Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Crypto drainer” template facilitates theft

blog.confiant.com

Post reply on HN
Print view View original

211–220 of 228 posts

Re: “Crypto drainer” template facilitates theft

#211

Post by zeven7 »

worksonmine wrote: post #180
zeven7 wrote: post #179

Earlier quoted context omitted.

There are ways it could be built into the contract. But most don't support that operation today.

On whose authority and why? In this case the customer was promised a product they didn't get. And with traditional banking usually it's the other way around, businesses have to live with chargebacks for products they sell to people with stolen card info. Always someone getting burned, but in this case it's the "idiots" for lack of better word. Don't try to make cryptocurrencies work like fiat, that's exactly the kind…

> There are ways

You didn't even explore any of the options for different types of "undo" operations that could be possible in contracts. You seemed to simply assume recreating the exact same situation that exists in traditional finance and responded based on that.

There are several other ways of doing it that I can think of, all with their own pros and cons. There are even a couple that have already been applied in crypto that I can think of and I'm sure many that I'm not aware of.

And why would you assume I even meant "reimplement traditional chargebacks as they are today"? My recommendation: Hold off on forming strong opinions too early in the process of learning about something.

Re: “Crypto drainer” template facilitates theft

#212

Post by cowtools »

giaour wrote: post #209
cowtools wrote: post #157

Earlier quoted context omitted.

No. If you invest your money in something you do not understand, you deserve to lose it. I'm sorry you think that you need some authority to put their thumb on the scale and tell you what you can and can't do with your own money.

Do you feel the same way about violent crime? I.e., if a person through their own stupidity or naivete puts themselves in a position where they become a victim of armed robbery/assault/murder/rape, did they get what they deserved?

only to the extent that the violent crime is preventable. Ultimately, the victim bears the risk and the rest of society will do what they must (policing, self-defense, investigation, justice, compensation) after the fact to prevent future victimization themselves.

In the case of crypto/investment fraud, you have to take into account that all investments and transactions bear a certain amount of risk and reward. It's not fair to expect the public to bail you out for risks that you knowingly accepted when they wouldn't get a slice of the reward. In the conventional financial system, the public sees a slice of that reward through taxation. The same is not true of cryptocurrency, so why use everyone else's tax dollars to regulate it?

The only reason authorities like the SEC exist is to reduce risk, thus increasing the amount that ordinary people can safely invest. It's not a matter of ethics, it's a matter of economics.

Re: “Crypto drainer” template facilitates theft

#213

Post by cowtools »

chowells wrote: post #184
cowtools wrote: post #157

Earlier quoted context omitted.

No. If you invest your money in something you do not understand, you deserve to lose it. I'm sorry you think that you need some authority to put their thumb on the scale and tell you what you can and can't do with your own money.

Why do you believe that victims should be punished? Wouldn't it be more compassionate to recover their losses and punish the perpetrators? Trust shouldn't be seen as a weakness. Trust powers all the best things humans can do. Trust should be rewarded, not punished.

>Why do you believe that victims should be punished?

I don't believe victims should be punished. I just don't think victims should be rewarded either. I do think that the perpetrators should be punished.

>Wouldn't it be more compassionate to recover their losses

It would be "compassionate", but it would also encourage people to make risky and stupid decisions. Tough love I suppose.

>Trust shouldn't be seen as a weakness. Trust powers all the best things humans can do. Trust should be rewarded, not punished.

There is a difference between knowledge, trust, and blind faith. Your inability to discriminate between the three is what allows you to mix these unrelated platitudes.

Re: “Crypto drainer” template facilitates theft

#214

Post by [deleted] »

worksonmine wrote: post #166
a4isms wrote: post #107

Earlier quoted context omitted.

And not just secure system design. “Undo” is powerful in any app, not just because it can roll a change back with a single click, but because scary dialog boxes (“Really, really REALLY delete this file? It can not be recovered once deleted, so check this box saying you know what you’re doing before clicking OK”) don’t work for regular apps, either.

How would you undo a crypto transfer, and is that a feature that fits in that system?

[deleted]

Re: “Crypto drainer” template facilitates theft

#215

Post by sbierwagen »

cowtools wrote: post #159
Gigachad wrote: post #115

Earlier quoted context omitted.

"requests a signature for a hex ETH transaction." What an earth does that even mean? It's no wonder people keep messing this up. You need to spend half your life keeping up with the tech just to not get scammed.

You don't know what a digital signature is? This is the equivalent of being mad at banks because you don't understand what a bank routing number is. >It's no wonder people keep messing this up. The type of user that doesn't understand this should not even be using cryptocurrency in the first place.

>The type of user that doesn't understand this should not even be using cryptocurrency in the first place.

Then why did all those cryptocurrency exchanges buy ads during the super bowl?

Re: “Crypto drainer” template facilitates theft

#216

Post by giaour »

cowtools wrote: post #212
giaour wrote: post #209

Earlier quoted context omitted.

Do you feel the same way about violent crime? I.e., if a person through their own stupidity or naivete puts themselves in a position where they become a victim of armed robbery/assault/murder/rape, did they get what they deserved?

only to the extent that the violent crime is preventable. Ultimately, the victim bears the risk and the rest of society will do what they must (policing, self-defense, investigation, justice, compensation) after the fact to prevent future victimization themselves. In the case of crypto/investment fraud, you have to take into account that all investments and transactions bear a certain amount of risk and reward. It's…

> In the conventional financial system, the public sees a slice of that reward through taxation. The same is not true of cryptocurrency, so why use everyone else's tax dollars to regulate it?

You should maybe run that past a tax attorney just to make sure. I'm in the US, where capital gains from cryptocurrency are taxed just like capital gains from stocks, but of course this may not be true in your jurisdiction.

> The only reason authorities like the SEC exist is to reduce risk, thus increasing the amount that ordinary people can safely invest. It's not a matter of ethics, it's a matter of economics.

I don't think that's correct, but if it is, yeesh! What a bleak hellscape we live in, where the only reason to add safety to anything is to prevent the plebs from getting too scared to spend money.

I take it from your responses that you're one of the "hardcore believers in the 'code is law' dark forest" mentioned in an earlier comment, so I guess we'll just have to agree to disagree.

Re: “Crypto drainer” template facilitates theft

#217

Post by scoofy »

brutusborn wrote: post #208
scoofy wrote: post #187

Earlier quoted context omitted.

I didn't mean exclusively. I meant it's an existing problem, the distance between the regulator and the authority, which in democracy is quite distant, but in other form of government can also be quite distant.

I think we're getting closer but I still don't understand. What do you mean by "the authority"?

This is not a game for me

Re: “Crypto drainer” template facilitates theft

#218

Post by chowells »

cowtools wrote: post #213
chowells wrote: post #184

Earlier quoted context omitted.

Why do you believe that victims should be punished? Wouldn't it be more compassionate to recover their losses and punish the perpetrators? Trust shouldn't be seen as a weakness. Trust powers all the best things humans can do. Trust should be rewarded, not punished.

>Why do you believe that victims should be punished? I don't believe victims should be punished. I just don't think victims should be rewarded either. I do think that the perpetrators should be punished. >Wouldn't it be more compassionate to recover their losses It would be "compassionate", but it would also encourage people to make risky and stupid decisions. Tough love I suppose. >Trust shouldn't be seen as a weakn…

> It would be "compassionate", but it would also encourage people to make risky and stupid decisions. Tough love I suppose.

What you call tough love, I call inflicting trauma that makes everyone worse off. No one should ever risk being destitute. There's no societal benefit to risks with a downside of total loss.

And that's why I think your comment of blind faith was a non-sequitor. I'm not advocating for blind faith, I'm advocating for informed faith. I think we should have an informed assumption that the risk in a scam is on the part of the scammer. When something blows up, the scammer pays. Let's go ahead and reward people for blowing up scams from the inside.

Re: “Crypto drainer” template facilitates theft

#219

Post by mNovak »

Gigachad wrote: post #115
rattlesnakedave wrote: post #58

Earlier quoted context omitted.

Metamask presents a big red warning when it requests a signature for a hex ETH transaction. But most people don’t read. Or they request token approvals users don’t bother to modify.

"requests a signature for a hex ETH transaction." What an earth does that even mean? It's no wonder people keep messing this up. You need to spend half your life keeping up with the tech just to not get scammed.

I believe the malicious tx is basically serialized into a hex string, so not easily inspected by the user. As such, the wallet gives a warning, which the user ignores

Re: “Crypto drainer” template facilitates theft

#220

Post by cowtools »

sbierwagen wrote: post #215
cowtools wrote: post #159

Earlier quoted context omitted.

You don't know what a digital signature is? This is the equivalent of being mad at banks because you don't understand what a bank routing number is. >It's no wonder people keep messing this up. The type of user that doesn't understand this should not even be using cryptocurrency in the first place.

>The type of user that doesn't understand this should not even be using cryptocurrency in the first place. Then why did all those cryptocurrency exchanges buy ads during the super bowl?

Matt Damon told us fortune favors the brave. Everyone lost all their money- but they were brave in doing so! https://www.youtube.com/watch?v=gor-8erHxoY
Post reply on HN