Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering scam that nearly cost me all of my ETH

twitter.com

Post reply on HN
Print view View original

281–290 of 423 posts

Re: Social engineering scam that nearly cost me all of my ETH

#281

Post by woodruffw »

thebean11 wrote: post #242
woodruffw wrote: post #181

Earlier quoted context omitted.

> I have no issue believing that an imaginary consensus stored ledger in thousands of computers all secured by massive amounts of energy and limited to 21M units over 100 years might be valuable. It's not "secured" by energy. You can't convert a Bitcoin into the original amount of power required to produce it, which is the defining quality of a financial security. It's more accurate to say that Bitcoin's value is ret…

The person you are replying to is using the word secured in a literal sense I think. Not the financial sense meaning backed by.

Okay. In what "literal" sense of the word is Bitcoin secured by electricity? The need for electricity seems to be Bitcoin's greatest practical liability, since the entire network depends on it.

Re: Social engineering scam that nearly cost me all of my ETH

#282

Post by hypertele-Xii »

thebean11 wrote: post #271
hypertele-Xii wrote: post #269

Earlier quoted context omitted.

But everyone in the world has access to a cryptocoin that will uphold their ownership in a just way? Is that the argument? Crypto is "more just" and "available globally" and affordably?

We're talking about domain name registration right? No reason why it would need to be more expensive than the current system. The argument is that ownership is upheld in a totally programmatic way. Just is a value judgement, not sure about that. It depends on what you value. Available globally yes.

What's "totally programmatic"? Is that where programmers never make mistakes, protocols never have bugs, users always remember their secret keys, read and understand the code they're running, on the computer they wholly own and trust, with perfectly functioning hardware? And somehow resistant against the $5 wrench attack and state-level seizure?

Re: Social engineering scam that nearly cost me all of my ETH

#283

Post by cipheredStones »

woodruffw wrote: post #267
Qub3d wrote: post #237

Earlier quoted context omitted.

See also: the "Chinese Robbers" fallacy[1] -- just because you can find a ton of examples of fiat fraud, doesn't imply its worse -- without context it only implies its the most common form of currency. [1]: https://www.lesswrong.com/s/XsMTxdQ6fprAQMoKi/p/DSzpr8Y9299j...

Yes, that's called "base rate neglect" or "base rate bias." In a twist of irony, you can see another example of it in the distribution of terms reinvented by internet rationalists :-)

"Base rate" appears multiple times in that article and is a pretty core concept in the rationalist movement. Memorably illustrating a concept is not the same thing as not knowing the technical term.

Re: Social engineering scam that nearly cost me all of my ETH

#284

Post by thebean11 »

hypertele-Xii wrote: post #282
thebean11 wrote: post #271

Earlier quoted context omitted.

We're talking about domain name registration right? No reason why it would need to be more expensive than the current system. The argument is that ownership is upheld in a totally programmatic way. Just is a value judgement, not sure about that. It depends on what you value. Available globally yes.

What's "totally programmatic"? Is that where programmers never make mistakes, protocols never have bugs, users always remember their secret keys, read and understand the code they're running, on the computer they wholly own and trust, with perfectly functioning hardware? And somehow resistant against the $5 wrench attack and state-level seizure?

Protocols have bugs, yep. Audited and battle tested protocols, less often though. For example, there are hacks every day where people exploit smart contract bugs, yet there are contracts securing billions of dollars that have not been hacked. Both can be true at once. Something like this wouldn't be widely used without lots of iterations to iron out issues like that.

$5 wrench attack is easily thwarted by splitting ownership across multiple geographically separated people, easily doable by giving control of the domain name to a shared contract. This would require lawyers in the current system!

Re: Social engineering scam that nearly cost me all of my ETH

#285

Post by dlubarov »

labrador wrote: post #226
herodotus wrote: post #224

So I don't know anything about crypto, but stories like this make me think that crypto can never become mainstream. I have been programming since 1970; I worked for major computer companies; I was a computer science professor; I have apps on the App Store. In spite of all of this, I have not the foggiest idea, even after reading the thread, how someone who offers to give me something can use the gift to steal from me…

According to this talk about NFTs, an NFT can contain code and the execution of that code can be triggered to do unsafe things. at 1:22:50 Smart contracts are just code, they’re software, there’s no reason they can’t be viruses or worms, the primary limitation is processing power. But, also, it’s a virus that someone can drop directly into your bankless bank account and just wait for you to activate it. And, yeah, th…

FWIW it doesn't seem that's what happened in this case. It seems the NFT was just part of the attacker's ruse, where they told a story about some NFT staking dapp they launched. Then the malicious dapp asked for permission to transfer the victim's aWETH tokens. This is just part of the ERC-20 API, unrelated to NFTs.

While it's true that NFTs can be sent without permission and can contain code, users normally invoke contracts via (hopefully trusted) dapp websites, such as app.uniswap.org. Invoking code from an NFT I found in my wallet is possible, but not part of any normal/legitimate workflow that I'm aware of.

Re: Social engineering scam that nearly cost me all of my ETH

#286

Post by AlexCoventry »

dom96 wrote: post #161
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

For somebody with $100M+ I find it strange how excited Thomas got about the prospect of some strangers setting up a meeting with some random founders. With that much money would it be that difficult for Thomas to set up a meeting with them on his own?

Yes, and I think he just set himself up as an even bigger target, because he's revealed that he has personal, immediate custody over $100m. His next attackers are likely to get much more personal and direct.

Re: Social engineering scam that nearly cost me all of my ETH

#288

Post by CryptoPunk »

dimgl wrote: post #238
chrisco255 wrote: post #11

This was a multi-week long social engineering scam targeted at Thomas. Thomas has a Discord for a drone transportation startup, and the scammers proceeded to embed themselves in the community and provide valuable labor such as web design and graphics design in order to earn his trust. Thomas's wallet is public and advertised on Twitter via his ENS domain. He had $100M+ in aETH, a derivative token provided by Aave whe…

I'm surprised anyone reading this story wouldn't conclude that the real takeaway is to just not engage with cryptocurrency at all. This ecosystem is so convoluted it just turns me off at every level.

There are trade-offs with every financial system, and ways of using each in a way that mitigates its disadvantages.

Smart contracts on a general computing platform can enable anything, including the reversible payments and reliance on trusted third party delegates that you see in traditional banking, so as a consequence of this maximally expansive design space, I assume they will eventually lead to a financial system that offers a much better set of trade-offs than that of any other financial system.

Re: Social engineering scam that nearly cost me all of my ETH

#289

Post by ikt »

betwixthewires wrote: post #264

I can get behind cryptocurrency and stuff, but the idea that anyone can write a contract that says "I get to do what I want with your money" and then build their own custom, one of a kind UI with no way to limit what the user thinks the button does for you to sign such a transaction, it's got to be the biggest, most massive security hole I've ever seen brushed off. You want me to put the title to my house on it? You…

Think of all the scams happening over TCP/IP every day! They built this thing where anyone can pretend to be a bank website? No checks or security? It's laughable. I'm in disbelief. And this is the web?

Re: Social engineering scam that nearly cost me all of my ETH

#290

Post by thebean11 »

woodruffw wrote: post #281
thebean11 wrote: post #242

Earlier quoted context omitted.

The person you are replying to is using the word secured in a literal sense I think. Not the financial sense meaning backed by.

Okay. In what "literal" sense of the word is Bitcoin secured by electricity? The need for electricity seems to be Bitcoin's greatest practical liability, since the entire network depends on it.

The more electricity is used to secure it, the more electricity is required to attack it
Post reply on HN