Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Casa Client Case Study: The Tinder Trap

blog.keys.casa

Post reply on HN
Print view View original

71–80 of 211 posts

Re: Casa Client Case Study: The Tinder Trap

#71

Post by mabbo »

Cryptocurrencies offer a single property that is both good and bad: there is no authority who can reverse or block a transaction against the will of the participants.

Lawsuits and criminal proceedings can cause government authority to direct banks and financial institutions to do what they say. Government can set rules to block transactions, or to demand more identification to be tied to a transaction. Even cash can be physically seized and taken by the government. I'm not arguing this is good or bad, just that it is. You can come up with a list of circumstances where this authority is a bad thing, or a good thing.

And in cases like this, we see why that overriding authority can be a good thing. If your bitcoins are stolen, there is nothing anyone can do to get them back. They are gone.

Re: Casa Client Case Study: The Tinder Trap

#72

Post by [deleted] »

sombremesa wrote: post #63
statoshi wrote: post #37

Earlier quoted context omitted.

You're free to believe that I (the author) made up this story. I'm not a fiction writer; the Bitcoin security space is exciting enough without needing to waste time making stories up. I'll note that we have seen several folks report being victims of similar attacks since we published this article. https://twitter.com/Disruptepreneur/status/14131498654759075... https://twitter.com/jayzalowitz/status/141316518720545588…

FYI this comment actually had the effect of confirming that the story is all but made up - there is nothing remotely resembling evidence anywhere, including in this ostensibly defensive comment.

[deleted]

Re: Casa Client Case Study: The Tinder Trap

#73

Post by Cthulhu_ »

break_the_bank wrote: post #17

Was wondering how vulnerable my traditional bank accounts are to this attack. I’m assuming this is one of those times that a daily limit could be useful, though that can also be bypassed to some extent by phone banking.

Traditional bank accounts have a number of securities in place. Depending on the bank:

- You can't transfer money without filling in 2FA credentials

- Suspicious transactions will be flagged (e.g. account draining amounts to another account you've never transfered money to)

- Banks have insurance and will reimburse you the money, whether they can revert the transactions are not. Which leads me to:

- Bank transactions are reversible

- Bank accounts need ID. If money is transfered to someone, they will know the identity of the person receiving money. For dumb people it'll be themselves, for smarter people it'll be their money mule. (never allow strangers or new friends to transfer money through your account no matter how lucrative or trustworthy it may seem). Crypto exchanges are catching up, but crypto doesn't need to be transferred between exchanges.

- Banks are licensed and pay to a national bank; if a bank goes bankrupt (ha), said national bank has you covered. See cases like Icesave and DSB Bank.

But yeah, reversibility, anti fraud / theft prevention and insurance is banks' advantage that the crypto crowd is either unaware of or simply doesn't want to pay for, even if banks are cheap (because they get to play with your money)

Re: Casa Client Case Study: The Tinder Trap

#74

Post by joseluis »

vishnugupta wrote: post #36

I've been working in the payments industry on and off for 15 years. I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police. To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a comp…

yes, it's being worked on, but it's only apparent if you know where to look, that means in business oriented blockchains. This could be a good starting point: https://coingeek.com/stefan-matthews-on-hashing-it-out-episo...

Re: Casa Client Case Study: The Tinder Trap

#75

Post by wmf »

gruez wrote: post #41
vishnugupta wrote: post #36

I've been working in the payments industry on and off for 15 years. I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police. To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a comp…

>I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police. What about the stories of companies being scammed via wire transfer?

Wire transfers can be reversed in some cases but it's not as simple as filing a chargeback; AFAIK it requires cooperation between law enforcement and the recipient bank.

Re: Casa Client Case Study: The Tinder Trap

#76

Post by deregulateMed »

tablespoon wrote: post #6
deregulateMed wrote: post #2

This is one of my biggest fears. As a result I use the supposedly not ok, security by obsecurity. (Along with other normal precautions) I don't tell people which Bitcoin wallet I recommend, I simply say "I don't tell people where I hide gold". Although not sure if I could survive devil's breath.

> As a result I use the supposedly not ok, security by obsecurity. Security by obscurity is perfectly OK as part of a layered defense, where your systems are also secured properly. Where it is not OK is when you don't bother to secure your systems because you assume they're hidden and no one will find them.

Yep. It's one of about 5 methods I use, depending on how you count them. I don't even offer security advice or mention the 5.

Re: Casa Client Case Study: The Tinder Trap

#77

Post by deregulateMed »

tppiotrowski wrote: post #4
deregulateMed wrote: post #2

This is one of my biggest fears. As a result I use the supposedly not ok, security by obsecurity. (Along with other normal precautions) I don't tell people which Bitcoin wallet I recommend, I simply say "I don't tell people where I hide gold". Although not sure if I could survive devil's breath.

Didn’t this comment make you a potential target?

What information in particular did I give away?

This is important to me, please let me know.

Re: Casa Client Case Study: The Tinder Trap

#79

Post by im3w1l »

Cthulhu_ wrote: post #46
papito wrote: post #26

Earlier quoted context omitted.

I got roofied once in a bar and the next thing I knew I was going back to my place in the back of a car. They gave me weed, too. You are completely out of it, you will say whatever they ask you. This is how truth serum works, at its core. So, the girl(s) called Chase posing as my wife and transferred $500 out of my account. A nice chunk of cash, but not too greedy so I could let it go and not pursue it any further. Y…

It's kinda scary that they can order a cash transaction via phone. Is there no identity verification at all?

I think the issue is that the bank probably gets a lot of legitimate phone calls like that. $500 is the kind of money you can need urgently and where failing closed would be a major inconvinience.

Re: Casa Client Case Study: The Tinder Trap

#80

Post by dannyw »

seibelj wrote: post #38
papito wrote: post #26

Earlier quoted context omitted.

I got roofied once in a bar and the next thing I knew I was going back to my place in the back of a car. They gave me weed, too. You are completely out of it, you will say whatever they ask you. This is how truth serum works, at its core. So, the girl(s) called Chase posing as my wife and transferred $500 out of my account. A nice chunk of cash, but not too greedy so I could let it go and not pursue it any further. Y…

That is extremely scary. I hope you filed a police report? That person is a serious criminal.

Ehh, for a lot of people $500 is the "I'd rather just move on" amount.

If that happened to me I would move on, particularly because you don't know the criminals here and whether they'd seek retribution if you made a police report.

If someone roofied you, they'd probably be willing to do worse things to you if you hassled them. Just some advice; speaking from life experiences.

Post reply on HN