Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

coindesk.com

Post reply on HN
Print view View original

51–60 of 63 posts

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#51

Post by TylerE »

maaku wrote: post #49
TylerE wrote: post #37

Earlier quoted context omitted.

You can do anything if you allow massive handwaving. ("out-of-band mechanisms for approving transactions")

Do I have to spell it out? The machine could be under physical control of its operators, with rate limiting restrictions lifted only by manual intervention via a GUI interface, making the low bandwidth TOR connection the only link to the outside world (and a simple one at that). Or the the verification and signing steps done via TPM so as to prevent key theft. There are other possibilities too. This isn't handwavery.…

Yes, but the whole debate was how to it automatically. Once you have someone physically intervening, your solution fails to meet the problem criteria.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#52

Post by apalmer »

dragontamer wrote: post #45
michaelt wrote: post #41

Earlier quoted context omitted.

Given the choice between being hacked, losing your reputation and millions of dollars; or having someone on call 24/7 to move USB sticks across an air gap; I'd choose the latter. I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.

THIS IS THE FUTURE EVERYONE!!!! The future of modern banking is to return to physical transfer of funds. Instead of relying on modern networking, technology, automation, or websites... we will manually move money over a physical medium. Without automation, how the hell is BTC supposed to be any better than cash?

Uhhh let me get this right:

$10,000,000 spent to secure a bitcoin exchange to within 99.999% secure via "automation"

$100,000 spent to secure a bitcoin exchange to within 99.999% secure via physical air gap...

which makes more sense

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#53

Post by maaku »

TylerE wrote: post #51
maaku wrote: post #49

Earlier quoted context omitted.

Do I have to spell it out? The machine could be under physical control of its operators, with rate limiting restrictions lifted only by manual intervention via a GUI interface, making the low bandwidth TOR connection the only link to the outside world (and a simple one at that). Or the the verification and signing steps done via TPM so as to prevent key theft. There are other possibilities too. This isn't handwavery.…

Yes, but the whole debate was how to it automatically . Once you have someone physically intervening, your solution fails to meet the problem criteria.

Having people involved to resolve edge cases and possible fraud/theft is kinda the point...

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#54

Post by michaelt »

dragontamer wrote: post #45
michaelt wrote: post #41

Earlier quoted context omitted.

Given the choice between being hacked, losing your reputation and millions of dollars; or having someone on call 24/7 to move USB sticks across an air gap; I'd choose the latter. I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.

THIS IS THE FUTURE EVERYONE!!!! The future of modern banking is to return to physical transfer of funds. Instead of relying on modern networking, technology, automation, or websites... we will manually move money over a physical medium. Without automation, how the hell is BTC supposed to be any better than cash?

You can still do automated transactions from your hot wallet - human intervention is only required for transactions that exceed the size of the hot wallet.

And merchants who don't make enough profit to pay $20-$30 an hour to put a human in the loop can have a payment processing company do it.

Don't get me wrong, if you think bitcoin websites have done a superb job at securing their hot wallets [1,2], you're welcome to keep all your money in a hot wallet where it can be 100% cleaned out without a human lifting a finger. Good luck with that.

[1] https://bitcointalk.org/index.php?topic=83794.0 [2] http://fc13.ifca.ai/proc/1-2.pdf

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#55

Post by Vitaly »

Whale Communications, before they were purchased by Microsoft, had a hardware solution where a shared HDD disk was used to physically switch it between 2 different hosts to enable file sharing in a shared directory. would be almost perfect to secure the hot wallet of a BT service. MS seem to discontinued the product. I wander if something like this still exists from another vendor?

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#56

Post by fat0wl »

maaku wrote: post #33
fat0wl wrote: post #9

Earlier quoted context omitted.

I've heard that this type of insurance is expensive and a large part of banks' transaction fees. I can only imagine how expensive an insurance service like that for Bitcoin would be.

However unlike the existing system there will be a transparent, competitive market for such insurance mechanisms, and they will be available to consumers/businesses directly.

I think the banks are pretty focused on offering competitive products that are packaged together neatly to avoid putting too much of burden on consumers (what's the diff between choosing a bank or choosing a private transaction-insurance service?).

I'm paranoid of investment banks but I think plain old banks are benign. You put a certain amount of money in your account and they handle all this for you. There is usually no charge for checking. Credit cards don't charge interest unless you go into debt, etc.

I don't think lack of competition is so much an issue, it seems that the Bitcoin movement just has a fundamental distrust of govt/corporations. I think if Bitcoin money didn't magically appreciate in value so much it wouldn't be much cheaper than banking except for big international money transfers.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#57

Post by fat0wl »

clarkmoody wrote: post #43

I know it makes for a better headline to say $1M stolen, but unless actual USD was taken in the theft, I wish these headlines would say "X BTC stolen, valued at $Y." But then again, the headline made it to the front page and got me to comment...

hah i suggested this a few posts ago & people got pissed.

https://news.ycombinator.com/item?id=6783710

granted, i don't present these things very tactfully

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#59

Post by bdcravens »

iamshs wrote: post #20
stpddts wrote: post #13

Can we get a break from all these Bitcoin posts please?

I agree, there are six posts about Bitcoin right now on top. On one hand it is community regulated matter, but on other hand 20% of top posts is too much.

When Steve Jobs passed, the entire home page was related articles.

Re: Bitcoin Payment Processor BIPS Attacked, Over $1M Stolen

#60

Post by tlrobinson »

michaelt wrote: post #41
dragontamer wrote: post #29

Earlier quoted context omitted.

You cannot automate a cold-wallet scheme. Any automated website or tool will require a "hot wallet" of some kind. The more funds in the hot wallet, the longer the website / BTC Bank can go automatically. Customers like having funds available to them immediately... among other things.

Given the choice between being hacked, losing your reputation and millions of dollars; or having someone on call 24/7 to move USB sticks across an air gap; I'd choose the latter. I've seen fast food joints and parking lots with 24/7 attendants, it can't possibly cost more than $100,000 a year.

Did you really just suggest trusting millions of dollars of customer funds to the equivalent of minimum wage fast food restaurant employees?
Post reply on HN