Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If you don't own your OS, you don't own your BTC

combatnerd.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: If you don't own your OS, you don't own your BTC

#51

Post by mirimir »

johnnycab wrote: post #48
mirimir wrote: post #27

This is also an issue for Android and iOS. And some of the newer cryptocurrencies are more or less restricted to those platforms. And with smartphones, adversaries can access the OS using StingRay etc. Edit: I should have said "devices like StingRays". Perhaps StingRays can only track, and maybe see traffic. But the baseband is poorly secured, and has privileged access.

>And with smartphones, adversaries can access the OS using StingRay etc. I was not aware of StingRay possessing any advanced capabilities, other than being used as a IMSI catcher and providing LE with 'tower dumps'? https://en.wikipedia.org/wiki/Stingray_phone_tracker https://eu.usatoday.com/story/news/nation/2013/12/08/cellpho...

I'm not sure about the StingRay brand per se, but it's likely that malicious fake cell towers can pwn the baseband radio. And we know that the baseband radio is privileged over userland.

Also, baseband firmware is totally black box, so we have no clue what its capabilities are. So the safest bet is isolating it in a subsystem, or better in a separate device, which can be firewalled.

https://www.osnews.com/story/27416/the-second-operating-syst...

Re: If you don't own your OS, you don't own your BTC

#52

Post by abdullahkhalids »

pjc50 wrote: post #47
abdullahkhalids wrote: post #32

A number of comments in this thread strawmanning the OP's argument. The main point is simply that if you don't have complete legal control, in perpetuity, of the system that you are storing your cryptocurrency on, then if your license is cancelled by legal means, you may lose your data [1]. OP is not talking about whether FOSS or proprietary software has more bugs or has more chances of having backdoors. OP is not ta…

> if your license is cancelled by legal means This basically never happens to private individuals - the license enforcement focuses on getting you to pay for it instead. The data in any case remains yours and you can theoretically lift it off the drive (or your backups!) with FOSS. In the very unlikely event of getting raided for copyright infringement, they'll take all your hardware and sort it out later. (Of course…

I did not say that the linked article is making a sound argument. I agree with you that even with a non-FOSS OS, you can set things up that cancellation of the license does not make you lose your keys. I was merely annoyed by the strawmanning.

Re: If you don't own your OS, you don't own your BTC

#53

Post by deweller »

koalalorenzo wrote: post #7

The real question is: why he is not using an Hardware Wallet? A ledger wallet is cheap enough if you get worried about your BTC being in an unsafe device. Yes, then you have to trust the company selling it for you, but isn't that the whole business to not compromise their own devices?

Hardware wallets are a good compromise here. Sure, you need to trust the hardware vendor. But the attack surface for a hardware wallet is way smaller than with a big OS.

There are much bigger attack vectors than the operating system vendor. Even using with a FOSS OS, you are susceptible to viruses or other attacks not initiated by the OS vendor.

Use a hardware wallet or cold storage. Use a multi-sig wallet for corporate-sized quantities.

Holding your own BTC is not simple but there are good solutions. Be safe out there.

Re: If you don't own your OS, you don't own your BTC

#54

Post by grifball »

Nitramevfank wrote: post #37
normalnorm wrote: post #26

Earlier quoted context omitted.

To me, your offer of "help" reads like a thinly disguised attack / insult. I guess we all know about the "humblebrag", this is "backhanded empathy". Or something. The author is not saying anything that is not true. Given everything that happened and was disclosed in the past decade, I don't think one has to be paranoid to be deeply suspicious of black box software controlled by big tech.

I never touched Bitcoin so maybe you can clarify how this makes sense: > If Microsoft decides to terminate your license, what happens to your Bitcoin? Your Bitcoin is represented by some kind of data stored on your computer I assume. So this data should be backed up, right? So the anwser is that you would access the bit coins from some device which you have a license to use? If my understanding is right then I would…

if you're using security methods like bitlocker (an MS product that encrypts your disk), it's possible that, after losing your license to use that program, your data would become unrecoverable without some serious reverse engineering efforts.

I'm probably just adding to the paranoia though. In reality, this whole thing is a very unrealistic attack. What hluska has stated is mostly true, but I'd like to add that an employee that could write code into an OS that would steal bitcoin and stay undetected would have to have a lot of skill. More than that random engineer that they just hired, think a guy with a PhD. Those types of people generally don't risk their jobs to steal because they're usually committed to their work and make a lot of money.

Re: If you don't own your OS, you don't own your BTC

#55

Post by Nitramevfank »

grifball wrote: post #54
Nitramevfank wrote: post #37

Earlier quoted context omitted.

I never touched Bitcoin so maybe you can clarify how this makes sense: > If Microsoft decides to terminate your license, what happens to your Bitcoin? Your Bitcoin is represented by some kind of data stored on your computer I assume. So this data should be backed up, right? So the anwser is that you would access the bit coins from some device which you have a license to use? If my understanding is right then I would…

if you're using security methods like bitlocker (an MS product that encrypts your disk), it's possible that, after losing your license to use that program, your data would become unrecoverable without some serious reverse engineering efforts. I'm probably just adding to the paranoia though. In reality, this whole thing is a very unrealistic attack. What hluska has stated is mostly true, but I'd like to add that an em…

Sorry, but I'm not sure what point you are trying to make here. Is your scenario that the users license to use the OS is revoked combined with there not being any backups?

If you store data on a computer without backups you can expect to lose that data. Disks breaks, files are corrupted, computers are stolen, node.js deletes your crap. Or whatever.

As for employees embedding stuff in OS code. Sure, that can happen. Open source developers can also embed such code into any code they write, which has happened many times already. Unless you are writing your OS yourself from scratch or manually reviewed all source code for all code running on your machine (which I suspect no one has done the last decades), this is a risk. Open source or not.

Re: If you don't own your OS, you don't own your BTC

#56

Post by ryanlol »

jcranmer wrote: post #42
falcolas wrote: post #25

Earlier quoted context omitted.

Windows is targeted more (not exclusively, however), due to its popularity. If everyone moved over to Linux for the "security benefits", Linux would be targeted just as heavily. Both Linux and Mac users have been hit with ransomware.

The other factor is that the vast majority of Windows security administrators (i.e., random users) are incompetent. In terms of the security of the operating system itself, Windows may well be more secure than Linux. Many Windows applications, however, are going to be much less secure than the OS--although it's not like Linux applications are stellar in this regard as well (e.g., Docker).

Vast majority of Linux admins are incompetent.

>Windows may well be more secure than Linux

This is very obviously the case if you look into the deployed exploit mitigation technologies.

Re: If you don't own your OS, you don't own your BTC

#57

Post by ryanlol »

cmcd wrote: post #6
ryanlol wrote: post #2

This guy is a downright idiot if he thinks that he has any more control over his keys on desktop Linux without actually auditing all the source code himself. The idea that ElementaryOS is less likely to steal your coins than Windows or OS X is simply laughable.

We already know Windows has some pretty excessive telemetry, it is not unreasonable to assume this or other elements of the OS can be exploited to gain control of a wallet. At least with Linux we have thousands of open source developers keeping an eye on things, chances are much higher that an issue would be caught with Linux since Windows is closed source.

> At least with Linux we have thousands of open source developers keeping an eye on things, chances are much higher that an issue would be caught with Linux since Windows is closed source.

That’s all utterly irrelevant when ElementaryOS doesn’t even offer reproducible builds.

Besides, source code access doesn’t make finding bugs much easier. Usually you’ll be auditing binaries anyway.

Re: If you don't own your OS, you don't own your BTC

#58

Post by ryanlol »

sudosysgen wrote: post #14
falcolas wrote: post #10

Earlier quoted context omitted.

> At least with Linux we have thousands of open source developers keeping an eye on things A bit of pithy sarcasm for your morning: Those thousands of eyes worked so well with OpenSSL, didn’t it? Those eyes are less vigilant than you might think, especially when the eyes aren’t being paid to monitor a particular chunk of code.

Yes, they worked pretty well for OpenSSL. The issue was found eventually. In a proprietary system, it may have been there forever.

> In a proprietary system, it may have been there forever.

Why? Heartbleed was discovered by fuzzing the compiled binaries, not by eyeballing the source code.

Nothing prevents you from performing the exact same research on proprietary software.

Re: If you don't own your OS, you don't own your BTC

#59

Post by ryanlol »

cmcd wrote: post #8
hvidgaard wrote: post #5

Earlier quoted context omitted.

Not to mention, you have to evaluate this in context. What would MS stand to lose if they actually did this? Far far more than whatever Bitcoin they'd be able to steal that much is certain. But in any case, if you care about security, you have a hardware wallet and store the seed somewhere secure.

It wouldn't have to be Microsoft exploiting this though, a few rogue employees that can modify their telemetry system could do this on their own. There is no external oversight for Windows but on Linux there are thousands of people looking at changes even if you aren't looking yourself.

> there are thousands of people looking at changes even if you aren't looking yourself.

I’m sorry, but it’s really obvious that you don’t really know what you’re talking about.

Very few commits are looked at by more than a handful of people. If you’ve ever had any involvement in FOSS development you must know this.

Re: If you don't own your OS, you don't own your BTC

#60

Post by hluska »

Nitramevfank wrote: post #55
grifball wrote: post #54

Earlier quoted context omitted.

if you're using security methods like bitlocker (an MS product that encrypts your disk), it's possible that, after losing your license to use that program, your data would become unrecoverable without some serious reverse engineering efforts. I'm probably just adding to the paranoia though. In reality, this whole thing is a very unrealistic attack. What hluska has stated is mostly true, but I'd like to add that an em…

Sorry, but I'm not sure what point you are trying to make here. Is your scenario that the users license to use the OS is revoked combined with there not being any backups? If you store data on a computer without backups you can expect to lose that data. Disks breaks, files are corrupted, computers are stolen, node.js deletes your crap. Or whatever. As for employees embedding stuff in OS code. Sure, that can happen. O…

I’m not the person you’re replying to, but Grifball is talking about BitLocker. BitLocker is a device encryption tool that ships with certain versions of Windows (I think only Pro, but don’t trust that.)

I believe that what Grifball is saying is that if your disc was fully encrypted and you lost the ability to decrypt, you’d be in a lot of trouble. In the BitLocker case, if you had a valid Windows license, encrypted your disc and lost your license, it would be a very bad day.

As for your comments about backups, you’re correct though in this case, a backup wouldn’t be much use if you lost access to BitLocker. That would take a really serious ops failure, but far stranger things have happened.

Post reply on HN