Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

181–190 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#181

Post by rossdavidh »

datadata wrote: post #53

It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…

"While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using?"

The literal answer to your question is, no, probably not.

It's not that it's impossible, it's that a lot of the technical talent required for doing it at every financial institution that would need to, is deployed elsewhere (some of it in finance, but not in the improving-security part of it).

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#182

Post by SparkyMcUnicorn »

themagician wrote: post #118
pcthrowaway wrote: post #114

Earlier quoted context omitted.

I've never heard of a crypto wallet that was not open source. The coinbase one certainly is. That doesn't mean there won't be hacks and backdoors though. You also need to build them from the codebase yourself if you want to be completely sure that you're running the code that's visible (though maybe there's a better way to verify this with Android/iOS apps?)

How do I know the code running on my iPhone is the same as what is on Github? I don't. There is every incentive for someone to cheat here. There is very little risk, and the potential reward is basically infinite. I can slip a few lines of code in that grant me access to every wallet generated. Worst case I get caught and fired. Best case no one ever knows. Assuming your employer isn't in on it and you get caught, wh…

I agree there's a problem here, but the verification problem exists for every app on your iPhone that isn't released by Apple.

Maybe I'm just clueless, but what solution could exist to verify that the code running on your phone doesn't differ from a given codebase (that also can't be faked)?

We can build Brave for any platform, which happens to have a wallet, but there's still no way of knowing whether what I built matches what's on the apple store. At least on Android there's F-Droid, which builds and releases from the source. Seems like that's as close as we can get to user-friendly and verifiable right now.

My solution is Safe[0] with multiple signers (different software/hardware for each one). Probably overkill, but when you are your own bank...

[0] https://github.com/safe-global

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#183

Post by daydream »

giobox wrote: post #142
ChrisMarshallNY wrote: post #109

Earlier quoted context omitted.

> Credit card numbers are similarly a private number used as a public number, and printed on plaintext on the card. I have an Apple Card. The only text on the card is my name. I think a lot of bank cards are starting to do similar stuff. It isn't foolproof, though. Someone somehow was able to charge against the card, a couple of months ago.

The lack of identifying numbers causes no end of confusion when I travel with it too, especially in European countries that Apple haven't launched the card in yet. It got so annoying on a recent trip, I just reverted to using another conventional credit card. The Apple Card is generally fine any time I use tap to pay from the phone, but the physical card simply isn't as reliable as some other cards I have that genera…

I went to Europe and used Apple Card almost exclusively with zero issues. Both via Apple Pay on my iPhone as well as using the physical card. Seamless experience.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#184

Post by closeparen »

datadata wrote: post #53

It is fantastic that a company operating with such horrific practices is dead. While we are at it, when can we fix similar issues below with mainstream financial systems that millions of people are still using? - Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identificat…

>- Social security numbers are used as a secret for identification, despite being in plaintext and having so low entropy as to be guessable, and originally issued on a card literally saying "Not for Identification".

This is by design: millions of Americans believe that the clunkiness of the SSN protects them from tyranny.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#186

Post by physicles »

burnished wrote: post #164
mabbo wrote: post #71

Imagine if you were an employee at this company with access to these keys. They're so disorganized, you could have stolen tens or millions of dollars in crypto and even right now after auditors have gone through everything, still no one would know you had done it. That anyone had done it. How ethical are you really? Could you actually resist that temptation? Do you think all your co-workers could too? What a fiasco.

Yeah? Being well compensated makes it much, much easier to resist temptation. Plus the nagging suspicion that you'd fuck up or never be able to use it in a meaningful fashion. I'm not saying I'd be surprised if some one took advantage, but I don't think it would be most folks natural inclination.

Exactly. If you have the skills to get hired at a place like FTX, a below-the-radar amount like ten million dollars isn’t an utterly life-changing amount of money. Not something worth risking years of freedom.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#188

Post by TheGigaChad »

anecdotal1 wrote: post #129
WeylandYutani wrote: post #120

Earlier quoted context omitted.

Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.

The still living members of the Silent Generation would disagree. They still don't trust banks and the banks have once again proven themselves to be untrustworthy.

[dead]

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#189

Post by olalonde »

LapsangGuzzler wrote: post #153
olalonde wrote: post #119

Earlier quoted context omitted.

That conclusion doesn't necessarily follow. A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. However, money is an exception in this regard, and many cryptocurrency advocates argue that it could be better managed outside of government control. This does not imply that a justice system is unnecessary; rather, it emphasizes diverse role…

> A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. This just isn't true, government participation can be found throughout the entire US economy. Import and export controls, labor force participation and visas, a massive small business loan portfolio, R&D investments in things like clean technology (e.g. Tesla was initially funded by…

There's a difference between a little intervention here and there, and government having a literal monopoly over something (e.g. money creation).

> Lots of participants in crypto believe that taxation is theft and that government is an inherently wasteful entity, all while continuing to enjoy the largely invisible benefits that government policy and enforcement provides them. This is the contradiction.

What you've described are anarchists. They are a small minority and certainly do not advocate for more government involvement. Most Bitcoin advocates simply think that Bitcoin is much needed competition to government money (fiat) while still believing in a government-run justice system.

> EDIT: The government is the only reason that FAANG and other tech companies aren't bringing in foreign software developers who will work for $15/hr en masse. You know that if they could, they 100% would.

If you really believe that, I can see why Bitcoin would make you nervous.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#190

Post by olalonde »

Eisenstein wrote: post #134
olalonde wrote: post #119

Earlier quoted context omitted.

That conclusion doesn't necessarily follow. A significant portion of the economy functions with limited government intervention, as the government sucks at managing the economy. However, money is an exception in this regard, and many cryptocurrency advocates argue that it could be better managed outside of government control. This does not imply that a justice system is unnecessary; rather, it emphasizes diverse role…

I think the contradiction is that if you don't allow the government access to the financial system then there is little it can do for you to get your money back or investigate financial crimes.

The government has access to Bitcoin... Everyone has. You need to be more precise in what you mean there.
Post reply on HN