Live data from Hacker News

“Crypto drainer” template facilitates theft

blog.confiant.com

71–80 of 228 posts

Re: “Crypto drainer” template facilitates theft

#71
post #52

Earlier quoted context omitted.

you’re right. the unreasonable complexity of crypto is why people fall for phishing scams. thanks.

Right? It's a good thing our monetary system and financial instruments aren't complex, phew!

It's one thing to have complex payment instruments where innocent mistakes are reversible. Having them in a world where everything is permanent is another situation entirely.

Re: “Crypto drainer” template facilitates theft

#72
post #61
post #20

Earlier quoted context omitted.

Again, this can be true, but regulatory capture is a problem of democracy, not of regulation powers themselves.

The problem with democracy and regulations both come down to essentially sovereign financial powers (wealthy/corporate) that have interests that don't align with the people or the state that is supposed to represent the people. These corporations control us if we don't control them.

The problem with democracy is the dunning-kruger effect more than the principle-agent problem. People think highly-complex problems are obvious and easy. They care more about big sweeping theory than they do about local technocracy.

The idea that anti-intellectualism even exists is testament to this.

Re: “Crypto drainer” template facilitates theft

#73

So let me get this straight. You just connect your Wallet to a random website and let them run arbitrary smart contracts? That's wild, man. Surely there's gotta be some concern here that someone could take your shit. I'm just surprised there isn't a privacy.com equivalent for this, like a limited-view wallet that lets you create sub-wallets for interaction with various services. Or if there is, perhaps it's not famou…

Nothing stops a person making a new wallet with limited assets for interaction with less reputable websites. Web3 culture has made this quite difficult in practice. For example, it's quite normalised to say "new exciting nft project, only available to existing owners of expensive nfts". This sort of thing is considered an ownership perk. And it's why those discord hacks were so damaging, a statement like that was mad…

Why is the MetaMask UI so dumb that it can't say "This transacation is sending your NFT to address X. Address X has [reputation stats of some sort]. Is that what you want?"

Re: “Crypto drainer” template facilitates theft

#74
post #13

So let me get this straight. You just connect your Wallet to a random website and let them run arbitrary smart contracts? That's wild, man. Surely there's gotta be some concern here that someone could take your shit. I'm just surprised there isn't a privacy.com equivalent for this, like a limited-view wallet that lets you create sub-wallets for interaction with various services. Or if there is, perhaps it's not famou…

You can create a different wallet for each transaction, and do all sorts of complicated things, but nobody does. Just like you could pay your phone bill with a prepaid Visa each month just in case they overcharged you.

But why isn't it fully automated, like Apple Pay or privacy.com?

Re: “Crypto drainer” template facilitates theft

#75
post #66

Earlier quoted context omitted.

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?

This is what I do:

When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, you should add it to your saved addresses on your wallet and next time you'll see the name of the address.

Also you can create a new throw away address, transfer just a little bit of coins to it and interact with the contract. If it does what you think it should do, then you can create a new account and do it again.

It's not perfect. It could be a proxy, so you're not guaranteed the contract you're interacting with.

There's no easy way to "see what a transaction does". You just need to do risk management.

Re: “Crypto drainer” template facilitates theft

#76
post #40
post #17

Earlier quoted context omitted.

Not necessarily a bad person. But to think that people that may not have the education to understand NFTs deserve to be robbed seems to justify to prey on people. NFTs are an absurdity, but millions are spend on advertising them to an unprotected public. That are the real culprits. Scammers do not deserve to get any money, that's for sure.

I feel the same way about it I do when I see someone blasting down the freeway on a motorcycle in shorts and t-shirt. If something happens, then we should try to help, but I'm not showing up for the candle lit vigil and pretending it's crazy that 1+1=2.

Seems more like someone walking down the sidewalk at 1am and stopping to buy a drink from a lemonade stand, and getting jumped by a gang and mugged.

Re: “Crypto drainer” template facilitates theft

#77
post #68
post #50

> Victim connects their wallet to “mint”. It's not clear exactly what's going on here. The word "connect" by itself implies two modes: (1) present public keys; or (2) present private keys. But the loss of property suggests it's (2). If so, then the people falling for this are hopelessly incompetent. Of course, this has been a problem from the start of Bitcoin. Users "buy" something they have no clue how to secure. Th…

the wallet in question is probably metamask, a browser extension. it injects a web3 provider in `window.ethereum`. connecting the wallet is done by calling `window.ethereum.enable()`, this pops up a dialog asking you to connect an address to the website. it just tels the extension that the website is allowed to interact with the extension This article is about phishing in the context of cryptos. Silent signing doesn'…

I have a CS degree and have worked at FAANG for 6 years and that was straight gibberish to me. I guess maybe because I have only worked at FAANG using traditional tech and not crypto startups?

Re: “Crypto drainer” template facilitates theft

#79
post #72
post #61

Earlier quoted context omitted.

The problem with democracy and regulations both come down to essentially sovereign financial powers (wealthy/corporate) that have interests that don't align with the people or the state that is supposed to represent the people. These corporations control us if we don't control them.

The problem with democracy is the dunning-kruger effect more than the principle-agent problem. People think highly-complex problems are obvious and easy. They care more about big sweeping theory than they do about local technocracy. The idea that anti-intellectualism even exists is testament to this.

Gonna say something that would likely be downvoted but a functioning society does not need democracy. A governing body needs legitimacy because it's power springs from the people, but democracy and voting are not necessarily requisite.

e.g. China/CCP (which isn't really communism, but definitely not democratic).

Re: “Crypto drainer” template facilitates theft

#80
post #25
post #17

Earlier quoted context omitted.

Not necessarily a bad person. But to think that people that may not have the education to understand NFTs deserve to be robbed seems to justify to prey on people. NFTs are an absurdity, but millions are spend on advertising them to an unprotected public. That are the real culprits. Scammers do not deserve to get any money, that's for sure.

You don't need to have the education to understand NFTs to have the knowledge not to put bets down on things you don't understand.

If every transaction required perfect understanding by both parties, there would be no markets. We have regulations to reduce the amount of understanding needed to participate in markets without getting fleeced, which makes the markets function.
Post reply on HN