Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

151–160 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#151

Post by DennisP »

sjsdaiuasgdia wrote: post #6
asplake wrote: post #2

> That probably means this vulnerability exists in some other wallet implementations which is concerning…

This song is almost as old as Bitcoin itself. 2013: https://bitcoin.org/en/alert/2013-08-11-android All that trust I have to put in the non-crypto financial system doesn't seem too bad when you realize that the trust picture isn't all that different in the crypto world. Do you trust that the exchange won't steal your money? Do you trust that the software developers haven't intentionally or accidentally left any holes…

I'm just going to cherrypick one point here: the crypto version of escrow services can't steal your funds. The idea is to use 2-of-3 signatures, in some kind of smart contract (even a really basic one that Bitcoin can support). If buyer and seller sign the transaction, the escrow service never sees it. If buyer and seller disagree, then the escrow service decides whether buyer or seller gets the money. The escrow service never holds the money, the contract does that.

Re: Funds of every Trust Wallet browser extension could have been stolen

#152

Post by mike_hearn »

nailer wrote: post #141
mike_hearn wrote: post #59

Earlier quoted context omitted.

Last time I used WebCrypto the implementation in Safari was buggy in subtle ways. It was possible to work around it. I filed bugs against Apple so maybe it's fixed now. These days you can argue that a browser is intended to do anything, as there seems to be no scope limit to what goes into HTML5. But it's not what they're really about. Why did this exploit occur, well, WebCrypto apparently isn't directly exposed to W…

> Last time I used WebCrypto the implementation in Safari was buggy in subtle ways. Oh hell yes. I used maintain webcrypto code for a different job and yes Safari was broken forever. I don't have the codebase anymore (I sold the company in 2020) but we disabled keypair crypto features in Safari and told people to use a different browser. I believe it's since been fixed.

Congrats on selling the company!

Re: Funds of every Trust Wallet browser extension could have been stolen

#153

Post by justinator »

codedokode wrote: post #95
justinator wrote: post #80

Earlier quoted context omitted.

Gold is far from useless - I’ll wager whatever hardware you typed that comment on is made up in small part with gold.

Only a tiny amount of gold is used in electronics. Also, this doesn't explain why people were greedy for gold thousands years before.

>Only a tiny amount of gold is used in electronics.

That's what interesting - only a tiny amount of gold is needed. This wouldn't work with lead.

>this doesn't explain why people were greedy for gold thousands years before.

You're asking me to do this research?

Re: Funds of every Trust Wallet browser extension could have been stolen

#154

Post by yamazakiwi »

ravenstine wrote: post #105
rchaud wrote: post #19

Earlier quoted context omitted.

Because it is used by people , not cybersecurity experts. From the vendor's website[0]: > Our position is simple: Your wallet. Your keys. Your crypto. Built-in private key encryption and a password-protected login means you’re always in complete control. An average person that reads this wouldn't think about needing to add more protections. [0]: https://trustwallet.com/browser-extension/

Still, it's disappointing how (understandably) inept the average person is at reasoning where they should and shouldn't be placing trust in tech. It's also disappointing to be involved worth the tech industry, broadly speaking, and frequently witness shit shows of security incompetence and outright charlatanism. We can all do better, right? How we do that is definitely a question.

The base level of knowledge for computing is poor because computing is new in history.

How do I know what you personally trust is trustworthy? Some people use Protonmail trying to avoid lawful prosecution, thinking they're protected, and they will tell you they know what they're doing. A lot of the time there is too much noise for the common human to make an informed decision.

Re: Funds of every Trust Wallet browser extension could have been stolen

#155

Post by mrguyorama »

lxgr wrote: post #109
_trampeltier wrote: post #45

Earlier quoted context omitted.

Yes, that's my point. WASM is new. So why does it not just have strong cryptographic functions from the very beginning? Strong random generators are super important today. Why don't they just demand strong crypto functions in every implementation? I mean, this calls just for endless troubles, if you don't can trust a random generator in WASM (depending on the implementation).

WASM is a "pure" VM/execution environment without any standard system calls or library functions. Given that, you'll need to provide your own seed and your own cryptographically-secure PRNG implementation. Trust Wallet seems to have botched the latter [1] (in fact, it looks to me like they aren't even understanding the implications of that decision based on the PR description [2]). How is that WASMs fault? [1] https:…

This means that WASM is a garbage tool for this purpose and they should have gone a different route.

Re: Funds of every Trust Wallet browser extension could have been stolen

#156

Post by mrguyorama »

detrites wrote: post #136
jakelazaroff wrote: post #86

Earlier quoted context omitted.

You don't think that your bank would get your money back if this happened to them?

Which bank? SVB? FRB? You raise an important point though: crypto is not for the faint-hearted. "Be your own bank" has exactly that much responsibility attached. Many don't fully appreciate that.

Find a depositor that lost money from either bank.

Re: Funds of every Trust Wallet browser extension could have been stolen

#157

Post by lxgr »

mrguyorama wrote: post #155
lxgr wrote: post #109

Earlier quoted context omitted.

WASM is a "pure" VM/execution environment without any standard system calls or library functions. Given that, you'll need to provide your own seed and your own cryptographically-secure PRNG implementation. Trust Wallet seems to have botched the latter [1] (in fact, it looks to me like they aren't even understanding the implications of that decision based on the PR description [2]). How is that WASMs fault? [1] https:…

This means that WASM is a garbage tool for this purpose and they should have gone a different route.

No, you seem to be misunderstanding what WASM is and isn't. WASM is the specification of a bytecode format (i.e. something like a virtual ISA) and the corresponding execution environment.

It's perfectly possible to implement a secure PRNG in WASM and supply entropy/a seed as a parameter to that, and this is exactly what emscripten does. Trust just happened to provide a non-secure PRNG in their implementation (and ironically quotes emscripten's PR while doing the opposite).

They reimplemented low-level crypto primitives in an insecure way, and quite possibly without even realizing that they were doing so, and their users are paying the price. No language or framework can protect developers from that.

Re: Funds of every Trust Wallet browser extension could have been stolen

#158

Post by justinator »

hospitalhusband wrote: post #124
justinator wrote: post #78

Earlier quoted context omitted.

Not to be snarky, but this sounds real convenient. Why don’t we just admit these tools are just fundamentally broken?

When your funds get low just open your hot and cold wallet apps and type in how much to transfer, wasabi takes care of the rest. It's easier than merely logging into my bank. Or paypal (which unintentionally locked me out for over a year after a broken tos update that I couldn't accept). People have had hot and cold wallets forever, they just call them wallets and banks. It is the same workflow, except without: Drivi…

>It's the legacy banking system that is fundamentally broken.

I can't think of one time funds from my checking account were wiped out because of a browser extension.

Re: Funds of every Trust Wallet browser extension could have been stolen

#159

Post by lxgr »

kristianc wrote: post #120

I’m not sure why there is such fascination with this tech when it’s complex to understand and implement, prone to break in a thousand different ways, and has an ecosystem which is absolutely crammed with bad actors. This requires a deep understanding of cryptography to even understand if you’re safe. Why do people take the risk? Is it because they like to feel smart?

> Is it because they like to feel smart?

I believe that that's actually a big part of it. Many people have a desire to be (or at least feel) smarter than the average, to be ahead of the curve.

Cryptocurrencies, and its marketers, sit in a particularly effective sweet spot of finance- and technobabble (with a sprinkle of defiance of authorities and the status quo on top), catering to that desire.

Re: Funds of every Trust Wallet browser extension could have been stolen

#160

Post by olalonde »

rt4mn wrote: post #147
Retric wrote: post #140

Earlier quoted context omitted.

Why not use those gift credit cards loaded with cash if you want anonymity for less effort?

with the caveat that I dont personally use bitcoin, I still think the above description is simpler then using gift credit cards, for a couple of reasons: - gift cards involves getting in a car and driving to a place to buy them, which introduces annoying logistical issues - the purchases made on a single card are linked together, so you have to keep track of cards you use for x store and what cards you use for y prod…

Not to mention that you can't do peer to peer transfers with credit cards. The recipient needs to have a merchant account.
Post reply on HN