Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTX stored private keys to crypto assets in plaintext, without access controls

twitter.com

Post reply on HN
Print view View original

191–200 of 222 posts

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#191

Post by olalonde »

knorker wrote: post #169
reisse wrote: post #85

Earlier quoted context omitted.

It's not really a contradiction. People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people. The latter usually care about 100% APR on dollar and other scammy promises, and not about any real crypto benefits. When they get burned, they want government to step in and regulate. The former don't care much that system allows to sca…

> People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people. Are they? I'm not so sure. Could you elaborate? The whole selling point of cryptocurrencies seems to be to start from scratch, without those pesky KYC/AML and tax laws. Traditional banking is not a natural law. It's man-made. The benefits cryptocurrencies have over t…

The rule of law, police and investigations pre-date KYC/AML regulations by decades if not centuries. It's possible to fight crime without them.

Would you say being in favor of HTTPS or encrypted messaging is equally incompatible with believing in a justice system?

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#192

Post by knorker »

olalonde wrote: post #191
knorker wrote: post #169

Earlier quoted context omitted.

> People who want financial system free of government control and people who want government to prosecute for crypto crimes are mostly different people. Are they? I'm not so sure. Could you elaborate? The whole selling point of cryptocurrencies seems to be to start from scratch, without those pesky KYC/AML and tax laws. Traditional banking is not a natural law. It's man-made. The benefits cryptocurrencies have over t…

The rule of law, police and investigations pre-date KYC/AML regulations by decades if not centuries. It's possible to fight crime without them. Would you say being in favor of HTTPS or encrypted messaging is equally incompatible with believing in a justice system?

Sure. Plenty of financial regulation is newer. Crashes and frauds just in the last 100 years have created lots of new laws.

But the thing is people want fast and anonymous payments, but don't acknowledge that traditional banking isn't doing that so well (especially in the US) because of laws people want even more.

E.g. given the choice of easier international payment or fighting mob money laundering, people will say the latter.

Well, they'll say both, but cryptocurrencies only even try to do the former. (Failing, because it's anything but easy for almost everyone)

As for your HTTPS analogy: mass surveillance is less law enforcement and more spy agency shit.

Even for messaging, the messages are rarely the harm. For money the moving of money is the harm.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#193

Post by pcthrowaway »

SparkyMcUnicorn wrote: post #182
themagician wrote: post #118

Earlier quoted context omitted.

How do I know the code running on my iPhone is the same as what is on Github? I don't. There is every incentive for someone to cheat here. There is very little risk, and the potential reward is basically infinite. I can slip a few lines of code in that grant me access to every wallet generated. Worst case I get caught and fired. Best case no one ever knows. Assuming your employer isn't in on it and you get caught, wh…

I agree there's a problem here, but the verification problem exists for every app on your iPhone that isn't released by Apple. Maybe I'm just clueless, but what solution could exist to verify that the code running on your phone doesn't differ from a given codebase (that also can't be faked)? We can build Brave for any platform, which happens to have a wallet, but there's still no way of knowing whether what I built m…

One more thing you can do is audit the source code of open source projects you use, and build them yourself where possible.

For example, Metamask is source-available and you can add it to your browser from the git repo rather than the chrome extension store.

You can also add it from the chrome extension store and inspect the source to ensure all files match the build, before adding any private key material to it.

I was arguing in a comment recently[1] that browser extensions should be required to be source-available, and the chrome store should take a role in verifying the bundle matches the build process defined with the source code.

It's alarming to me that this is not already the state of things, but as it is it perverts incentives for extension developers to a horrific degree.

[1]: https://news.ycombinator.com/item?id=34892991

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#194

Post by throwaway2037 »

anecdotal1 wrote: post #129
WeylandYutani wrote: post #120

Earlier quoted context omitted.

Nobody wants to be their own bank. That's the mistake crypto makes. Banks were invented because it offloads the risk and hassle of handling money.

The still living members of the Silent Generation would disagree. They still don't trust banks and the banks have once again proven themselves to be untrustworthy.

Google tells me that Silent Generation:

    people born from 1928 to 1945
I assume you are trying to hint about the Great Depression and the banking crises that went with it?

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#195

Post by oblio »

lozenge wrote: post #174
oblio wrote: post #149

Earlier quoted context omitted.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

As a person you can only send them money. As a business you can initiate a direct debit which withdraws money. However you are attesting that they signed a direct debit agreement with you and provided their account number and agreed on the amount to pay. This is the same as a credit card - you can charge any card with just the number and a couple of basic details, however if there's a complaint "I found these CC deta…

That's a distinction without a difference.

I obviously don't care about people sending me money, I care about people requesting money from me.

Individuals can't do it and business can only > for money, that's different.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#196

Post by oblio »

summarity wrote: post #163
oblio wrote: post #149

Earlier quoted context omitted.

Do you mean that if I know a German bank account number I can just withdraw money for me? Be right back, asking some German friends for their bank account numbers. Jokes aside, you're probably wrong. There's NO way I can just pull money from their bank account just by knowing their bank account number.

Yes, yes you can. Name + IBAN is all you need to enter even large recurring payments.

I don't believe that.

Let's say I have account number 1234 and my name is John Doe.

You're telling me that, no strings attached, no repercussion, Mike Hacker can set up a large recurring payment from my account, without my approval?

I'd need solid proof of how that would work.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#197

Post by jon-wood »

oblio wrote: post #196
summarity wrote: post #163

Earlier quoted context omitted.

Yes, yes you can. Name + IBAN is all you need to enter even large recurring payments.

I don't believe that. Let's say I have account number 1234 and my name is John Doe. You're telling me that, no strings attached, no repercussion, Mike Hacker can set up a large recurring payment from my account, without my approval? I'd need solid proof of how that would work.

Yes. That is a thing that can be done, here’s Stripe’s documentation on how to set up a Direct Debit mandate: https://stripe.com/docs/payments/payment-methods/bacs-debit?...

The thing that’s being missed here is that direct debits can be disputed in the same way a credit card payment can, and by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#199

Post by oblio »

jon-wood wrote: post #197
oblio wrote: post #196

Earlier quoted context omitted.

I don't believe that. Let's say I have account number 1234 and my name is John Doe. You're telling me that, no strings attached, no repercussion, Mike Hacker can set up a large recurring payment from my account, without my approval? I'd need solid proof of how that would work.

Yes. That is a thing that can be done, here’s Stripe’s documentation on how to set up a Direct Debit mandate: https://stripe.com/docs/payments/payment-methods/bacs-debit?... The thing that’s being missed here is that direct debits can be disputed in the same way a credit card payment can, and by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.

Ok, that's both interesting, slightly unsettling, but also doesn't really fall under:

> You're telling me that, no strings attached, no repercussion

This bit:

> by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.

sounds a lot to me like repercussions :-)

Re: FTX stored private keys to crypto assets in plaintext, without access controls

#200

Post by [deleted] »

oblio wrote: post #199
jon-wood wrote: post #197

Earlier quoted context omitted.

Yes. That is a thing that can be done, here’s Stripe’s documentation on how to set up a Direct Debit mandate: https://stripe.com/docs/payments/payment-methods/bacs-debit?... The thing that’s being missed here is that direct debits can be disputed in the same way a credit card payment can, and by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.

Ok, that's both interesting, slightly unsettling, but also doesn't really fall under: > You're telling me that, no strings attached, no repercussion This bit: > by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back. sounds a lot to me like repercussions :-)

[deleted]
Post reply on HN