function of a government). Lots of participants in crypto believe that taxation is theft and that government is an inherently wasteful entity, all while continuing to enjoy the largely invisible benefits that government policy and enforcement provides them. This is the contradiction.

EDIT: The government is the only reason that FAANG and other tech companies aren't bringing in foreign software developers who will work for $15/hr en masse. You know that if they could, they 100% would.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#155

Post by RandomLensman »

germanier wrote: post #148
RandomLensman wrote: post #145

Earlier quoted context omitted.

Banks don't need a SEPA mandate to allow a direct debit?

The SEPA mandate is between the parties in the transaction. While banks require their existence, it is usually not shared with the banks involved.

So only a creditor ID is needed if someone has a set of IBANs and then things will be processed?

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#156

Post by nullc »

themagician wrote: post #81
willio58 wrote: post #14

While this is flatout insane, it does not speak toward crypto's security directly. If you personally decide that you want a company to hold your crypto that's your decision and a poor one at that. You have the ability to create your own wallet and hold your funds in it securely. Some exchanges like Coinbase even have wallet apps so the transition is super easy to make.

Wallet "apps" are not secure. It's an illusion of security. Unless the source is open AND verifiable there is no reason to trust it more than trusting FTX. I 100% guarantee that there will be a major hack, from a major app, at some point in the future where it turns out that all seed generation was not in fact random. Honestly, it's probably already happened multiple times and they just haven't gotten caught. Those s…

> from a major app, at some point in the future where it turns out that all seed generation was not in fact random. Honestly, it's probably already happened multiple times and they just haven't gotten caught

Bitpay's "copay" wallet used only 64-bits of randomness for the nonces in their signatures, making it trivial to recover the user's private keys.

That wallet was "open source" -- but it doesn't much matter if its open source if no one competent is reading or reviewing the code.

They never announced the vulnerability-- they fixed it and the person who introduced it quietly parted ways with the company (he surfaced again later as part of conman Wright's team, ... I'm not sure if that increases my estimate the the vulnerability was intentional or if it was just incompetence).

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#157

Post by germanier »

RandomLensman wrote: post #155
germanier wrote: post #148

Earlier quoted context omitted.

The SEPA mandate is between the parties in the transaction. While banks require their existence, it is usually not shared with the banks involved.

So only a creditor ID is needed if someone has a set of IBANs and then things will be processed?

A creditor ID and a direct debit agreement with some bank, yes. After you have those, (usually) the banks won't verify individual transactions.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#158

Post by overthrow »

pasc1878 wrote: post #139
overthrow wrote: post #111

Earlier quoted context omitted.

Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.

So it is OK to have your jeans made by children and in a factory that pours toxic waste into a river used for drinking water?

If you read my post, I said laws should apply equally to jeans and crypto. That includes child labor laws.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#159

Post by medvezhenok »

datadata wrote: post #92
sublinear wrote: post #89

Earlier quoted context omitted.

> The downsides are now substantial as the customer expects higher speeds. Why would they expect this? It seems like the slowness is the only thing keeping the game from growing legs and walking away from the humans playing it.

Ask anyone waiting for an emergency withdrawal to settle from a failing institution like FTX or SVB.

On the flip side, think about all the old people that initiate transfers to various scammers and get stopped by the bank.

Making things faster will be good for some people, bad for others. Not clear if better on the whole.

It’s also probably better to keep it slow to prevent impulse decisions (let me put all of my money into dogecoin, it’s mooning now)

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#160

Post by bongoman37 »

gleenn wrote: post #33
logicalmonster wrote: post #23

Earlier quoted context omitted.

> That crosses the line and goes deep into "willful negligence" territory, in my view. A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. They could have preplanned this behavior. If they were ever caught doing anything really bad, they had "plausible denia…

While I agree with most of this, keeping a small number of things secure for yourself is far easier than doing it for thousands/millions of accounts in an automated way. That's true of almost everything in software. For instance, just because I know how to use a password manager doesn't mean it's easy to get my whole family using a password manager. They were clearly dysfunctional and there may be some of this at pla…

[dead]
Post reply on HN