Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoinica MtGox account compromised

bitcointalk.org

Post reply on HN
Print view View original

41–50 of 108 posts

Re: Bitcoinica MtGox account compromised

#41

Post by kiba »

ajross wrote: post #38

> Unbeknownst to us, Tihan was using the mtgox api key as the password for a website called LastPass. Unbelievable. They decide to use a password escrow service... and use a duplicate password to secure it. This is 100% cargo cult security. Clearly whoever did this had no idea what the value of LastPass was, just that it was what all the cool security kids were doing. The choice of the high-value BtGox key was (stagg…

I have no idea why their BTC are siting in a MtGox account, online. Any and all bitcoin that are not being used for transactions with customers should be squirreled away into a cold wallet immediately.

If they did that, they will only have 40 K USD gone instead of also 40 K BTC gone.

Re: Bitcoinica MtGox account compromised

#46

Post by untog »

rpledge wrote: post #30

Ouch.... http://qrauth.com - Login using QR codes Password is stored on your iOS device and securely transported to the site you're login into when you scan a QR code. No more excused for duplicate/easy to remember passwords!

You should probably put in a disclaimer that you created QRAuth, it looks somewhat spammy.

Re: Bitcoinica MtGox account compromised

#47

Post by mmcnickle »

The app and its infrastructure was created by a single, very inexperienced programmer. The app's original author, Zhou Tong, is only 17[1].

Not that age is an indicator of experience in general, but it's certainly the case here. I'm honestly shocked at the amount of trust placed in Bitcoinica.

An interesting display of the oft mentioned Stockholm Syndrome happening elsewhere on the forum here https://bitcointalk.org/index.php?topic=93100.0

[1] http://coinabul.tumblr.com/post/24022841613/10qs-zhou-tong-b...

Edit: added reference.

Re: Bitcoinica MtGox account compromised

#48

Post by gibybo »

nullc wrote: post #32
bnr wrote: post #21

Earlier quoted context omitted.

Another possible explanation for the increasing rate is that someone is offering 7% interest on BTC: https://bitcointalk.org/index.php?topic=50822.0 If that offer is really enough to make the price rise, this might be exactly what this guy is speculating on.

You mean 3372% interest— The 7% number is _per-week_.

I'm not sure why anyone would believe him enough to send him money. Perhaps they don't understand how absurd that claimed interest rate is? :x

Re: Bitcoinica MtGox account compromised

#49

Post by [deleted] »

epscylonb wrote: post #40
columbo wrote: post #28

I know nothing about bitcoin, can someone provide a tldr about why it is (seemingly) so difficult to build a secure site around exchanging these things? I don't get how you can simply "Loose" a few hundred grand without a horse head winding up at the food of your bed.

If you run a service where you need to pay bitcoins out to users then that means your systems have to respond to user input and send money to them. It turns out this is pretty tricky to secure. The current popular strategy is to have hot and cold wallets. A hot wallet is online and can make payouts automatically. A cold wallet is kept offline (airgap) and brought online by a human being to refill the hot wallet when…

[deleted]

Re: Bitcoinica MtGox account compromised

#50

Post by coinabul »

mmcnickle wrote: post #47

The app and its infrastructure was created by a single, very inexperienced programmer. The app's original author, Zhou Tong, is only 17[1]. Not that age is an indicator of experience in general, but it's certainly the case here. I'm honestly shocked at the amount of trust placed in Bitcoinica. An interesting display of the oft mentioned Stockholm Syndrome happening elsewhere on the forum here https://bitcointalk.org/…

Hey, that post happened after the first hack. Also, I feel this hack is not Zhou's fault.

Edit: Oh, misread that. You were just citing source. Gotcha.

Post reply on HN