Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

21–30 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#21

Post by rini17 »

Mistletoe wrote: post #17
pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

I feel exactly the opposite- “At some point there won't be any more suckers left. That's when banking will really collapse.” The news every day sends the message more urgently that a global hard money that can never be debased by money printing and that is free from the whims of governments and dictators is sorely needed.

But for that, general population to be able (and willing!) to manage secret keys properly is sorely needed.

Re: Funds of every Trust Wallet browser extension could have been stolen

#22

Post by yieldcrv »

pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

if we made international headlines for every phishing attack, you would feel the same about the tech sector or tangentially "computing" at all.

this was the case in the 90s pretty often.

now we choose to highlight properly run organizations and advances, while largely ignoring the rest. new problems presented by home computing and electronic funds transfer didnt go away.

its more likely the same will happen with crypto assets and industry. when I look at mainstream news like Bloomberg, thats what I see already.

Re: Funds of every Trust Wallet browser extension could have been stolen

#24

Post by 4gotunameagain »

_trampeltier wrote: post #3

Why is in something so new (WASM), a such bad random generator?

Because if you read the article, you would have been informed that through WASM they did not have access to existing PRNG (e.g. /dev/urandom), and had to roll a mersenne twister. Which should not be used.

It is about implementation, not about WASM

Re: Funds of every Trust Wallet browser extension could have been stolen

#25

Post by Robotbeat »

Mistletoe wrote: post #17
pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

I feel exactly the opposite- “At some point there won't be any more suckers left. That's when banking will really collapse.” The news every day sends the message more urgently that a global hard money that can never be debased by money printing and that is free from the whims of governments and dictators is sorely needed.

Money is fundamentally community based. It is based on exchange with your neighbors and colleagues and peers and anyone you do business with. You’re not getting away from the entity representing that community from exerting some control over it.

Precious materials like gold are probably the best you can get as the material itself has some value.

Re: Funds of every Trust Wallet browser extension could have been stolen

#26

Post by rchaud »

Mistletoe wrote: post #17
pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

I feel exactly the opposite- “At some point there won't be any more suckers left. That's when banking will really collapse.” The news every day sends the message more urgently that a global hard money that can never be debased by money printing and that is free from the whims of governments and dictators is sorely needed.

Interesting how these incorruptible currencies are always valued in terms of its debased fiat siblings.

Re: Funds of every Trust Wallet browser extension could have been stolen

#27

Post by jeroenhd »

bo1024 wrote: post #18
mike_hearn wrote: post #15

I was writing about this exact problem of bad RNGs in web cryptocurrency wallets a ~decade ago. It is profoundly depressing that so little has changed: https://medium.com/mike-hearn/type-safety-and-rngs-40e3ec71a... Browsers have a number of problems that make it difficult to build wallets, but I’m not going to try and convince you to stop making them here. Suffice it to say there are alternatives for writing cross p…

This is very interesting and I agree about all the upsides of desktop apps. However, in web3, people’s blockchain credentials could be used to interact with many different websites. This seems hard to reproduce with desktop-based apps, right?

I imagine this should be possible with a very small connector addon that calls out to a secure wallet running on the desktop as a native application.

This requires some careful consideration to prevent phishing and other nastiness, but a native application could use native window prompts and techniques such as Windows Hello/TouchID as an authentication technique that's hard to spoof.

The complexity and risks are still there but you can hide away the important secrets much better with a native application than a browser extension ever could. It would also allow access to better sources of randomness and all kinds of sandboxing and exploit protection that aren't available with WASM.

Re: Funds of every Trust Wallet browser extension could have been stolen

#29

Post by [deleted] »

rchaud wrote: post #19
louison11 wrote: post #8

Why anyone would hold any significant amount in a chrome extension is beyond my understanding. Even if you’re using Metamask, use it in hybrid mode with a Ledger.

Because it is used by people , not cybersecurity experts. From the vendor's website[0]: > Our position is simple: Your wallet. Your keys. Your crypto. Built-in private key encryption and a password-protected login means you’re always in complete control. An average person that reads this wouldn't think about needing to add more protections. [0]: https://trustwallet.com/browser-extension/

[deleted]

Re: Funds of every Trust Wallet browser extension could have been stolen

#30

Post by nailer »

Robotbeat wrote: post #25
Mistletoe wrote: post #17

Earlier quoted context omitted.

I feel exactly the opposite- “At some point there won't be any more suckers left. That's when banking will really collapse.” The news every day sends the message more urgently that a global hard money that can never be debased by money printing and that is free from the whims of governments and dictators is sorely needed.

Money is fundamentally community based. It is based on exchange with your neighbors and colleagues and peers and anyone you do business with. You’re not getting away from the entity representing that community from exerting some control over it. Precious materials like gold are probably the best you can get as the material itself has some value.

Why do precious metals have value?
Post reply on HN