Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Resolv hack: How one compromised key printed $23M

chainalysis.com

Post reply on HN
Print view View original

151–160 of 174 posts

Re: The Resolv hack: How one compromised key printed $23M

#151

Post by anonym29 »

rando1234 wrote: post #122
anonym29 wrote: post #81

Earlier quoted context omitted.

Ethereum is a great utility token. Smart contracts absolutely have utility in the digital economy. It's just not a cryptocurrency, is all. It had a massive premine, there's no supply cap, it's subject to OFAC censorship, and has effectively demonstrated that just ~4.8% of the total ETH supply can vote to cause rollout and widespread adoption of a fork that reverses transactions. We need different words for these fund…

Where did the 4.8% number come from? Is it based on the validator stake? How does that compare to the number required to fork Bitcoin as a function of it's supply?

There was a vote after the DAO incident to roll back. 87% of those that voted voted yes (for the rollback), but only 5.5% of the total supply voted at all.

Re: The Resolv hack: How one compromised key printed $23M

#152

Post by troad »

mothballed wrote: post #147
lmm wrote: post #117

Earlier quoted context omitted.

> You realise you can walk into any US bank right now and they'll just open an account for you with nothing more than some accurate ID? There's an ocean in the way, not to mention how risky visiting looks right now. I changed my name recently and the one US bank that I managed to get an account with (so that US clients can pay me without weirdness) won't accept any kind of documentation without going there in person…

Well no matter what you say it's always nuh uh, doesn't count or some variation of why can't you just be an "everyman." It's hard to argue with a dogmatic position that is based on feelings. You can tell such person what's actually happened to me when I tried to open an account with only "accurate ID" (a US passport) and they literally won't do it while you are homeless because they require a proof of address for KYC…

>> They also claim to have used their bank account to pay for trade in North Korea, a comprehensively sanctioned entity, which seems to be a public written confession of committing a serious crime just to own the crypto use crowd for internet points lol

Lol. Thanks, Mr Google Esq.

I was indeed in North Korea. It was not particularly hard to get to before COVID (I'm told it's harder now). You have no idea what the laws of my jurisdiction are were at the time I went, or the purpose of my visit and whether sanctions even extend to it, whether I sought any exemptions from my government, etc - but please tell me more about all these alleged serious crimes you've just discovered on Wikipedia.

>> So you end up with people shaking their fists at the sky crying that crypto exists, with their fingers in their ears and loudly proclaiming anyone using it are just making up absurd contrived scenarios.

See, the problem with all your posts is that you're just spinning one tale after another. You need crypto for all the orphanages you're building in war zones. You need crypto for illiterate Iraqi farmers. You need crypto for your Comoros citizenship purchases. Never mind that none of that makes any sense - it's everyone else who's not listening to you! And all your super legitimate, not at all made up, not at all tax fraud related use cases for stable coins!

Get real.

Re: The Resolv hack: How one compromised key printed $23M

#153

Post by mothballed »

troad wrote: post #152
mothballed wrote: post #147

Earlier quoted context omitted.

Well no matter what you say it's always nuh uh, doesn't count or some variation of why can't you just be an "everyman." It's hard to argue with a dogmatic position that is based on feelings. You can tell such person what's actually happened to me when I tried to open an account with only "accurate ID" (a US passport) and they literally won't do it while you are homeless because they require a proof of address for KYC…

>> They also claim to have used their bank account to pay for trade in North Korea, a comprehensively sanctioned entity, which seems to be a public written confession of committing a serious crime just to own the crypto use crowd for internet points lol Lol. Thanks, Mr Google Esq. I was indeed in North Korea. It was not particularly hard to get to before COVID (I'm told it's harder now). You have no idea what the law…

Why is it more absurd to want to build an orphanage in Iraq or buy a residence visa somewhere off the beaten path than it is to proclaim you've gotten sanctions exemptions for North Korea in the context of you explicitly pointing to the use of US bank accounts? Why is your anecdotes somehow more valid than mine?

Suddenly when it comes to your North Korea escapades (while proclaiming about mr. "everyman", lmao) I just don't have all the facts and nuance, but you just handwave away any of the uses I point to. Get real.

Re: The Resolv hack: How one compromised key printed $23M

#154

Post by amarant »

abigail95 wrote: post #118
amarant wrote: post #95

Earlier quoted context omitted.

What utterly horrendous payment solutions are you using that have more friction than crypto? The ones I use are several orders of magnitude less friction and most are 100% free. The ones that do have a cost (for recipients outside Scandinavia basically) are still way, waay cheaper than crypto transactions.

How do you have a payment system that is free? Who pays for the infrastructure?

I was referring to this one: https://en.wikipedia.org/wiki/Swish_(payment)

No sign-up fee, no recurring fee, and no transaction fee. I guess it's a loss leader for banks? But if one bank stopped supporting it, they would find themselves without customers in less than 24 hours, so it's a worthwhile loss I guess

Re: The Resolv hack: How one compromised key printed $23M

#155

Post by troad »

mothballed wrote: post #153
troad wrote: post #152

Earlier quoted context omitted.

>> They also claim to have used their bank account to pay for trade in North Korea, a comprehensively sanctioned entity, which seems to be a public written confession of committing a serious crime just to own the crypto use crowd for internet points lol Lol. Thanks, Mr Google Esq. I was indeed in North Korea. It was not particularly hard to get to before COVID (I'm told it's harder now). You have no idea what the law…

Why is it more absurd to want to build an orphanage in Iraq or buy a residence visa somewhere off the beaten path than it is to proclaim you've gotten sanctions exemptions for North Korea in the context of you explicitly pointing to the use of US bank accounts? Why is your anecdotes somehow more valid than mine? Suddenly when it comes to your North Korea escapades (while proclaiming about mr. "everyman", lmao) I just…

I never said I obtained sanctions exemptions, I merely pointed out you're just straight up making stuff up when you're concocting "serious crimes" with no knowledge of the underlying facts whatsoever. Which seems like a bit of a pattern with your posts, to be frank.

It's relatively trivial to visit North Korea, and there are many reasons one might do so that may not fall afoul of any sanctions (journalism, research, aid, and so on). It's ludicrous to proclaim you're building orphanages in Iraq for which you require crypto stablecoins. These are not even remotely comparable claims.

Re: The Resolv hack: How one compromised key printed $23M

#156

Post by mothballed »

troad wrote: post #155
mothballed wrote: post #153

Earlier quoted context omitted.

Why is it more absurd to want to build an orphanage in Iraq or buy a residence visa somewhere off the beaten path than it is to proclaim you've gotten sanctions exemptions for North Korea in the context of you explicitly pointing to the use of US bank accounts? Why is your anecdotes somehow more valid than mine? Suddenly when it comes to your North Korea escapades (while proclaiming about mr. "everyman", lmao) I just…

I never said I obtained sanctions exemptions, I merely pointed out you're just straight up making stuff up when you're concocting "serious crimes" with no knowledge of the underlying facts whatsoever. Which seems like a bit of a pattern with your posts, to be frank. It's relatively trivial to visit North Korea, and there are many reasons one might do so that may not fall afoul of any sanctions (journalism, research,…

It's funny how you can know all the facts to be sure stable coins aren't applicable to some others' scenario but if someone dare point out that you paid a comprehensively sanctioned country by god they're not allowed to use the same evidentiary standards you have presented. And for the record, I said it seems as if a confession to a crime, not that it actually was one.

Seems as if you don't like it when your own logic is used on you. Which seems like a bit of a pattern with your posts, to be frank.

Re: The Resolv hack: How one compromised key printed $23M

#157

Post by vlovich123 »

jiggawatts wrote: post #107
vlovich123 wrote: post #97

Earlier quoted context omitted.

Have you actually tried to run a business this way?

I have, I've set up "truly offline" root certificate authorities and the like in the past. Yes, it's a pain to operate, but if the alternative is "the bad guys get all of our money", then it can be worth it.

Sure, I never said anything against offline root cert authorities. But did you do it literally exactly how this guy was saying to do it with a laptop that you load via CD-ROM for a signing key that’s being used for active transactions?

It’s as if one of the things your root certificate authority signed got compromised. It doesn’t help that your root key is safe if attackers still managed to impersonate you before you revoked that cert.

> privileged private key to sign off on how much USR could be created. Unfortunately, the smart contract itself did not enforce any maximum limit on minting – it only checked that a valid signature existed.

The offline idea simply doesn’t work because this particular key has to be online

Re: The Resolv hack: How one compromised key printed $23M

#158

Post by troad »

mothballed wrote: post #156
troad wrote: post #155

Earlier quoted context omitted.

I never said I obtained sanctions exemptions, I merely pointed out you're just straight up making stuff up when you're concocting "serious crimes" with no knowledge of the underlying facts whatsoever. Which seems like a bit of a pattern with your posts, to be frank. It's relatively trivial to visit North Korea, and there are many reasons one might do so that may not fall afoul of any sanctions (journalism, research,…

It's funny how you can know all the facts to be sure stable coins aren't applicable to some others' scenario but if someone dare point out that you paid a comprehensively sanctioned country by god they're not allowed to use the same evidentiary standards you have presented. And for the record, I said it seems as if a confession to a crime, not that it actually was one. Seems as if you don't like it when your own logi…

Lol. Evidentiary standards? Mate, I don't give a flying fig if you believe me or not. You asked for my experiences, so I gave them to you. I certainly don't believe you, so you're free to not believe me. Seems only fair.

Your claimed use cases for stablecoins are utterly fantastical and I think your posts speak for themselves.

Re: The Resolv hack: How one compromised key printed $23M

#159

Post by pants2 »

Ferret7446 wrote: post #112
pants2 wrote: post #110

Earlier quoted context omitted.

^ this is a common security misconception in crypto. "We're using an HSM, they can't steal our private key." OK genius now you still have to secure the HSM. There's no shortcut to MPC/multisig with 3+ keyholders.

It's still significantly better, since access can be revoked, vs a leaked key where you're permanently fucked

Not much better because even a single signature can drain your whole wallet.

Re: The Resolv hack: How one compromised key printed $23M

#160

Post by mothballed »

troad wrote: post #158
mothballed wrote: post #156

Earlier quoted context omitted.

It's funny how you can know all the facts to be sure stable coins aren't applicable to some others' scenario but if someone dare point out that you paid a comprehensively sanctioned country by god they're not allowed to use the same evidentiary standards you have presented. And for the record, I said it seems as if a confession to a crime, not that it actually was one. Seems as if you don't like it when your own logi…

Lol. Evidentiary standards? Mate, I don't give a flying fig if you believe me or not. You asked for my experiences, so I gave them to you. I certainly don't believe you, so you're free to not believe me. Seems only fair. Your claimed use cases for stablecoins are utterly fantastical and I think your posts speak for themselves.

I did not ask for your experiences. You were the one asking ("waiting"). Then just dismissing anyone that told you because it was never a genuine question.
Post reply on HN