Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoinica MtGox account compromised

bitcointalk.org

Post reply on HN
Print view View original

71–80 of 108 posts

Re: Bitcoinica MtGox account compromised

#71

Post by biff »

raganwald wrote: post #39
sneak wrote: post #29

Earlier quoted context omitted.

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?" Seriously. Knock that shit off. It's a red herring. You can't abstract away the personal process of choosing trust anchors and metrics, no matter how hard you try. Changing your trust anchor to "the government" just means you end up getting fucked on a larger scale, over a la…

As the big banks in the USA have proven, government regulation is definitively not the answer to the question "How can you know whom to trust?” A common sentiment: “Big Government doesn’t work.” No, it doesn’t work. But in many cases, it’s less broken then no government a/k/a The Free Market. I’m reminded of Winston Churchill’s quip: "It has been said that democracy is the worst form of government except all the othe…

It's necessary to have a framework that makes taking the correct action more rewarding or less punitive than taking incorrect action.

We mostly rely on government to handle this. It's not perfect and it works in some folks' interests more than others, but I feel comfortable saying that it does increase the cost of most socially undesirable activities beyond their worth to most people most of the time.

Is it possible to come up with similar protection for Bitcoin without such an authority? I think you have to find a way to introduce risk for people handling Bitcoins they don't own, where they've got an amount of their own Bitcoins held as a security that could be forfeit if they fail to meet obligations.

But then, who holds the security? Who determines if it's forfeit? This doesn't have the feel to me of a situation that can be handled without human interaction, but I would definitely be intrigued if somebody figured it out.

Re: Bitcoinica MtGox account compromised

#72

Post by rprasad »

sneak wrote: post #68
guscost wrote: post #59

Earlier quoted context omitted.

Without any rules, there is no such thing as personal property and therefore a free market cannot exist. You're describing anarchy, where people take what they want by force.

> You're describing anarchy, where people take what they want by force. Like taxes taken by the government with the consent of the majority? Anarchy is solving for the general case.

You're free to move to someplace where they do not impose taxes, like Somalia.

Of course, you will have to vie with various competing warlords, all of whom will demand "protection money", but that's the price of freedom from taxation.

Re: Bitcoinica MtGox account compromised

#73

Post by sgornick »

jasonlingx wrote: post #69

It is worth noting that (some of) the people behind Intersango acquired and took over operations of Bitcoinica just before the recent hack that took Bitcoinica offline since May 2012 (see https://bitcointalk.org/index.php?topic=81581.0 ) Intersango is currently the second largest bitcoin exchange after MtGox, and the largest bitcoin exchange for GBP (see http://bitcoincharts.com/markets/ ) From their site( https://in…

Mt. Gox offers two-factor authentication methods (Yubikey and Google Authenticator). Neither was used. Lastpass offers two-factor authentication methods (Yubikey and Google Authenticator). Neither was used.

But also, nobody who also works with Intersango had access to either of those two accounts. [Update: I may have been mislead on that as there is now conflicting information: http://bitcointalk.org/index.php?topic=93074.msg1028157#msg1... ]

Re: Bitcoinica MtGox account compromised

#74

Post by drivebyacct2 »

Reusing passwords. Check.

Using passwords after they've been known to be compromised. Check.

Storing passwords protecting north of a million dollars in an online password storage system and not even using the provided two-factor auth. Priceless.

This is just like the Mtgox guys claiming the bcrypt was not good after getting caught using unsalted MD5.

This is amateur bullshit and the lack of actual penalties makes me think I should have finished the exchange I started writing. You know, one where I would have the common sense to store financial values as decimals and not floats.

These are such naively simple mistakes, it just is hard to fathom.

The first reply's conclusion is spot on

You failed to disable Mt.Gox API,

You failed to protect mt. Gox with a Yubikey,

You failed to change Lastpass password,

You failed to protect Lastpass with one of their many 2nd factor auth. (some free)

This is embarrassing to watch.

Re: Bitcoinica MtGox account compromised

#76

Post by sgornick »

morsch wrote: post #37
columbo wrote: post #28

I know nothing about bitcoin, can someone provide a tldr about why it is (seemingly) so difficult to build a secure site around exchanging these things? I don't get how you can simply "Loose" a few hundred grand without a horse head winding up at the food of your bed.

It's difficult to write secure code. It's difficult to administrate a secure system. It's a new market where release early, release often is important. BTC transaction are largely untraceable and irreversible.

That's probably the shortest yet most comprehensive response to "explain this". Nice!

Re: Bitcoinica MtGox account compromised

#77

Post by georgemcbay »

xSwag wrote: post #10
codesuela wrote: post #5

I would've thought that no one would keep using Bitconica after their first major breach but here I am, shocked by the fact that people still kept trusting them with their Bitcoins

I've lost count of how many times they have been breached. Why don't they get independent pen testers and get them to test their system? Surely paying a pen tester $5k is much better than the amount of negative publicity you get when you lose $350K

"Surely paying a pen tester $5k is much better than the amount of negative publicity you get when you lose $350K"

Depends upon who you're "losing" the $350k to.

Re: Bitcoinica MtGox account compromised

#78

Post by rorrr »

mmcnickle wrote: post #47

The app and its infrastructure was created by a single, very inexperienced programmer. The app's original author, Zhou Tong, is only 17[1]. Not that age is an indicator of experience in general, but it's certainly the case here. I'm honestly shocked at the amount of trust placed in Bitcoinica. An interesting display of the oft mentioned Stockholm Syndrome happening elsewhere on the forum here https://bitcointalk.org/…

What makes you think he wasn't in on this breach? It's far more profitable than running a bitcoin exchange.

Re: Bitcoinica MtGox account compromised

#79

Post by wmf »

0x0 wrote: post #6

I can't believe people entrust virtual money to sites like these which in general - but consistently - seem to be run by amateurs.

AFAIK Bitcoinica was the only site offering BTC derivatives, so presumably some people figured the potential profit was worth the risk. More generally, all Bitcoin exchanges seem to be run by amateurs, so people have to deal with them to cash out.

Re: Bitcoinica MtGox account compromised

#80

Post by rmc »

sneak wrote: post #31
biff wrote: post #25

This is starting to prove -- the hard way -- why regulations, certifications, and all that other stuff that feels like meaningless overhead the majority of the time has become a grudgingly accepted part of our lives. It comes back to the most difficult problem: you inevitably need to trust someone, so how do you minimize your risk in that trust? I always thought the Bitcoin trust issues would revolve around the inabi…

> that providers in this market might not be driven to produce quality and reliability because somehow there isn't the demand for it Also, the market is young and small and very inefficient as yet. The tools for allowing market participants to reasonably evaluate trustworthiness of service providers don't really exist yet. You can't really blame that on "lack of demand for quality and reliability". Give it five years…

The market might be young, but IT security is not. Unix has had salts on passwords for decades.
Post reply on HN