Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

171–180 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#171

Post by zimbatm »

mellosouls wrote: post #54
zimbatm wrote: post #33

Earlier quoted context omitted.

That kind of argument can be applied to any value-based systems. s/crypto/ with /banks/, /religion/, /houses/. The real question is how big the risk is relative to inflation, central banks collapses, bank runs and all other types of institutional risks.

That kind of argument can be applied to any value-based systems. s/crypto/ with /banks/, /religion/, /houses/. No. False equivalence. The other examples have a long history of applications that add value to people's lives (as well as disbenefits depending on your viewpoint and ideology). Crypto-currency has never yet demonstrated any significant value to normal people, though plenty of the latter.

What are you talking about. Bitcoins has been working as a digital value exchange system for 10 years, and has a market cap of 539B USD right now.

Re: Funds of every Trust Wallet browser extension could have been stolen

#172

Post by louison11 »

kristianc wrote: post #120

I’m not sure why there is such fascination with this tech when it’s complex to understand and implement, prone to break in a thousand different ways, and has an ecosystem which is absolutely crammed with bad actors. This requires a deep understanding of cryptography to even understand if you’re safe. Why do people take the risk? Is it because they like to feel smart?

Having known the space since 2011, I’d say there are different reasons for different types of investors who came at different waves.

- super early stage: curiosity + belief this could replace money as we know it

- early stage: speculation + elements of previous wave

- 2017-onwards: a mix of speculation++, a lot of ignorance, and the mass wanting to be “a part” of a technological future they often feel left out from + the quasi constant FOMO many experience when realizing they could have invested in FB, AMZN, APPL but didn’t. And many disingenuous (or delusional) crypto evangelists manipulating that FOMO and convincing people this is the next big financial movement of the century.

Re: Funds of every Trust Wallet browser extension could have been stolen

#173

Post by lxgr »

evilspammer wrote: post #115
Eumenes wrote: post #91

imagine using a chrome browser extension to do anything involving money/finances

not strictly any worse than e-banking or storing your bank details in 1password (with the exception of deposit insurance)

Not really, because bank transfers are often revocable, and hopefully also use more than just one authentication factor.

Re: Funds of every Trust Wallet browser extension could have been stolen

#174

Post by lxgr »

detrites wrote: post #137
veeti wrote: post #72

Earlier quoted context omitted.

The flaw was not in a dependency but Trust Wallet's first party code [1]. They decided that Mersenne Twister would be sufficient for generating cryptographically random data and specifically called it "secure" [2]. Very unfortunate. [1] https://github.com/trustwallet/wallet-core/blob/3.1.0/wasm/s... [2] https://github.com/trustwallet/wallet-core/pull/2240

Yes, a terrible decision - but still a decision left up to any developer in a similar position - which, with the trend to WASMify things may well happen again in other projects, until it's better addressed at the source. Honestly, it's so bad it makes me wonder if a bad actor could have had influence over such a decision in this case. Reports of Trust Wallet accounts being randomly pilfered without some plausible oth…

This makes no sense. What source should it be addressed?

This is an issue of standard libraries, whereas WASM is a specification of an execution environment. WASM doesn't have a standard library, since it doesn't even have a canonical source language!

It's like demanding that x86 or aarch64 offer better Unicode or SVG support.

Re: Funds of every Trust Wallet browser extension could have been stolen

#175

Post by Robotbeat »

codedokode wrote: post #100
throwawaycities wrote: post #50

Earlier quoted context omitted.

A metal such as gold has both intrinsic and extrinsic value from the time of antiquity to modern day. For one, gold, enables the electronic device you used to post your comment.

Then why did it have value before semiconductor manufacturing?

Jewelry and it doesn't rust or erode.

Re: Funds of every Trust Wallet browser extension could have been stolen

#176

Post by latchkey »

codedokode wrote: post #168
latchkey wrote: post #164

Earlier quoted context omitted.

What is “worth 98 old dollars”? What you’re complaining about is the price of 12 eggs going up by $2. It isn’t that you now have $98. It is that eggs are more expensive. Of course the solution to that, is to print more eggs. Part of the reason why inflation rarely goes down.

Let's put the eggs aside. The government determines an inflation target and tries to control the inflation (e.g. by changing interest rates, buying or selling securities etc). So why not set the target to 0%? For example, this site [1] states that in recent years the inflation in Japan was about 0% on average. This proves that it is possible to keep inflation around zero. Maybe it is because Japanese government unlik…

Good read:

https://seekingalpha.com/article/4598574-inflation-update-fe...

Re: Funds of every Trust Wallet browser extension could have been stolen

#177

Post by lxgr »

jeroenhd wrote: post #71
nailer wrote: post #36

Earlier quoted context omitted.

Crypto wallets also have access to the secure enclave via webauthn. I develop a new wallet (Portal) which will have webauthn but I know Glow uses Windows Hello right now.

Interesting! Does the WebAuthn API provide enough of a cryptographic basis to fulfill the needs of cryptocurrency wallets? I know it works through public/private key sharing but I wasn't aware that it provides such direct primitives.

It doesn't, at least not for generic/unmodified cryptographic applications.

WebAuthN signatures are of a very specific challenge/response format [1] that applications need to explicitly support. For example, SSH had to add new key and signature formats [2] to support it.

Theoretically, a blockchain/cryptocurrency application could adopt the WebAuthN signature format as its canonical or an alternative signature format, but I'm not aware of any popular one having done so.

[1] https://developers.yubico.com/WebAuthn/Concepts/Using_WebAut...

[2] https://github.com/openssh/openssh-portable/blob/master/PROT...

Re: Funds of every Trust Wallet browser extension could have been stolen

#178

Post by lxgr »

nailer wrote: post #36
jeroenhd wrote: post #27

Earlier quoted context omitted.

I imagine this should be possible with a very small connector addon that calls out to a secure wallet running on the desktop as a native application. This requires some careful consideration to prevent phishing and other nastiness, but a native application could use native window prompts and techniques such as Windows Hello/TouchID as an authentication technique that's hard to spoof. The complexity and risks are stil…

Crypto wallets also have access to the secure enclave via webauthn. I develop a new wallet (Portal) which will have webauthn but I know Glow uses Windows Hello right now.

Yes, but WebAuthN can't be used for arbitrary signatures (which would be required to support various cryptocurrencies/blockchains), nor can it be used to decrypt data or derive keys, which would allow using it as an unlocking key for some hybrid solution.

I'm happy to be proven wrong if you've found a way around these fundamental constraints!

Re: Funds of every Trust Wallet browser extension could have been stolen

#179

Post by asadotzler »

detrites wrote: post #161
mrguyorama wrote: post #156

Earlier quoted context omitted.

Find a depositor that lost money from either bank.

Sure, but major banks failing one after the other might not exactly promote confidence in ones bank deposits.

You're working really hard in this discussion. Why?

Re: Funds of every Trust Wallet browser extension could have been stolen

#180

Post by detrites »

lxgr wrote: post #174
detrites wrote: post #137

Earlier quoted context omitted.

Yes, a terrible decision - but still a decision left up to any developer in a similar position - which, with the trend to WASMify things may well happen again in other projects, until it's better addressed at the source. Honestly, it's so bad it makes me wonder if a bad actor could have had influence over such a decision in this case. Reports of Trust Wallet accounts being randomly pilfered without some plausible oth…

This makes no sense. What source should it be addressed? This is an issue of standard libraries, whereas WASM is a specification of an execution environment. WASM doesn't have a standard library, since it doesn't even have a canonical source language! It's like demanding that x86 or aarch64 offer better Unicode or SVG support.

Developers should never end up in a situation where they feel the best cryptography solution is to "roll their own". That's likely what happened here. And the situation needs to change. It doesn't matter where in the stack that change is affected.
Post reply on HN