Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exodus Bitcoin Wallet: $490k swindle

popey.com

Post reply on HN
Print view View original

191–200 of 297 posts

Re: Exodus Bitcoin Wallet: $490k swindle

#191

Post by [deleted] »

drdrek wrote: post #186
vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If only some kind of institution that can hold coins safely existed. Some kind of central place with all the security measures. They can also offer you interest if you let them lend the coins to other people. We can call it a bank.

[deleted]

Re: Exodus Bitcoin Wallet: $490k swindle

#192

Post by UweSchmidt »

danbruc wrote: post #176
geek_at wrote: post #160

Earlier quoted context omitted.

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

This essentially boils down to not using Bitcoin. If Bitcoin ever wants to achieve its goal of becoming a usable currency, hiding pieces of paper in safes is not the way to go. But you can of course speculate that in a few years someone else is willing to pay more than you did to enjoy the fun of storing a piece of paper in a safe.

Hard technical limitations prevent Bitcoin from becoming a usable currency.

Re: Exodus Bitcoin Wallet: $490k swindle

#193

Post by andruby »

kwar13 wrote: post #142
rsynnott wrote: post #122

In which being your own bank continues to be undesirable. (Never understood why ‘be your own bank’ was meant to be at all appealing. Being a bank is terrible. And still realistically less risky than this sort of thing; apart from truly bizarre edge cases (see the Citi/Revlon drama), this sort of thing simply can’t happen.)

How is being a bank terrible? It's one of the most profitable businesses ever and continues to be.

Being a stable working bank is really really hard. Most people don't have the knowledge, time or desire to do that.

For 99+ % of the world's population using fiat currency is simple and the learning curve is basic school maths.

Re: Exodus Bitcoin Wallet: $490k swindle

#194

Post by nly »

zx76 wrote: post #98
jstanley wrote: post #8

One point I would make: > it connects to some API at https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ It is common for malicious sites to redirect to l…

I'm the developer of the ExchangeRate-API.com service. Obviously it's upsetting to have our API used by a scammer, but our service couldn't have been involved in this hack beyond fetching a JSON-formatted response of up-to-date exchange rates because that's the only functionality our service/domain provides. My guess is that the scammer implemented a call to our API to fetch up-to-date exchange rates in order to make…

I think what parent is saying is the DNS request could have gone to your domain but the TLS handshake and HTTP POST could have contained another domain, because your site and the bad actors server could both be behind the Cloudflare CDN, which would handle both transparently.

Re: Exodus Bitcoin Wallet: $490k swindle

#195

Post by nly »

Keeping your Bitcoin on your computer in any form is an extremely bad idea.

Multiple laminated (real) paper wallets in a safety deposit box and multiple locations is the only way to go.

Re: Exodus Bitcoin Wallet: $490k swindle

#196

Post by velox_neb »

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

Still, most people who have a crypto wallet on their desktop computer don't get hacked. I always found this interesting because it puts an upper bound to how many machines out there are compromised (at least by an agency that's motivated only by money).

Re: Exodus Bitcoin Wallet: $490k swindle

#197

Post by wenebego »

drdrek wrote: post #186
vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

If only some kind of institution that can hold coins safely existed. Some kind of central place with all the security measures. They can also offer you interest if you let them lend the coins to other people. We can call it a bank.

Great idea, but its inconvenient when you need liquidity but the bank doesnt have it. We should let the bank lend out more money than they actually have, and if there's a run the public can just bail them out

Re: Exodus Bitcoin Wallet: $490k swindle

#198

Post by upofadown »

This seems to be the big, unsolved, identity problem at least X3:

* No way for anyone (user or store) to verify the identity of the publisher.

* User was not given enough understanding to be able to protect their Bitcoin identity (usability, identity backup).

* No way for anyone (user or store) to identify who had downloaded the malicious snap.

Re: Exodus Bitcoin Wallet: $490k swindle

#199

Post by acdha »

mattdesl wrote: post #149
acdha wrote: post #121

Earlier quoted context omitted.

Those comparisons are incredibly mismatched. In 1980 a computer cost as much as a car, and network connections were incredibly expensive and slow. Bill Gates, child of wealth and privilege, famously had to use a shared computer paid for by his elite school because even the child of an IBM board member wouldn’t have access to a computer! The microprocessor revolution unfolded in the 80s, however, so even your timeline…

> Similarly, nobody doubted that neural networks were capable of very interesting things - the holdup was the level of processing power needed to run them. As soon as that changes, useful applications abounded. This is incorrect. AI has gone through multiple ‘winters’ where there were serious doubts and pessimistic attitudes toward its capabilities. https://en.wikipedia.org/wiki/AI_winter

Yes, I’m aware of AI winters but that doesn’t affect the point I was making: people knew neural networks were capable of the task since neuroscientists were studying how our own brains used them, but they were computationally daunting. “AI winter” didn’t mean that everyone gave up and assumed the theists were right that some supernatural power was the key part, it meant that developing commercially-viable technologies was harder than hoped.

That’s where the contrast with Bitcoin is so pronounced: in that case, the limitation isn’t technical but political - it’s been available to anyone who wants it for 15 years but most people don’t want it because you have to strongly share a certain ideology to prefer a slower, less secure, more expensive financial system. There is no technical improvement which will suddenly boost Bitcoin adoption the way GPUs and smart algorithms boosted neural networks because the inefficiency is the point.

Re: Exodus Bitcoin Wallet: $490k swindle

#200

Post by akaiser »

nly wrote: post #195

Keeping your Bitcoin on your computer in any form is an extremely bad idea. Multiple laminated (real) paper wallets in a safety deposit box and multiple locations is the only way to go.

A wallet app like Exodus is not for keeping BTC, it's for transacting with it.

The wallet file is for keeping BTC, and whether you print it on laminated paper or copy it to multiple USB sticks that you distribute in multiple places (you can encrypt a USB stick, but not really a piece of paper, so beware who has access to your storage!), doesn't matter once you want to use your BTC. Using your BTC requires a computer and a wallet app; there's no way around that besides online platforms.

The real solution for fake wallets is to independently validate signatures of wallet app releases or to build from source yourself. Also wait for a few weeks before jumping onto the latest wallet version. Who knows if the developer's supply chain got compromised.

Edit for completeness: Last but not least, do offline transactions (send the signed transaction using an online device without access to the wallet).

Post reply on HN