[dead]
Exodus Bitcoin Wallet: $490k swindle
61–70 of 297 posts
Re: Exodus Bitcoin Wallet: $490k swindle
#62What I don't get about the Snap store is why there's no verified link back to a website? If you have the technical ability to create an app, you probably have the ability to upload something to /.well-known/ or to add a DNS TXT record. That way the Snap store could say "This app came from this website." OK, it doesn't help if someone goes to the trouble of registering a homograph address, but it would at least give n…
Off topic, but I wish /.well-known/ was used more often. Right now, the only real usage for apis is in oauth2. There are dozens of tiny use cases we could use a standard uri for ease of use in corporate environments… .well-known/documentation - redirects to the docs .well-known/health - health check .well-known/specificiation - api contracts Etc…
>Right now, the only real usage for apis is in oauth2.
... as well as the ACME HTTP-01 challenge as used by Let's Encrypt etc.
Re: Exodus Bitcoin Wallet: $490k swindle
#63Earlier quoted context omitted.
The claim is that some day innovations, and checks, and some other technologies will fix this and do all of this automatically, somehow. That's why it's still early days.
[flagged]
You’re arguing with a straw man (or the version of yourself which considered investing in Bitcoin).
Nobody presented this argument. Rollbacks?
First world users who have excellent financial services are not the target use case.
The senior citizens you mention are free to invest using ETFs if they want or should have as little responsibility over the wealth as possible.
They could also use a centralized exchange which regularly deposits into a multi-signature wallet controlled by the family.
Re: Exodus Bitcoin Wallet: $490k swindle
#64Re: Exodus Bitcoin Wallet: $490k swindle
#65On a tangent, my neighbor came to me about a month ago and asked if I was a "hacker"? He's around 75 and has known me for maybe 20 years, we're not close friends but we run into each other every now and then and he knows I work with IT; I'm about half his age. Long story short, I find out he needs help to retrieve his bitcoin wallet because he's lost $300k. I spend an hour looking around his devices and find out he's…
who the fuck told this poor guy about bitcoin, tell him to invest his money in some stocks, he will be taxed but wont be fucked.
Or just buy it with classic instruments - ETF.
Re: Exodus Bitcoin Wallet: $490k swindle
#66This is scary and even a hardware wallet might not help. When I create a transaction with Electrum on my computer, I use a hardware wallet to sign the transaction. When I sign the transaction, the hardware wallet shows the amounts, and the output addresses. But if my copy of Electrum was backdoored and smart about what it did, it could use an output address for the remaining amount that went to another wallet. And si…
No, you're wrong. The issue you're describing can't be exploited on Ledger devices at least. (Source: I’m a contributor to their bitcoin transaction parsing code) Their hardware wallet checks if the provided change output's address is actually owned by the device owner: - if it does, then the change output is simply hidden from the user validation flow - if it doesn’t it will appear as a second bitcoin transfer to ap…
Ok. I use Ledger. And I would not have thought of being suspicious of there being two addresses to confirm.
So rather than being “wrong”, maybe I am more similar to most regular user of hardware wallets, and that this kind of attack would indeed be a disaster for a lot of users who have hardware wallets. Myself included.
Re: Exodus Bitcoin Wallet: $490k swindle
#67App stores with stringent and restrictive policies do indeed help prevent this type of scams, unfortunately.
Re: Exodus Bitcoin Wallet: $490k swindle
#68Earlier quoted context omitted.
It’s happening right now.
Can you elaborate on this?
From a prior thread that didn’t get any constructive engagement: https://news.ycombinator.com/item?id=39205762
Essentially Ethereum can be used to codify financial contracts in order to provide a level of trust where one does not otherwise exist.
Re: Exodus Bitcoin Wallet: $490k swindle
#69On a tangent, my neighbor came to me about a month ago and asked if I was a "hacker"? He's around 75 and has known me for maybe 20 years, we're not close friends but we run into each other every now and then and he knows I work with IT; I'm about half his age. Long story short, I find out he needs help to retrieve his bitcoin wallet because he's lost $300k. I spend an hour looking around his devices and find out he's…
who the fuck told this poor guy about bitcoin, tell him to invest his money in some stocks, he will be taxed but wont be fucked.
Probably the Instagram lady that is helping him. These scams are fairly common on IG these days.
Re: Exodus Bitcoin Wallet: $490k swindle
#70Earlier quoted context omitted.
Bitcoin "wallet" is just a pair of public and private keys. Honest question - what is the difference between a "hardware wallet" and a thumbdrive with the keys on it, except for the price tag?
When you plug a hardware wallet into a computer it can't get the keys off the wallet. It can only ask the hardware wallet to sign a transaction, and the hardware wallet asks the user to confirm. When you plug a thumbdrive with keys on it into a computer the computer can just take the keys. It's the same as the difference between a YubiKey and a thumbdrive with GPG keys on it.
They exploited the change address which most crypto hardware wallets don't show when verifying a transaction.