Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Funds of every Trust Wallet browser extension could have been stolen

blog.ledger.com

Post reply on HN
Print view View original

1–10 of 186 posts

Re: Funds of every Trust Wallet browser extension could have been stolen

#5

Post by fallingknife »

This is the fundamental issue with the supposed "trustlessness" of crypto. Unless you are interacting directly with the protocol layer (which is like 0.0001% of users), you actually have to trust a lot of people and software.

And the whole system has been built on anonymity because it is "trustless," so it can never work in its present form. Sure, there is someone, or multiple people, at Wells Fargo who can move your money. But they will never be anonymous, and all of their actions are logged and tracked, and we have laws on the books requiring banks to be liable for such fraud and return the money to the customer. And failing that, if the whole bank goes down from the fraud, your money is FDIC insured, and the government will make you whole. Whereas in crypto, if someone gets your private key, you are instantly and irrevocably fucked. Crypto can never be anything more than a gambling tool unless it drops this "trustless" myth.

Re: Funds of every Trust Wallet browser extension could have been stolen

#6

Post by sjsdaiuasgdia »

asplake wrote: post #2

> That probably means this vulnerability exists in some other wallet implementations which is concerning…

This song is almost as old as Bitcoin itself.

2013: https://bitcoin.org/en/alert/2013-08-11-android

All that trust I have to put in the non-crypto financial system doesn't seem too bad when you realize that the trust picture isn't all that different in the crypto world.

Do you trust that the exchange won't steal your money?

Do you trust that the software developers haven't intentionally or accidentally left any holes in the software you use to manage your money, or the smart contracts you interact with?

Do you trust the vendor you're buying from to not steal your money? If you're thinking "escrow services", do you trust the escrow service to not steal your money?

Do you trust in all that, and more, sufficiently to operate in a system where there is no way to undo erroneous or malicious transactions? Except for like when ETH rolled back the chain after the DAO incident...you know, going contrary to the immutable ledger concept this whole mess is built on...what you might even say is the most essential trust in crypto.

Re: Funds of every Trust Wallet browser extension could have been stolen

#10

Post by wslh »

fallingknife wrote: post #5

This is the fundamental issue with the supposed "trustlessness" of crypto. Unless you are interacting directly with the protocol layer (which is like 0.0001% of users), you actually have to trust a lot of people and software. And the whole system has been built on anonymity because it is "trustless," so it can never work in its present form. Sure, there is someone, or multiple people, at Wells Fargo who can move your…

First, the trustlessness in crypto, it is just a nice keyword. You trust the protocol and the protocol trust depends on specific nodes (e.g. miners). Would you trust more these actors that hundreds of well known companies using a BFT protocol? Or a mix of both groups?

Second, key(s) custody is paramount beyond the blockchain technology used. And... this was very basic: "Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds."

Post reply on HN