“Crypto drainer” template facilitates theft • Hacker News Board

Re: “Crypto drainer” template facilitates theft

#61

Post by r00fus » Wed, Jun 15, 2022, 10:32 PM UTC

scoofy wrote: post #20

r00fus wrote: post #15

Earlier quoted context omitted.

btw "bad regulation" is usually due to regulatory capture [1] whether in legislation (ie, regulation without teeth, designed to fail) or in practice (ie, revolving door/corruption). Which usually points back to the companies/industries being regulated. [1] https://en.wikipedia.org/wiki/Regulatory_capture

Again, this can be true, but regulatory capture is a problem of democracy, not of regulation powers themselves.

The problem with democracy and regulations both come down to essentially sovereign financial powers (wealthy/corporate) that have interests that don't align with the people or the state that is supposed to represent the people.

These corporations control us if we don't control them.

Re: “Crypto drainer” template facilitates theft

#62

Post by dcolkitt » Wed, Jun 15, 2022, 10:32 PM UTC

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address.

The app does not have the ability to sign transactions on your behalf without your explicit approval.

Re: “Crypto drainer” template facilitates theft

#63

Post by rattlesnakedave » Wed, Jun 15, 2022, 10:32 PM UTC

IanCal wrote: post #34

ChrisClark wrote: post #22

Earlier quoted context omitted.

The people being scammed here aren't looking at what they are doing, at all. They go to the website, click "mint NFT", then their wallet pops up and says, "Sending [your expensive NFT] to [address], confirm?" And then the user says, yeah, I want to send them my NFT. There are more subtle ways to scam though. But the people losing them here are the type of users that confirm everything without reading.

Signing transactions used to iirc just show hard to interpret bytes. The user is not executing the transaction.

Metamask presents a large red warning when a user is prompted to sign a raw transaction, and they’re planning on deprecating that part of the API, so hopefully that helps.

Re: “Crypto drainer” template facilitates theft

#64

Post by dcolkitt » Wed, Jun 15, 2022, 10:35 PM UTC

Barrera wrote: post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

All connecting a wallet does is allow the app to see your public keys. Private keys are not directly exposed. The app can then request the user sign transactions, but they must be explicitly approved by the user.

Where fraud typically happens is when a user thinks they're signing an innocuous transaction, when in fact they're signing a malicious one. This is generally a hard problem, but it's very clear from the wallet the address of the smart contract your transaction interacts with.

Re: “Crypto drainer” template facilitates theft

#65

Post by reydequeso » Wed, Jun 15, 2022, 10:36 PM UTC

scoofy wrote: post #10

Regulation can be bad, but it can also be good. People think of history like it was wonderful, but it was full of cons and scams. Reputation matters, and people with reputations charge a premium for it. Some of the best aspects of regulations is exactly to remove the reputation tax by mandating everyone follow the same practices as the trusted institution. The real sad aspect is that the crypto-libertarians of today…

>who is going to read a book about 19th century finance

What recommendations do you have?

Re: “Crypto drainer” template facilitates theft

#66

Post by gowld » Wed, Jun 15, 2022, 10:37 PM UTC

dcolkitt wrote: post #62

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?

Re: “Crypto drainer” template facilitates theft

#67

Post by mushbino » Wed, Jun 15, 2022, 10:38 PM UTC

nubb wrote: post #52

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

you’re right. the unreasonable complexity of crypto is why people fall for phishing scams. thanks.

Right? It's a good thing our monetary system and financial instruments aren't complex, phew!

Re: “Crypto drainer” template facilitates theft

#68

Post by spinny » Wed, Jun 15, 2022, 10:38 PM UTC

Barrera wrote: post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

the wallet in question is probably metamask, a browser extension. it injects a web3 provider in `window.ethereum`. connecting the wallet is done by calling `window.ethereum.enable()`, this pops up a dialog asking you to connect an address to the website. it just tels the extension that the website is allowed to interact with the extension

This article is about phishing in the context of cryptos.

Silent signing doesn't happen (unless there is some kind of bug in metamask). the user is always presented with the contract address and call data (the args to the contract call)

Re: “Crypto drainer” template facilitates theft

#69

Post by giaour » Wed, Jun 15, 2022, 10:43 PM UTC

PragmaticPulp wrote: post #46

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas…

Users might think to themselves, I give my credit card number to all kinds of sites; how is this any different?

The internet has kind of conditioned all of us to be OK with passing around complex payment instruments without paying too much attention. If you're a hardcore believer in cryptocurrency as a political project, you almost certainly understand the difference and see the "code is law" dark forest as a feature, not a bug. But if you started buying crypto and NFTs because Matt Damon and Larry David told you to, then you're in for a world of hurt.

Re: “Crypto drainer” template facilitates theft

#70

Post by gowld » Wed, Jun 15, 2022, 10:44 PM UTC

Barrera wrote: post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

CBDC has never been about blockchain or cryptocurrency. That's what the first "C" means, and why the "D" isn't a C". It's Venmo or Zelle but run by the government bank.