Exodus Bitcoin Wallet: $490k swindle • Hacker News Board

Re: Exodus Bitcoin Wallet: $490k swindle

#181

Post by cmcaleer » Wed, Feb 21, 2024, 11:08 AM UTC

geek_at wrote: post #160

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

If you're daytrading you essentially need to be pricing that risk. If your strategy earns effectively 8% APY and you have to trust Sketchy Exchange Inc. it's probably not worth your time. If it's earning 600% APY then maybe it's worth keeping some amount with them.

Re: Exodus Bitcoin Wallet: $490k swindle

#182

Post by codetrotter » Wed, Feb 21, 2024, 11:12 AM UTC

csomar wrote: post #112

codetrotter wrote: post #9

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…

> But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. Pretty sure this is not the case for Trezor (This was an angle that got addressed a long time ago). Also, Ethereum doesn't have a change address. > So far I’ve been putting it off because a single wallet and being diligent about checking the output address that…

> Also, Ethereum doesn't have a change address

Read the comment you quoted again.

I said Electrum. The Bitcoin wallet.

Re: Exodus Bitcoin Wallet: $490k swindle

#183

Post by tlb » Wed, Feb 21, 2024, 11:16 AM UTC

geek_at wrote: post #160

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

You need some software to make a paper wallet. It’s pretty hard to write it yourself from scratch, so you ultimately still have to trust a software distribution. Scammy paper wallet generators could make semi-predictable private keys that the author could recover when they see the public key appear on the blockchain.

Re: Exodus Bitcoin Wallet: $490k swindle

#184

Post by damontal » Wed, Feb 21, 2024, 11:28 AM UTC

yankaf wrote: post #56

nntwozz wrote: post #42

On a tangent, my neighbor came to me about a month ago and asked if I was a "hacker"? He's around 75 and has known me for maybe 20 years, we're not close friends but we run into each other every now and then and he knows I work with IT; I'm about half his age. Long story short, I find out he needs help to retrieve his bitcoin wallet because he's lost $300k. I spend an hour looking around his devices and find out he's…

who the fuck told this poor guy about bitcoin, tell him to invest his money in some stocks, he will be taxed but wont be fucked.

Matt Damon

Re: Exodus Bitcoin Wallet: $490k swindle

#185

Post by y42 » Wed, Feb 21, 2024, 11:32 AM UTC

geek_at wrote: post #160

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

1. Boot Tails from USB

and that's an attack vector/point of doubt that you bring in into the equation. You need a trustful source for Tails, the USB drive and the surrounding OS.

One can turn it as one wants: "cryptos" are not safe.

And I am saying this as someone who's holding a handful of values on different crypto currencies. And I know it is insane.

Re: Exodus Bitcoin Wallet: $490k swindle

#186

Post by drdrek » Wed, Feb 21, 2024, 11:32 AM UTC

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If only some kind of institution that can hold coins safely existed. Some kind of central place with all the security measures. They can also offer you interest if you let them lend the coins to other people. We can call it a bank.

Re: Exodus Bitcoin Wallet: $490k swindle

#187

Post by andruby » Wed, Feb 21, 2024, 11:38 AM UTC

geek_at wrote: post #160

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

Let's say two years pass and I want to sell my crypto. Is Tails still safe? Is it still maintained? Has it been "acquired" by a malicious party.

Crypto unfortunately requires people to be a lot more careful and knowledgeable than traditional fiat currency. And I don't think that will meaningfully improve anytime soon.

Re: Exodus Bitcoin Wallet: $490k swindle

#188

Post by AlienRobot » Wed, Feb 21, 2024, 11:41 AM UTC

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

People aren't even up to 2FA. Every day lots of people lose access to things because they used 2FA.

Re: Exodus Bitcoin Wallet: $490k swindle

#189

Post by andruby » Wed, Feb 21, 2024, 11:45 AM UTC

brazzy wrote: post #165

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

> Are people up to the task of doing all this? No. Anyone who thinks they are is deluding themselves. There is no such thing as a setup that is 100% secure against human error (and nobody is infallible) or a sufficiently motivated and skilled attacker (and there are supreme amounts of motivation here). The core problem is the lack of legal recourse. Anonymous, irreversible, distributed transactions for money are a re…

> The core problem is the lack of legal recourse

That is indeed the crux and the big advantage that traditional fiat currency has. And I believe that this is why crypto as a day-to-day currency won't surpase fiat.

The centralised trust and the government authority and enforcement of fiat is what enables millions of people to pay and transact so easily with strangers.

Re: Exodus Bitcoin Wallet: $490k swindle

#190

Post by yau8edq12i » Wed, Feb 21, 2024, 11:46 AM UTC

codedokode wrote: post #35

Canonical should not have displayed a "safe" icon at scam app page. The proper text should be something like "Not verified. Review the code and check the publisher before using the app.". The same should be at Google Play and Apple Store. Scam apps and sanctioned apps are regularly passing through reviews.

If every single app has the same warning, the warning becomes useless too.