Dear Mt Gox, Please add margin-right - the 'Support' tab keeps blocking text as I scroll. Thank you.
Not sure why this is getting down voted. That 'support' button showed to me in many websites, and was really upsetting.
Those 500K Bitcoins that caused the flash crash weren't real
21–30 of 176 posts
Re: Those 500K Bitcoins that caused the flash crash weren't real
#22What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…
By using floating point values for a user's balances (per-currency) in the DB, they effectively did make themselves a fractional reserve bank, even if the spread was likely small. Most every transaction would've added a tiny bit of an error value -- given enough time, this would've added up pretty considerably.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#23If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now. When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know that I could still withdraw my money because they have enough cash on hand for me to do so.
Mtgox has neither of those assurances.
They have absolutely no credibility on the security front. They were using MD5 with no salts at one point in time. They then moved to MD5 with salts. Now they are at "SHA-512 multi-iteration, triple salted." That seems more like they're trying to say "Oooohh! Look at us! See?! We're being secure!" Triple salted means what, exactly? (Other than the fact that it makes it clear these are people who read about salting online and then though "more is better.")
Next: "we have actively been patching holes." Oh no. You mean, you're just going through the code and looking for bugs and hoping you get them all? That might work for normal programs just fine, but even ONE vulnerability is enough to take an entire database. A database hosting just passwords may not be all that bad (it usually is, but it doesn't have to be). A database which hosts thousands and thousands of dollars? Now that is something to worry about. It truly does look like they got lucky on this attack.
As for the guarantee that banks give -- that if they get broken in to, I will still have my money -- there is no way mtgox provides this. Anyone who still has money on mtgox is asking for trouble.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#24Dear Mt Gox, Please add margin-right - the 'Support' tab keeps blocking text as I scroll. Thank you.
Not sure why this is getting down voted. That 'support' button showed to me in many websites, and was really upsetting.
Probably because it adds nothing to the discussion of the article at hand.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#25That 2000BTC the thieves made off with is worth about $32,000 at the moment.
I'm surprised they weren't able to raise the amount they could withdraw at once; I would imagine the limit is database-backed.
Probably hardcoded, not in the DB.
In case it isn't clear, MTGox wasn't exactly what you'd call a professional operation.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#26What this means is that very easily, or even accidentally, MTGox could be running a fractional reserve bank in bitcoin. Balances are just numbers in the database, so there's no cryptographic requirement that they sum up to the actual amount in the dollar and bitcoin escrow accounts/wallets. They can inflate the bitcoin in circulation, and all it takes is enough real bitcoin and cash to cover the withdrawals for no on…
By using floating point values for a user's balances (per-currency) in the DB, they effectively did make themselves a fractional reserve bank, even if the spread was likely small. Most every transaction would've added a tiny bit of an error value -- given enough time, this would've added up pretty considerably.
Well, that and the 500k. And whatever anyone else was able to sql inject.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#27Everybody should give the people behind Mt. Gox a break. These guys make real banks look good - no small feat!
Re: Those 500K Bitcoins that caused the flash crash weren't real
#28Earlier quoted context omitted.
Perhaps they mean it's salted by 3 different environments, so an attacker would need to crack the db server and 3 other servers just to get a chance to start cracking the passwords.
That would mean that logins would have to go through 3 different servers. If anything, I would be more worried about security in that case.
Not necessarily. Let's say the salt is a combination of a per-user salt in the database, a per-user salt from a file on disk, and a per-system salt that's entered at the console at startup and held in memory.
A DB compromise doesn't reveal the other 2 salts. A full filesystem image doesn't reveal the third salt. Even an interactive root compromise would need to know to take an image of the running system's memory to get the third salt.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#29"The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing" Why not use a standard key derivation function such as PBKDF2 or bcrypt to provide some confidence in the system rather than inventing their own? AFAIK bcrypt is strong because of Blowfish's expensive key setup. How does this compare to SHA-512?
Why not use client-side certificates to log in? Or at least use a client-side certificate for anyone that works at Mt. Gox.
Re: Those 500K Bitcoins that caused the flash crash weren't real
#30Earlier quoted context omitted.
Not sure why this is getting down voted. That 'support' button showed to me in many websites, and was really upsetting.
Probably because it adds nothing to the discussion of the article at hand.
Yeah but its not like there's a discussion thread anywhere to critique the UI of MtGox's website, and these complaints have to be made so that these problems can be fixed.
(I had this same problem)