Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

171–180 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#171

Post by overthrow »

r_hoods_ghost wrote: post #162
overthrow wrote: post #158

Earlier quoted context omitted.

If you read my post, I said laws should apply equally to jeans and crypto. That includes child labor laws.

So you do want the government to control jeans manufacturing then?

You're being silly, but I'll humor you. The world "control" has multiple meanings.

In the communist sense: the government should not control the means of production for jeans or crypto.

In the social welfare sense: the government should "control" whether people are allowed to steal others' jeans and crypto, and the government should "control" whether you can abuse children in connection with your jeans or crypto company.

You can play with the meaning of the word, but whatever meaning you choose, jeans and crypto shouldn't be treated any differently.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#172

Post by lxgr »

summarity wrote: post #163
oblio wrote: post #149

Earlier quoted context omitted.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

Yes, yes you can. Name + IBAN is all you need to enter even large recurring payments.

Most importantly, you need a bank that will let you submit any DD requests.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#173

Post by qeternity »

akira2501 wrote: post #146
kerblang wrote: post #58

Stupid & Evil are best friends - if you're looking for one, the other is often nearby. There's going to be a mix of incredibly stupid and incredibly crooked behavior all through this. It's not a surprise that this "genius" is a delusional, pathetic dolt who couldn't operate a frozen banana stand properly, much less a multi-million dollar company. It's also not a surprise that he truly thinks he's innocent on all char…

> who couldn't operate a frozen banana stand properly, A lot of column inches are dedicated to making it seem that way; however, I have a sneaking suspicion that there's _always_ money in the banana stand.

Mr Banana Grabber royalties

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#174

Post by lozenge »

oblio wrote: post #149
lxgr wrote: post #130

Earlier quoted context omitted.

> By default, those requests are denied. That's not the case in Germany, at least.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

As a person you can only send them money. As a business you can initiate a direct debit which withdraws money. However you are attesting that they signed a direct debit agreement with you and provided their account number and agreed on the amount to pay.

This is the same as a credit card - you can charge any card with just the number and a couple of basic details, however if there's a complaint "I found these CC details on a random website" isn't accepted, you need to show the card holder agreed to the charge. If you don't provide the evidence the transaction is reversed.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#175

Post by singleshot_ »

gumby wrote: post #141
datadata wrote: post #53

It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…

> Every bank check lists the bank account number, which serves as the only information needed for a party to issue a request to withdraw money from that account. A check is simply a contract -- a promissory note. Like any contract you wouldn't sign it with someone you didn't trust, right? (Obviously that statement, while true, is risable these days. But I remember a Bogart film in which he was setting a debt at a cas…

If you trusted the person from whom you accepted a check, why didn’t you simply accept a promise to be paid later?

Put elsewise, the salient feature of a check is that your trust in that bank backstops your lack of trust in the bearer of the checking account.

(Right? Or did I misunderstand your trust model perhaps?)

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#177

Post by gumby »

singleshot_ wrote: post #175
gumby wrote: post #141

Earlier quoted context omitted.

> Every bank check lists the bank account number, which serves as the only information needed for a party to issue a request to withdraw money from that account. A check is simply a contract -- a promissory note. Like any contract you wouldn't sign it with someone you didn't trust, right? (Obviously that statement, while true, is risable these days. But I remember a Bogart film in which he was setting a debt at a cas…

If you trusted the person from whom you accepted a check, why didn’t you simply accept a promise to be paid later? Put elsewise, the salient feature of a check is that your trust in that bank backstops your lack of trust in the bearer of the checking account. (Right? Or did I misunderstand your trust model perhaps?)

The check is a promise to be paid later. You are trusting the check writer that they are good for the money. The bank could refuse to honor the request if there isn’t enough money in the account or they don’t believe the document is legit (looks altered). In the not so old days* you’d have to wait for the check’s bank to accept it before you got your money.

And the writer is trusting you not to modify the check or otherwise fraudulently use the account info (in my parents’ time the check didn’t have account numbers on it so this was less of a risk).

The only backstop the bank offered was to verify the signature against the signature card and refuse the check if it looked suspicious. I think the same is still true today.

* I worked for Atari back when Warner owned them (1980s). Congress had required that companies offer direct deposit, but the minimum was they only had to offer it to you if you banked at the same bank as the company. So Atari’s payroll came out of a small bank in Sunnyvale with only one office. The rest of us got paper paychecks on Friday. Even if you went to the bank before 3 on Friday it wouldn’t be processed until Monday, which meant they’d send the physical checks to Synnyvale to be validated. Warner got to use the float on the money while all that was going on.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#178

Post by overthrow »

knorker wrote: post #170
overthrow wrote: post #111

Earlier quoted context omitted.

Being free of government control doesn't imply lawlessness. I wouldn't want the government to control jeans manufacturing, but if someone steals your jeans, that's still a crime. There are laws against theft, and crypto and jeans are just different kinds of property.

> I wouldn't want the government to control jeans manufacturing Of course you do. You want asbestos to be banned in the clothes you buy. You want labelling of material to not be lies. You want child labour banned. You want slavery banned. You want trademark protection. You want the factory to not dump toxic waste in the nearby river. And you say "well, of course I want that , but not... I dunno..." and give some hypo…

I literally said the laws should apply to all kinds of property equally - yet you think I "want to get rid of all financial regulation"? I hope you enjoyed building that strawman and then tearing it down

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#179

Post by singleshot_ »

gumby wrote: post #177
singleshot_ wrote: post #175

Earlier quoted context omitted.

If you trusted the person from whom you accepted a check, why didn’t you simply accept a promise to be paid later? Put elsewise, the salient feature of a check is that your trust in that bank backstops your lack of trust in the bearer of the checking account. (Right? Or did I misunderstand your trust model perhaps?)

The check is a promise to be paid later. You are trusting the check writer that they are good for the money. The bank could refuse to honor the request if there isn’t enough money in the account or they don’t believe the document is legit (looks altered). In the not so old days* you’d have to wait for the check’s bank to accept it before you got your money. And the writer is trusting you not to modify the check or ot…

One brief and illuminating trip through UCC-4 and it appears you are correct. Thanks for the explanation.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#180

Post by reisse »

knorker wrote: post #169
reisse wrote: post #85

Earlier quoted context omitted.

It's not really a contradiction. People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people. The latter usually care about 100% APR on dollar and other scammy promises, and not about any real crypto benefits. When they get burned, they want government to step in and regulate. The former don't care much that system allows to sca…

> People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people. Are they? I'm not so sure. Could you elaborate? The whole selling point of cryptocurrencies seems to be to start from scratch, without those pesky KYC/AML and tax laws. Traditional banking is not a natural law. It's man-made. The benefits cryptocurrencies have over t…

> Could you elaborate? The whole selling point of cryptocurrencies seems to be to start from scratch, without those pesky KYC/AML and tax laws.

> The set of people who like cryptocurrency is not small.

There are two sets of people who like cryptocurrency. First ones like crypto because of better yields than traditional bank accounts or investments. But they want to live in a miracle pinky unicorn world where they can have better yields risk-free by having government protections. Other than better yields, they're completely fine with traditional banking system.

Second ones like crypto because it allows for easy money transfer from A to B. These people don't care much about yields, they cannot transfer money via traditional ways for various reasons, and they want governments to stay away from crypto as long as possible.

> It's not different people. It's the same people at different times; the times they're affected and the times they're not.

That's your assumptions about some people. Sure, from my side it's also only assumptions and personal anecdata, but most of the guys I know that use crypto for something useful wants government to stay away from it as far as possible, despite all the scams around. Some of them lost money on FTX, and that didn't change their position.

Post reply on HN