Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

161–170 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#161

Post by lxgr »

oblio wrote: post #149
lxgr wrote: post #130

Earlier quoted context omitted.

> By default, those requests are denied. That's not the case in Germany, at least.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

> Jokes aside, you're probably wrong.

What GP says is accurate.

> Do you mean that if I know a German bank account number I can just withdraw money for me?

You most likely can't, because if you have to ask this you don't have an agreement with a SEPA Direct Debit originating bank that lets you :)

And even if you decide to open one now: Given the risks involved for the originating bank, they will heavily scrutinize your business case and demand considerable collateral and/or payout time limits.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#162

Post by r_hoods_ghost »

overthrow wrote: post #158
pasc1878 wrote: post #139

Earlier quoted context omitted.

So it is OK to have your jeans made by children and in a factory that pours toxic waste into a river used for drinking water?

If you read my post, I said laws should apply equally to jeans and crypto. That includes child labor laws.

So you do want the government to control jeans manufacturing then?

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#163

Post by summarity »

oblio wrote: post #149
lxgr wrote: post #130

Earlier quoted context omitted.

> By default, those requests are denied. That's not the case in Germany, at least.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

Yes, yes you can. Name + IBAN is all you need to enter even large recurring payments.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#164

Post by burnished »

mabbo wrote: post #71

Imagine if you were an employee at this company with access to these keys. They're so disorganized, you could have stolen tens or millions of dollars in crypto and even right now after auditors have gone through everything, still no one would know you had done it. That anyone had done it. How ethical are you really? Could you actually resist that temptation? Do you think all your co-workers could too? What a fiasco.

Yeah? Being well compensated makes it much, much easier to resist temptation.

Plus the nagging suspicion that you'd fuck up or never be able to use it in a meaningful fashion.

I'm not saying I'd be surprised if some one took advantage, but I don't think it would be most folks natural inclination.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#165

Post by dang »

arcticbull wrote: post #122
dang wrote: post #66

Earlier quoted context omitted.

" Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. " https://news.ycombinator.com/newsguidelines.html

Ah sorry, I just meant that light-heartedly. I wasn't assuming ill intent of the parent at all - just FTX. I'll be more careful. Tone doesn't always carry well over the internet.

Ah thanks. I obviously misread you, but alas that probably means many others would as well - particularly when the comment doesn't contain enough information to convey intent.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#166

Post by burnished »

AnimalMuppet wrote: post #42
cs702 wrote: post #2

Wait, what ? Private keys were stored in unprotected plaintext files regularly opened by multiple people at the company? WTF? That crosses the line and goes deep into "willful negligence" territory, in my view. The physical equivalent would be stacking customer assets like dollar bills and gold bars in big piles inside a heavily trafficked room that has no lock. The term "irresponsible" doesn't quite do justice to it…

"Sufficiently advanced incompetence is indistinguishable from malice." I don't recall who said it, but it seems to fit.

Yeah, this is sort of the teleological view. I think Hanlon's razor is a great first guess when trying to figure out people's motivations, but this inverse is probably more appropriate when thinking about what your defenses/reactions should be.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#167

Post by cypress66 »

themagician wrote: post #81
willio58 wrote: post #14

While this is flatout insane, it does not speak toward crypto's security directly. If you personally decide that you want a company to hold your crypto that's your decision and a poor one at that. You have the ability to create your own wallet and hold your funds in it securely. Some exchanges like Coinbase even have wallet apps so the transition is super easy to make.

Wallet "apps" are not secure. It's an illusion of security. Unless the source is open AND verifiable there is no reason to trust it more than trusting FTX. I 100% guarantee that there will be a major hack, from a major app, at some point in the future where it turns out that all seed generation was not in fact random. Honestly, it's probably already happened multiple times and they just haven't gotten caught. Those s…

It has always been recommended to use hardware wallets, and software wallets are considered highly insecure.

You can get a trezor which is open source.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#168

Post by bagels »

shagie wrote: post #45
logicalmonster wrote: post #23

Earlier quoted context omitted.

> That crosses the line and goes deep into "willful negligence" territory, in my view. A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. They could have preplanned this behavior. If they were ever caught doing anything really bad, they had "plausible denia…

> A lot of people are making the assumption that gross incompetence reigned supreme with FTX, and that does seem like the likeliest explanation, but another potential explanation is deeply devious criminal activity. Former FTX US President Reportedly Quit After ‘Protracted Disagreement’ With Bankman-Fried - https://www.coindesk.com/business/2023/04/09/former-ftx-us-p... > ... > According to the report, another employ…

"such is life" = I refuse to take any action to improve this situation

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#169

Post by knorker »

reisse wrote: post #85
LapsangGuzzler wrote: post #68

Earlier quoted context omitted.

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

It's not really a contradiction. People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people. The latter usually care about 100% APR on dollar and other scammy promises, and not about any real crypto benefits. When they get burned, they want government to step in and regulate. The former don't care much that system allows to sca…

> People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people.

Are they? I'm not so sure.

Could you elaborate? The whole selling point of cryptocurrencies seems to be to start from scratch, without those pesky KYC/AML and tax laws.

Traditional banking is not a natural law. It's man-made.

The benefits cryptocurrencies have over traditional banking seem to all come either directly or indirectly from the extent to which they do not have the man-made rules and laws.

Basically: It is hard to send money from A to B because of laws.

The set of people who like cryptocurrency is not small. The number of anarchists is vanishingly small. People want anarchism (complete freedom) and unregulated cryptocurrency until someone else uses that anarchism against them, and then they want regulation, post-facto.

It's not different people. It's the same people at different times; the times they're affected and the times they're not.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#170

Post by knorker »

overthrow wrote: post #111
LapsangGuzzler wrote: post #68

Earlier quoted context omitted.

> while stealing crypto may be hard or impossible to prosecute in many jurisdictions. This is one of the inherent contradictions of crypto. If the ultimate goal of crypto is to create a financial system that is free of government control, then that system must also be free of the justice system because that's the government too. Asking people whose salaries are paid for with tax dollars to help you recover stolen cry…

Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.

> I wouldn't want the government to control jeans manufacturing

Of course you do. You want asbestos to be banned in the clothes you buy. You want labelling of material to not be lies. You want child labour banned. You want slavery banned. You want trademark protection. You want the factory to not dump toxic waste in the nearby river.

And you say "well, of course I want that, but not... I dunno..." and give some hypothetical. Well, the same with cryptocurrency. If you think you want to get rid of all financial regulation, including AML/KYC, then I don't think you've thought about the issue for more than a fleeting moment.

Post reply on HN