Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exodus Bitcoin Wallet: $490k swindle

popey.com

Post reply on HN
Print view View original

201–210 of 297 posts

Re: Exodus Bitcoin Wallet: $490k swindle

#201

Post by tainted_blood »

y42 wrote: post #185
geek_at wrote: post #160

Earlier quoted context omitted.

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

1. Boot Tails from USB and that's an attack vector/point of doubt that you bring in into the equation. You need a trustful source for Tails, the USB drive and the surrounding OS. One can turn it as one wants: "cryptos" are not safe. And I am saying this as someone who's holding a handful of values on different crypto currencies. And I know it is insane.

forget tails and ledger and use the Bitbox2. Its not that hard.

Re: Exodus Bitcoin Wallet: $490k swindle

#202

Post by ladyanita22 »

gjsman-1000 wrote: post #32

I'm still not exactly sure, to be honest, why Snap exists. The desktop on Linux has gone Flatpak. If I'm running a server, why the heck would I trust Snap, a platform that until recently didn't even let me control updates, over Docker? If something goes wrong, who do I call? If I need a custom storage arrangement, who do I call? If I need a custom network arrangement, who do I call? If I need to scale up, who do I ca…

For reference, I've checked the Flatpak app and can confirm that the Flatpak for Exodus is the correct Electron app. In Flathub it's as easy as going to the github of the store and looking at the package's instructions. You'll see what it does is basically downloading the ZIP from the offical Exodus website and run it.

Re: Exodus Bitcoin Wallet: $490k swindle

#203

Post by acdha »

px43 wrote: post #136
acdha wrote: post #125

Earlier quoted context omitted.

This is a great example: most of the fraudulent transactions were blocked by the NY Federal Reserve – $850M – and of the remaining $101M, a significant amount was recovered: https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery https://www.bbc.com/news/stories-57520169 Not perfect, but 90-something percent better than no recourse. More importantly, it’s also not a given that individuals lose everything as opposed to…

That was a complete dumb luck accident due to a spelling mistake. https://www.independent.co.uk/news/world/asia/spelling-mista... Note that the rest of the money disappeared quite effectively.

> Note that the rest of the money disappeared quite effectively.

No, I’d suggest reading the article I shared. Some of the money was laundered successfully but they recovered tens of millions and the bank in the Philippines which didn’t help was heavily fined. The SWIFT system developers also took this very seriously and added additional safeguards, which seems like a better sign of safety for a financial system than mocking them for having poor opsec and saying they should have used a hardware wallet like the cryptocurrency world tends to do.

Re: Exodus Bitcoin Wallet: $490k swindle

#204

Post by lyu07282 »

diego_sandoval wrote: post #105
lyu07282 wrote: post #29

The takeaway is to avoid using Snap. In case you needed another reason to.

And more generally, avoid installing apps from centralized repositories/ App stores. Go to the official source if available.

No actually, official distribution repositories are preferable if they are properly maintained. Debian for example has provided such centralized repositories that can absolutely be trusted for decades. Otherwise you'd have to update each application manually and/or trust each application's update mechanism (also bad).

Snap is only bad because the people developing snap are incompetent. The idea itself isn't bad.

Re: Exodus Bitcoin Wallet: $490k swindle

#205

Post by sanderjd »

TimeBearingDown wrote: post #90
sanderjd wrote: post #77

Earlier quoted context omitted.

Central banks are also great, though.

If you’re the Stay-Puft Marshmallow Man, definitely.

I don't know what this means, but I suspect I disagree. Central banks are good for everybody, though certainly some benefit more than others.

Re: Exodus Bitcoin Wallet: $490k swindle

#206

Post by pcdoodle »

brazzy wrote: post #165
vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

> Are people up to the task of doing all this? No. Anyone who thinks they are is deluding themselves. There is no such thing as a setup that is 100% secure against human error (and nobody is infallible) or a sufficiently motivated and skilled attacker (and there are supreme amounts of motivation here). The core problem is the lack of legal recourse. Anonymous, irreversible, distributed transactions for money are a re…

I think it's a fantastic idea. And the network also produces a lot of salt.

Re: Exodus Bitcoin Wallet: $490k swindle

#207

Post by jstanley »

nly wrote: post #194
zx76 wrote: post #98

Earlier quoted context omitted.

I'm the developer of the ExchangeRate-API.com service. Obviously it's upsetting to have our API used by a scammer, but our service couldn't have been involved in this hack beyond fetching a JSON-formatted response of up-to-date exchange rates because that's the only functionality our service/domain provides. My guess is that the scammer implemented a call to our API to fetch up-to-date exchange rates in order to make…

I think what parent is saying is the DNS request could have gone to your domain but the TLS handshake and HTTP POST could have contained another domain, because your site and the bad actors server could both be behind the Cloudflare CDN, which would handle both transparently.

No, I mean the initial HTTP request can go to some other site, which can then issue a redirect to anywhere it pleases (i.e. to exchangerate-api.com).

If you're running a malicious service and you want to throw people off the scent, one common strategy is to redirect to random legitimate services so that anyone investigating thinks you're part of the other service.

Re: Exodus Bitcoin Wallet: $490k swindle

#208

Post by fsflover »

nly wrote: post #195

Keeping your Bitcoin on your computer in any form is an extremely bad idea. Multiple laminated (real) paper wallets in a safety deposit box and multiple locations is the only way to go.

> Keeping your Bitcoin on your computer in any form is an extremely bad idea.

How about an offline virtual machine on Qubes OS?

Re: Exodus Bitcoin Wallet: $490k swindle

#209

Post by cassepipe »

wenebego wrote: post #197
drdrek wrote: post #186

Earlier quoted context omitted.

If only some kind of institution that can hold coins safely existed. Some kind of central place with all the security measures. They can also offer you interest if you let them lend the coins to other people. We can call it a bank.

Great idea, but its inconvenient when you need liquidity but the bank doesnt have it. We should let the bank lend out more money than they actually have, and if there's a run the public can just bail them out

Ok I am triggered.

I am rather ignorant on the matter but indeed I don't like that some things/people are too big too fail in the system.

On the other hand, isn't that established that banks being allowed to issue more money than what is backed by their assets is universally recognized as "good" as in allowing for previously unseen economic development that benefits everyone (but not equally...) ?

Re: Exodus Bitcoin Wallet: $490k swindle

#210

Post by cassepipe »

vmoore wrote: post #156

The operational security measures one has to take these days to secure crypto is insane. You have to build your own mini intelligence agency just to protect your digital crypto assets. You have to do: - Principle of least privilege. - Zero Trust. - Compartmentation. - Hardened Operating Systems with no malware and strong endpoint defense. - Firewalls that whitelist only your IP and disavow everything else. - 2FA/MFA/…

Well maybe if you have 500000 dollars worth of bitcoin you can invest some of it in good security practices and products ?
Post reply on HN