Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

coindesk.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#41

Post by michaelt »

dragontamer wrote: post #29
M4v3R wrote: post #19

Ugh. There are much better solutions than keeping user funds in the hot wallet (fully cold storage with manual withdrawals, multi-signature wallets), but many "reputable" businesses STILL uses them. I don't understand why. If you want to store your customers funds online, do it the right way, or don't do it at all.

You cannot automate a cold-wallet scheme. Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically. Customers like having funds available to them immediately... among other things.

Given the choice between being hacked, losing your reputation and millions of dollars; or having someone on call 24/7 to move USB sticks across an air gap; I'd choose the latter.

I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#42

Post by M4v3R »

ye wrote: post #34
M4v3R wrote: post #30

Earlier quoted context omitted.

> You cannot automate a cold-wallet scheme. That's why I said that it would be manual. Actually, it could be semi-automatic - a script could generate all relevant transactions, and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key. > Customers like having funds available to them immediately... among other things. Either security or convenienc…

> and a human operator could simply confirm them few times a day by signing the transaction with his password protected private key. It's a payment system. This would be unacceptable.

I'm not talking about confirming transactions of merchant customers. I'm talking about confirming withdrawals from the merchant accounts.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#44

Post by foobarqux »

oleganza wrote: post #16
jzwinck wrote: post #3

Earlier quoted context omitted.

Well thank goodness for that. At least this way there is no chance of recovery. I enjoyed the bit at the end about a potential lawsuit to get the BTC back. Sounds awfully familiar to the legal posturing after some other BTC heists--none of which got anywhere AFAIK. Do people still think the irrevocability of BTC transactions is a good thing?

Gold, which was easier to track down and confiscate "back" was historically confiscated in much larger quantities by much tougher guys. This "insured" government debt-backed money that you have today is a result of having heavy money that is ultimately owned by someone who is bigger than you. While Bitcoin is stolen from some exchanges from time to time, it's much more diffused and it's enormously harder to take bitc…

States are powerful. You are mistaken if you think bitcoin can somehow materially evade that power, you have to interact with the real world some time.

Putting aside the increasingly clear fact that network-attached computers won't be secure from state-actors for the foreseeable future --- and bitcoin transactions always have to hit the network --- states can effectively control bitcoin being spent or bitcoin cash-outs being transferred in country as well as any currency.

Presently the risk of losing or having stolen your bitcoin is far higher than the same for gold or conventional stores of value.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#45

Post by dragontamer »

michaelt wrote: post #41
dragontamer wrote: post #29

Earlier quoted context omitted.

You cannot automate a cold-wallet scheme. Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically. Customers like having funds available to them immediately... among other things.

Given the choice between being hacked, losing your reputation and millions of dollars; or having someone on call 24/7 to move USB sticks across an air gap; I'd choose the latter. I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.

THIS IS THE FUTURE EVERYONE!!!!

The future of modern banking is to return to physical transfer of funds. Instead of relying on modern networking, technology, automation, or websites... we will manually move money over a physical medium.

Without automation, how the hell is BTC supposed to be any better than cash?

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#46

Post by GigabyteCoin »

ori_b wrote: post #36

I'm not a bitcoin expert, so I may end up off base, but... The US government seemed surprisingly warm to bitcoin in the senate hearing. I suspect that if governments end up getting involved in bitcoin, each merchant will require some form of ID for each wallet that they interact with. This will mean that tracking down crimes like this will be fairly easy, since there's a record of each transaction. Trace down the cha…

If the US government decides to take this approach, I am sure that a few of these guys will do the exact opposite: http://en.wikipedia.org/wiki/Tax_haven#Examples

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#47

Post by peteretep »

clarkmoody wrote: post #43

I know it makes for a better headline to say $1M stolen, but unless actual USD was taken in the theft, I wish these headlines would say "X BTC stolen, valued at $Y." But then again, the headline made it to the front page and got me to comment...

Why do you wish that? Every news source on the planet localizes currency amounts to their audience. Are you actually making some weird political point about BTC value, or are you surprised that a news source is localizing currency values?

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#48

Post by dublinben »

GigabyteCoin wrote: post #46
ori_b wrote: post #36

I'm not a bitcoin expert, so I may end up off base, but... The US government seemed surprisingly warm to bitcoin in the senate hearing. I suspect that if governments end up getting involved in bitcoin, each merchant will require some form of ID for each wallet that they interact with. This will mean that tracking down crimes like this will be fairly easy, since there's a record of each transaction. Trace down the cha…

If the US government decides to take this approach, I am sure that a few of these guys will do the exact opposite: http://en.wikipedia.org/wiki/Tax_haven#Examples

Jurisdictions like that have been increasingly disappearing. If regulators in major countries make it illegal to exchange BTC anonymously, it will significantly hamper its adoption.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#49

Post by maaku »

TylerE wrote: post #37
maaku wrote: post #31

Earlier quoted context omitted.

> You cannot automate a cold-wallet scheme. Yes, you can. You can have the hot wallet only deal with multi-signature outputs, and have these approved by separately locked down servers running behind TOR, for example, using out-of-band mechanisms for approving transactions.

You can do anything if you allow massive handwaving. ("out-of-band mechanisms for approving transactions")

Do I have to spell it out? The machine could be under physical control of its operators, with rate limiting restrictions lifted only by manual intervention via a GUI interface, making the low bandwidth TOR connection the only link to the outside world (and a simple one at that). Or the the verification and signing steps done via TPM so as to prevent key theft. There are other possibilities too.

This isn't handwavery. It's basic security engineering.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#50

Post by clarkmoody »

peteretep wrote: post #47
clarkmoody wrote: post #43

I know it makes for a better headline to say $1M stolen, but unless actual USD was taken in the theft, I wish these headlines would say "X BTC stolen, valued at $Y." But then again, the headline made it to the front page and got me to comment...

Why do you wish that? Every news source on the planet localizes currency amounts to their audience. Are you actually making some weird political point about BTC value, or are you surprised that a news source is localizing currency values?

1) When large amount of BTC are stolen or moved, the fiat value would be far less if the coins were sold on the open exchange.

2) The article title becomes immediately obsolete due to exchange rate fluctuations. On the day of the theft for instance, the BTC/USD rate was hugely volatile, fluctuating between $522 and $788.

We could go dig up the old Bitcoin Forum posts about people losing 25k coins and mark-to-market those losses for more sensational headlines. Or we could simply post the BTC amount in the headline along with present fiat value.

Post reply on HN