Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I got robbed of 34 btc on Mt.Gox today

bitcointalk.org

Post reply on HN
Print view View original

191–200 of 251 posts

Re: How I got robbed of 34 btc on Mt.Gox today

#191

Post by svachalek »

RyanZAG wrote: post #181
andy_boot wrote: post #60

Earlier quoted context omitted.

>> if (str1 != "yes") Thats some dodgy java code right there. (You should use .equals() )

It's a shame you'be been downvoted even while being correct - I gave you one upvote at least. Decompile is irrelevant here, the only difference is 'str1' might have been named something different in the original code. This is java code, so "string" != "string" will usually return true always, as you are checking if the objects are equal and not whether the contents are equal. Depending on the JRE this code runs on, i…

I believe String literals are guaranteed to be == in the same source file by the spec, although it's been some years since I could quote chapter and verse for that.

Re: How I got robbed of 34 btc on Mt.Gox today

#192

Post by dgabriel »

RyanZAG wrote: post #76

Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency. This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the own…

This is exactly right. Bitcoins are not a good idea for casual investors who can't/won't manage their own security, or can't bear the loss in case of a breach. If you want an unregulated, untraceable currency, that's the price you pay.

Re: How I got robbed of 34 btc on Mt.Gox today

#193

Post by ww520 »

fmavituna wrote: post #17

A bit off topic, but if you care about security DO NOT INSTALL JAVA to your computer. I'm JAVA free for the last ~5 years and I never really needed it. Java's security track is horrible and it's quite popular target.

This is a bit too much. Virus typically runs in EXE, why don't you get rid of all the executables in your computer?

Java's security track has been pretty good. In this case it's a signed applet that asked the user for permission to run. It's a classic case of social engineering.

It would be the same if an executable is directly downloaded and prompted for running. If you haven't got rid of all your executables on you computer, you probably will fall into the same trap.

Re: How I got robbed of 34 btc on Mt.Gox today

#194

Post by burntsushi »

dreen wrote: post #190
burntsushi wrote: post #163

Earlier quoted context omitted.

> I would be surprised if MtGox decides to refund you I agree that MtGox shouldn't be doing any kind of refunding in this case. > what happened is your own fault entirely You're blaming the victim. If I'm walking down a dark alley and someone pulls a gun on me and takes my wallet, is it my fault because I decided to walk down a dark alley? Not at all. The only person at fault here is the cracker who perpetrated the s…

Will you demand compensation from your local authorities because they did not prevent you walking into a dark alley?

I'll re-quote the first sentence of my post:

> I agree that MtGox shouldn't be doing any kind of refunding in this case.

You didn't respond to my central point: blaming the victim.

Re: How I got robbed of 34 btc on Mt.Gox today

#195

Post by ww520 »

smoyer wrote: post #11

Java Applets were designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits. Turn off Java in the browser and hope that JavaScript is sandboxed well enough.

Java Applets is not designed to give you the ability to execute a program on your computer from the browser in much the same way ActiveX controls could be used for exploits.

Only a signed Java applet can ask the user to give permission to access his computer.

Re: How I got robbed of 34 btc on Mt.Gox today

#197

Post by code4life »

RyanZAG wrote: post #76

Isn't this exactly what Bitcoin was created for - to allow unregulated access to currency? I guess people don't really realize what unregulated actually means - and nor do they realize why you really do want regulated currency. This kind of thing happens all the time with real banks, but with real banks, all transactions can be traced and reversed. Law enforcement can follow the required documentation to find the own…

We don't need sympathy or regulation. A simple market solution like voluntary bitcoin insurance would do the trick.

Re: How I got robbed of 34 btc on Mt.Gox today

#199

Post by kbolino »

svachalek wrote: post #191
RyanZAG wrote: post #181

Earlier quoted context omitted.

It's a shame you'be been downvoted even while being correct - I gave you one upvote at least. Decompile is irrelevant here, the only difference is 'str1' might have been named something different in the original code. This is java code, so "string" != "string" will usually return true always, as you are checking if the objects are equal and not whether the contents are equal. Depending on the JRE this code runs on, i…

I believe String literals are guaranteed to be == in the same source file by the spec, although it's been some years since I could quote chapter and verse for that.

You are correct (albeit substituting "class" for "source file" since runtime Java has no concept of source files), although the guarantee is stronger than that. Any two identical literals will refer to the same object, since literals are interned, regardless of what classes "own" them.

Chapter and verse: JLS §3.10.5, http://docs.oracle.com/javase/specs/jls/se7/html/jls-3.html#...

Re: How I got robbed of 34 btc on Mt.Gox today

#200

Post by socillion »

TazeTSchnitzel wrote: post #178
throwawaycan wrote: post #171

Earlier quoted context omitted.

Look at str2, it says poutinecoutu Seems to be the username of someone in Quebec (Canada), coutu being a very common last name and poutine being the national dish. This nickname has been used quite a lot on different hacking forums: https://www.google.com/search?q=poutinecoutu&aq=f&oq...

As I had noted in another comment, this product that this person is using is advertised on hackforums. ( https://news.ycombinator.com/item?id=5531500 ) So I've gone on hackforums, searched for poutinecoutu, and what do you know? This might be him. http://www.hackforums.net/member.php?action=profile&uid=... So let's look at their recent posts: http://www.hackforums.net/search.php?action=results&sid=... >RE: Bitcoin pr…

You can easily check if the username is taken via the register form - it is.

Flaw: someone could potentially have tried the same thing before me and accidentally registered it.

Post reply on HN