Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

bitcoincharts.com

Post reply on HN
Print view View original

231–240 of 262 posts

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#231

Post by aquarin »

burgerbrain wrote: post #181
aquarin wrote: post #167

Earlier quoted context omitted.

Let me explain what I mean: "Real" money are just a tokens, transferring the "Trust" between one market participant to authority and other market participant to authority. By "trust" I mean that every participants believe that Rules in the market will be followed. When you have N market participants you have N*(N-1)/2 ways to exchange "trust". If I understand correctly Bitcoin is N to N system. When you have Authorit…

Accidentally upvoted this... HNs really needs to have an undo vote feature, even if it is as blunt as slashdots "undo moderation".

You can always down-vote my other comments if this make you fill better.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#232

Post by etherael »

aquarin wrote: post #229
etherael wrote: post #206

Earlier quoted context omitted.

Trust that the participants in the market will behave in accordance with established rules on penalty of punishment of human administered centralised authority is one thing, trust that mathematical truths governing how cryptography works is completely another. If the latter does not hold, the financial institutions which you claim to be employed by are in a lot more hot water than they would be if it does and bitcoin…

You always need governing authority to enforce the rules, just because the cryptography protocol can not handle all the possible situations of human interactions and because money have no intrinsic value. Value is determined by the level of trust to Authority transferred by different communication channels and protocols (encrypted messages, paper with special printings etc.) In the case of Bitcoin it is not necessary…

This is precisely what I mean by people do not grasp the entire concept of a mathematical law and how it relates to public key cryptography. There are man made laws which are invariably prescriptive, and natural laws (not in the legal sense) which are invariably descriptive, and fallible only to the extent that this is not the case.

There is no authority needed to enforce these natural laws just as there is no authority needed to enforce gravity, it is a force of nature, public key cryptography relies upon mathematics which is also a force of nature. If the math is incorrect the system is insecure, failing that no authority is required to uphold the mathematical dogma of public key cryptography lest faith in the system be compromised. You're working from a set of premises and assumptions that simply do not apply here.

These laws do not require enforcement by an authority;

http://en.wikipedia.org/wiki/Laws_of_science

Read this for a primer on public key cryptography;

http://en.wikipedia.org/wiki/Public_key_cryptography

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#233

Post by bermanoid »

norswap wrote: post #230
iki23 wrote: post #221

Earlier quoted context omitted.

[Update - 2:06 GMT] What we know and what is being done. * It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. * Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hash…

"We have been working with Google to ensure any gmail accounts associated with Mt.Gox user accounts have been locked and need to be reverified." Ah, that's why I had to change my password then.

Yes, I was also worried when I saw the suspicious activity flag had been tripped on my acct., but apparently that doesn't actually mean that anyone actually tried anything, just that our e-mails appeared in the list.

Luckily I never reuse passwords for important stuff like e-mail or anything that touches money...

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#234

Post by bermanoid »

waterlesscloud wrote: post #179
lubos wrote: post #74

Earlier quoted context omitted.

which makes me think mtgox got very lucky. I mean the hacker could overcome $1000 limit a day (roughly 80 bitcoins) by creating thousands of bogus accounts, putting on the market bid orders at $0.01 in all accounts, drive the market to the bottom like he did to fill his orders and quickly transfer 80 bitcoins from each account out of the exchange. he could get away with bitcoins worth of millions irreversibly and com…

One would assume the $1000 limit is in the mtgox code. So if the hacker had full server access...

If you trust the Mt. Gox folks, they're now claiming that there was no server hack, just a database copy that some consultant had that got stolen.

If you trust what they're saying, which might be questionable since their business is pretty much going up in flames at the moment, so they are probably desperate to make things appear better than they are...

I hope for their sake that they actually have enough USD and BTC on hand to deal with the mass withdrawals that are coming...

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#235

Post by Flenser »

rmc wrote: post #144
hollerith wrote: post #121

Earlier quoted context omitted.

It is pretty clear that Mt Gox rolled back all trades from now to the first big unauthorized trade.

So if you had already done a legitimate trade it's gone? "Sorry you made some money there, but someone else got affect by something else, so we've undone that". So much for "There are no chargebacks on BitCoin"

When designing a system like this you have to have a veil of ignorance. There may from time to time be attacks or defects that mean some people lose a lot of money while others gain some. Not knowing which will happen to you, how would you want the system to work?

http://en.wikipedia.org/wiki/Veil_of_ignorance

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#236

Post by aquarin »

etherael wrote: post #232
aquarin wrote: post #229

Earlier quoted context omitted.

You always need governing authority to enforce the rules, just because the cryptography protocol can not handle all the possible situations of human interactions and because money have no intrinsic value. Value is determined by the level of trust to Authority transferred by different communication channels and protocols (encrypted messages, paper with special printings etc.) In the case of Bitcoin it is not necessary…

This is precisely what I mean by people do not grasp the entire concept of a mathematical law and how it relates to public key cryptography. There are man made laws which are invariably prescriptive, and natural laws (not in the legal sense) which are invariably descriptive, and fallible only to the extent that this is not the case. There is no authority needed to enforce these natural laws just as there is no author…

I pretty well understand both laws of science (PhD in physics) and what PK cryptography is, but you still don't get my point. There is something outside the protocols implementation, that are secure and do the job they are are developed for.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#237

Post by wnight »

plamenv wrote: post #37
skrebbel wrote: post #9

i must admit i'm somewhat impressed how fast the hackers and cheaters managed to take over bitcoin trading. i think it's kind of cute. people hoped for an economy no government could control, and got exactly that: anarchy and a burning world.

Yes, the mayhem at the beginning is expected but I'm curious if the trial/error process could actually bring some sound stable system at the end. I'm inclined to think that this won't happen because most of the people in the bitcoin "economy" have some serious dislike for central authorities. And it's hard to design a stable monetary system without some kind of regulation and more transparency.

Wanting to avoid single points of failure doesn't seem that strange to me. It's an engineering decision, not a political one. Central authority is just a central system to hack, or become corrupt.

You wouldn't let your business become reliant on a single-supplier part, why would you let it rely on a single-supplier currency?

Regulations are only worth as much as the authority regulating them, if that. Just look at the USA. All the laws required to stop the recent mortgage meltdown were already in place and could still be used, but won't be. What value do those unused regulations have? It's better to have less fake regulations and simply not depend on a non-existent safety net.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#238

Post by potatolicious »

danenania wrote: post #226
potatolicious wrote: post #173

Earlier quoted context omitted.

Wait, so this is the train of thought for Bitcoin: - Centralized money is bad! We need to create a perfectly decentralized, distributed economy! - Oh no! It turns out that the average Joe will get burned really badly by this new decentralized system! - But wait! What if we created these things called "banks" and provide people peace of mind and security by taking on some of this risk?! - ...? - Um... not profit.

Did you somehow get the idea that bitcoin users are against banking? Banking (as a concept) and decentralized money are not at odds.

Banking eradicates many of the supposed gains of decentralized money - not all, but most. I just dig a quick Google for "benefits of Bitcoin" and it seems most people agree on the following:

- Anonymity/trackability. Gone if you are with a bank. Sure, possible to sidestep by going through the song-and-dance that is withdraw-send-deposit. We can do this IRL also, but there's a reason people do not.

- Taxability. Welp, if your BTCs are in a bank, the IRS can easily get you.

- Abusive/coercisve government action (e.g., freezing). Well, yeah, if you're with a bank that can happen too.

- Lack of fees. If banks become standard (and if BTC takes off, yes, they will become standard) then kiss goodbye to this benefit - the same way cash right now has no transaction fee, but bank transactions do.

In fact, the only major sell of Bitcoin that remains:

- Inability for government to arbitrarily expand the supply of money.

Still a win, but suddenly Bitcoins have lost a lot of charm, especially for the everyman for whom the above 4 points are much more salient than that last one.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#239

Post by rmc »

iki23 wrote: post #221
buro9 wrote: post #39

From the mt.gox site: Huge Bitcoin sell off due to a compromised account - rollback The bitcoin will be back to around 17.5$/BTC after we rollback all trades that have happened after the huge Bitcoin sale that happened on June 20th near 3:00am (JST). Service should be back by June 20th 10:00am (JST, 01:00am GMT) with all the trades reversed and accounts available. One account with a lot of coins was compromised and w…

[Update - 2:06 GMT] What we know and what is being done. * It appears that someone who performs audits on our system and had read-only access to our database had their computer compromised. This allowed for someone to pull our database. The site was not compromised with a SQL injection as many are reporting, so in effect the site was not hacked. * Two months ago we migrated from MD5 hashing to freeBSD MD5 salted hash…

This allowed for someone to pull our database ... so in effect the site was not hacked.

Weasel words. If someone has a dump of your database, then your site was hacked.

Re: 500k Bitcoins traded in 1h, Mt.Gox market hacked + crash

#240

Post by rmc »

Hawramani wrote: post #169
bradleyland wrote: post #157

Earlier quoted context omitted.

I hate to look down my nose at other programmers, because I understand that we all start somewhere, but if you are building a financial exchange and you encrypted passwords using unsalted MD5 at any point in the history of your product, you have proven to me that you are learning as you go, and there is no way in hell I'd trust you with any significant sum of money.

Where do programmers learn about this stuff? Is it taught at schools? Can anyone recommend good books on proper security procedures?

Websites like this are great. Just look at what other learned people here are saying about cryptography.
Post reply on HN