Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

71–80 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#71

Post by jeroenhd »

nailer wrote: post #36
jeroenhd wrote: post #27

Earlier quoted context omitted.

I imagine this should be possible with a very small connector addon that calls out to a secure wallet running on the desktop as a native application. This requires some careful consideration to prevent phishing and other nastiness, but a native application could use native window prompts and techniques such as Windows Hello/TouchID as an authentication technique that's hard to spoof. The complexity and risks are stil…

Crypto wallets also have access to the secure enclave via webauthn. I develop a new wallet (Portal) which will have webauthn but I know Glow uses Windows Hello right now.

Interesting! Does the WebAuthn API provide enough of a cryptographic basis to fulfill the needs of cryptocurrency wallets?

I know it works through public/private key sharing but I wasn't aware that it provides such direct primitives.

Re: Funds of every Trust Wallet browser extension could have been stolen

#72

Post by veeti »

detrites wrote: post #20
pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

The flaw here was in a dependency introduced by targeting WASM, and could apply to any project of any kind relying on random number generation for a cryptographic purpose. It is not a "crypto-currency" specific problem.

The flaw was not in a dependency but Trust Wallet's first party code [1]. They decided that Mersenne Twister would be sufficient for generating cryptographically random data and specifically called it "secure" [2]. Very unfortunate.

[1] https://github.com/trustwallet/wallet-core/blob/3.1.0/wasm/s... [2] https://github.com/trustwallet/wallet-core/pull/2240

Re: Funds of every Trust Wallet browser extension could have been stolen

#73

Post by surgical_fire »

nintendo1889 wrote: post #65
surgical_fire wrote: post #51

Earlier quoted context omitted.

> Does this seem normal to you? Yes. Currency is a mean of exchange, nothing more. Economy is essentially how to satisfy the needs of its participants with the limited resources available. For the graph that you linked in a somewhat alarmist fashion to make sense, you need to compare it with a plethora of other information for it to make sense. What is the productivity of people and corporations? What are the level o…

Bitcoin will be the poor man's inflation hedge. Eventually others will wake up- see bhutan quietly mining it, and even family and private wealth offices (traditionally very conservative investors) are buying it.

Bitcoin is a complete failure as a currency. Your argument, not mine.

For all the talk and posture of it being a return to "hard money", all it is used for is as another investment tool for the wealthy.

And that is me giving it the benefit of doubt.

Re: Funds of every Trust Wallet browser extension could have been stolen

#74

Post by Geee »

surgical_fire wrote: post #51
Mistletoe wrote: post #39

Earlier quoted context omitted.

https://fred.stlouisfed.org/series/BOGMBASE Does this seem normal to you? Imagine you are a patient and you took data like this to your doctor. Would he say you are healthy after having such a gradual rise all your life and then complete chaos? If things have been going great the past few years I’d say maybe it doesn’t matter, but things don’t seem to be going great for anyone except the wealthy (those by nature clos…

> Does this seem normal to you? Yes. Currency is a mean of exchange, nothing more. Economy is essentially how to satisfy the needs of its participants with the limited resources available. For the graph that you linked in a somewhat alarmist fashion to make sense, you need to compare it with a plethora of other information for it to make sense. What is the productivity of people and corporations? What are the level o…

Wealthy people don't own money, they own assets. And they're usually in debt. Inflationary currency massively benefits wealthy people. Inflation is a transfer of buying power from poor people to rich people. That's the function of inflation. That's exactly the mechanism by which it makes poor people work harder, and makes the economy "grow".

Inflation makes people work harder, but it's not the right thing to do, and not good for the economy in the long term. Economy is not just the GDP; it's also happiness, freedom and mental health.

All productivity increases in the economy should belong to the people who are working and saving their money. They made the decision to limit their consumption and wait for cheaper products.

Inflationary currency is very unethical, and will result in total centralization of wealth when productivity keeps increasing.

Re: Funds of every Trust Wallet browser extension could have been stolen

#75

Post by Robotbeat »

tremon wrote: post #61
nailer wrote: post #30

Earlier quoted context omitted.

Why do precious metals have value?

Because the community believes their value will outlast the currency system. People have believed the same thing about tulips, peppercorn, wine, and buildings (or rather, land).

Well there’s residual value in metals as you can build stuff with it. Agree that the vast majority of the value of precious metals is contextual, but I guess you can appeal to human’s love of shiny stuff plus history, beyond just community context.

Re: Funds of every Trust Wallet browser extension could have been stolen

#76

Post by Robotbeat »

mrkstu wrote: post #35
nailer wrote: post #30

Earlier quoted context omitted.

Why do precious metals have value?

They (i.e. materials like gold/silver) have inherent value as being relatively difficult to obtain without significant work and being useful in creating valuable objects. Because of those properties they become a store of value (representing the work and rarity) which then makes them a useful proxy for trading that value, which increases their rarity/value by taking it out of circulation when used as a store of value…

Still, it should be said the vast majority of the value of gold is contextual. Just like aluminum before we perfected ability to make it cheaply.

Re: Funds of every Trust Wallet browser extension could have been stolen

#77

Post by toss1 »

pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

Except for:

"There's a sucker born every minute" — P. T. Barnum

After that 'discovery' in the mid-1800s, there seems to be an endless supply, and at today's higher brithrates and infant survival rates... we can't really expect that they'll ever run out ;-P

Re: Funds of every Trust Wallet browser extension could have been stolen

#78

Post by justinator »

nintendo1889 wrote: post #62
krono wrote: post #46

> Creating good randomness is a daunting task - Ledger devices rely on dedicated silicon logic in our certified smartcard chips that have been the gold standard of secure industries for the past 40 years to guarantee high quality randomness and tamper resistance. Which is worthless and entirely irrelevant when they keep leaking their customers' personal and purchase data (which they claimed not to collect or keep, an…

Which is why we transfer small amounts to the wasabi hot-wallet, coinjoin, and then spend. Each spend is then joined with another spend to obfuscate every purchase. It requires careful budgeting for future purchases (as the coin-join takes time). Trezor now has experimental support for directly coin-joining bitcoin that is stored on the cold-wallet, but I don't think anyone should trust it.

Not to be snarky, but this sounds real convenient.

Why don’t we just admit these tools are just fundamentally broken?

Re: Funds of every Trust Wallet browser extension could have been stolen

#79

Post by wslh »

pontifier wrote: post #9

At some point there won't be any more suckers left. That's when crypto will really collapse.

This could also apply to other financial instruments. At the core decentralization is about power. Crypto as we know it now could fail but the core tener is about new ways of power in the financial world.

From the technological level is also about the freedom to experiment with finances where regulations don't enable to. Even if it is at a sandbox level.

Re: Funds of every Trust Wallet browser extension could have been stolen

#80

Post by justinator »

dale_glass wrote: post #60
nailer wrote: post #30

Earlier quoted context omitted.

Why do precious metals have value?

They're relatively useless for other purposes. Eg, gold is rare, heavy and malleable. In situations where you need those qualities other options exist, like lead. It has the advantage of not oxidizing, so it makes for great jewelry. But all of that is extremely contextual. If it turns out there's a huge reserve of it somewhere, it will crash in value. Or if things crash badly enough there may be other things to worry…

Gold is far from useless - I’ll wager whatever hardware you typed that comment on is made up in small part with gold.
Post reply on HN