Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exodus Bitcoin Wallet: $490k swindle

popey.com

Post reply on HN
Print view View original

221–230 of 297 posts

Re: Exodus Bitcoin Wallet: $490k swindle

#221

Post by npoc »

danbruc wrote: post #176
geek_at wrote: post #160

Earlier quoted context omitted.

If you just want to buy crypto currencies and check again in a few years, the procedure is much simpler: 1. Make a paper wallet, laminate it, put it in a safe location or maybe two 2. Use any exchange and send the coins to the wallet. Never leave any coins on the exchange When you want to get them out again, this is the safest approach: 1. Boot Tails from USB 2. Enter your private key in Electrum (it's preinstalled i…

This essentially boils down to not using Bitcoin. If Bitcoin ever wants to achieve its goal of becoming a usable currency, hiding pieces of paper in safes is not the way to go. But you can of course speculate that in a few years someone else is willing to pay more than you did to enjoy the fun of storing a piece of paper in a safe.

At this stage bitcoin's main use case is storing large amounts of value for long periods of time.

Think of it as an alternative to investing in a house to let out to tenants, but without the inconvenience, risk and cost of buying/selling and owning it.

Re: Exodus Bitcoin Wallet: $490k swindle

#222

Post by npoc »

sjducb wrote: post #214
cassepipe wrote: post #210

Earlier quoted context omitted.

Well maybe if you have 500000 dollars worth of bitcoin you can invest some of it in good security practices and products ?

How do you find products to trust?

You don't really need to trust. For significant amounts of value, a multi-sig setup using a number of different devices means that _all_ the devices could be compromised, but providing they are not compromised by the same attacker your bitcoin is still safe.

Re: Exodus Bitcoin Wallet: $490k swindle

#223

Post by jstanley »

popey wrote: post #212
jstanley wrote: post #8

One point I would make: > it connects to some API at https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ It is common for malicious sites to redirect to l…

I further thought about your feedback and the comments from the owner of exchangerate-API and have removed that section from the blog and mentioned it in a follow-up post. I appreciate your comments, as they made me think more about that topic.

Great, thanks :)

Re: Exodus Bitcoin Wallet: $490k swindle

#224

Post by npoc »

codetrotter wrote: post #9

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…

Bluewallet Vault makes multi-sig simple. And when co-signing a transaction, it calculates the amount to display on the screen by calculating the difference between inputs & owned outputs, and so for general transactions this means you only need to check the amount and the destination address to be sure the right amount of money is going to the right place.

Re: Exodus Bitcoin Wallet: $490k swindle

#225

Post by nerdbert »

m_eiman wrote: post #166
jstanley wrote: post #8

One point I would make: > it connects to some API at https://www.exchangerate-api.com/ This is not necessarily right. The exchangerate-api.com site is hosted behind Cloudflare, so I don't know where it's actually hosted, but the IP addresses shown in bandwhich could be unrelated. You also said: > Visiting one of those IPs redirects to https://www.exchangerate-api.com/ It is common for malicious sites to redirect to l…

Another way IPv6 could make things better: no need to point multiple domains at the same IP address, so you could have a one-to-one relationship between domain and address and prevent shady things from hiding behind legit things.

And, sadly, make it easier for repressive regimes like China and Iran to block access to websites that are currently accessible thanks to CDNs' reuse of IP addresses.

Re: Exodus Bitcoin Wallet: $490k swindle

#227

Post by npoc »

stouset wrote: post #34
codetrotter wrote: post #9

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…

Reading this, it is bonkers to me that people think cryptocurrencies are ready or appropriate for mainstream use, either as a currency or as an investment. Line could go up, but if you aren’t extremely careful with processes that most people don’t and won’t comprehend—and don’t even realize are something you need to do—you can just straight up lose everything.

Not really - it's simply that a lot of people are safer trusting a custodian to hold their bitcoin for them (e.g. an ETF)

Re: Exodus Bitcoin Wallet: $490k swindle

#228

Post by npoc »

woah wrote: post #15
codetrotter wrote: post #9

This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…

So many of these exploits boil down to "hardware wallets not providing enough/the right information". The screen is tiny, and protocol devs don't usually put a lot of thought into making stuff easily human readable. Ideally a transaction can be fully understood and verified from the hardware wallet but we still have a ways to go.

I use a repurposed mobile running BlueWallet

Re: Exodus Bitcoin Wallet: $490k swindle

#229

Post by danbruc »

npoc wrote: post #221
danbruc wrote: post #176

Earlier quoted context omitted.

This essentially boils down to not using Bitcoin. If Bitcoin ever wants to achieve its goal of becoming a usable currency, hiding pieces of paper in safes is not the way to go. But you can of course speculate that in a few years someone else is willing to pay more than you did to enjoy the fun of storing a piece of paper in a safe.

At this stage bitcoin's main use case is storing large amounts of value for long periods of time. Think of it as an alternative to investing in a house to let out to tenants, but without the inconvenience, risk and cost of buying/selling and owning it.

That sounds potentially problematic in the long run. If Bitcoin is primarily used for long term storage, then you need some [at least] constant flux of people moving money in and out of long term storage, otherwise your stored Bitcoins will depreciate in value. Therefore this is a kind of bet that Bitcoin will remain popular as a long term store or that some other use case emerges and maintains the price.

Another factor is that with decreasing mining reward transaction fees are becoming more and more important for financing the entire system. But by its very nature using Bitcoin as a long term storage will lead to a small number of transaction and the relatively few transactions moving money into or out of long term storage will have to pay for the network resulting in high transaction fees or alternatively the hash rate will have to go down which could itself be problematic for the system.

One would have to run the numbers - how many people are storing how much money for how long - to see how problematic or unproblematic it would be to use Bitcoin primarily for long term storage. My gut feeling however is that without other usages like speculation or actually buying and selling stuff, it would be a rather expensive way to store money long term.

EDIT: Back-of-the-envelope estimate. Bitcoin market capitalization is currently 1000B $, electricity consumption is an estimated 138 TWh/y, 13.8B $/y at 0.10 $/kWh. So if it was all long term storage financed by transaction fees and with a stable price and hash rate, it would cost about 1.5 %/y to store your money in Bitcoin, assuming hardware, infrastructure, labor and so on adds another 10 % to the costs.

Re: Exodus Bitcoin Wallet: $490k swindle

#230

Post by FireBeyond »

justajot wrote: post #124
stouset wrote: post #34

Earlier quoted context omitted.

Reading this, it is bonkers to me that people think cryptocurrencies are ready or appropriate for mainstream use, either as a currency or as an investment. Line could go up, but if you aren’t extremely careful with processes that most people don’t and won’t comprehend—and don’t even realize are something you need to do—you can just straight up lose everything.

Yeah, it's definitely not ready. I agree with everything you are saying. Though, the industry is aware of this and working on it. There is at least one company (Chia Network) where the on-chain language (ChiaLisp) is both capable and secure enough to allow for the sort of management needed to allow for self-custody to happen in a safe, sane manner. GUIs for this sort of thing aren't ready for the general public yet,…

> where the on-chain language (ChiaLisp)

So all you need to do then is learn a Lisp? That sounds worth the effort for most non-tech people...

Post reply on HN