5 ms·

The person who wrote this EIP works for Parity. If we're going to be fixing shit like this, can we also restore funds to the poor guy who got robbed of 41k eth

by ryan-c 9y ago

The person who wrote this EIP works for Parity. If we're going to be fixing shit like this, can we also restore funds to the poor guy who got robbed of 41k ether? https://medium.com/taptrust/frozen-the-story-of-the-largest-wallet-burglary-in-ethereums-history-a-massive-mystery-and-a-1b0a81f3ee88 https://medium.com/taptrust/frozen-the-story-of-the-largest-... https://www.coindesk.com/35-million-refund-developer-appeals-ethereum-hard-fork-hack-reversal/ https://www.coindesk.com/35-million-refund-developer-appeals...

bhouston 9y ago
Only those connected to Vitalik get fixes, everyone else is shit out of luck.
- darawk 9y ago
  The people connected to Vitalik here just wrote the wallet. It doesn't really help them per se. It helps the innocent people who were hurt by their mistake.
  - bhouston 9y ago
    Doesn't this fix help the company Parity which has connections to Vitalik? According to https://techcrunch.com/2017/12/05/parity-ceo-says-shes-confident-that-its-280m-in-frozen-ethereum-isnt-lost-forever/ https://techcrunch.com/2017/12/05/parity-ceo-says-shes-confi... The co-founder of Parity has $90M at stake in this PR. If it was me and I had $90M at stake, I would totally slip Vitalik a million or two to ensure that this PR was merged.
    - warent 9y ago
      Vitalik's net worth is a lot higher than that, I highly doubt he can be bribed for a couple million (or any dollar amount)
      - foepys 9y ago
        Everybody can be bought. Rich people don't stop caring about more money just because they are rich.
slavik81 9y ago
> the hack happened because of a weak passphrase [...] Levy [expected] his private key would still be needed to access the wallet. But the wallet generation tool Levy used, developed by ethereum creator Vitalik Buterin, had a critical flaw in that others could access the wallet just with the passphrase. Neither gpg nor ssh keys work that way. Why would Vitalik design the etherium wallet key like that? The passphrase is the last line of defense against people who have managed to access to your system, it's not the first and only defense against remote attackers.
- mabbo 9y ago
  > Why would Vitalik design the etherium wallet key like that? Because he may be very clever at having come up with this whole ethereum system, but that doesn't mean he's wise and experienced. It's a rookie mistake, made by a rookie. It happens. He seems the type to learn from it at least.
  - ibarrac 9y ago
    No, the tool works like a brainwallet. The seed phrase determines the ethereum public and private keys. That way there is nothing else to save, no file backup is necessary. Knowledge of the seed phrase is sufficient. That's a feature, not a bug. It is not like gpg where the private key is independent, stored on disk and encrypted by the passphrase. The user messed up in that he didn't understand that he needed to use a strong passphrase or it was possible for anyone in the world to guess it.
    - Buge 9y ago
      >No, the tool works like a brainwallet. Are you saying that is a good thing? It's well known that brainwallet is a footgun. https://en.bitcoin.it/wiki/Brainwallet https://en.bitcoin.it/wiki/Brainwallet >An early old-style brainwallet was created by by memorization of a passphrase and converting it a private key with a hashing or key derivation algorithm (example: SHA256). That private key is then used to compute a Bitcoin address. This method was found to be very insecure and should not be used. Humans are not a good source of entropy.

by ryan-c 9y ago

bhouston 9y ago

Only those connected to Vitalik get fixes, everyone else is shit out of luck.

darawk 9y ago
The people connected to Vitalik here just wrote the wallet. It doesn't really help them per se. It helps the innocent people who were hurt by their mistake.
- bhouston 9y ago
  Doesn't this fix help the company Parity which has connections to Vitalik? According to https://techcrunch.com/2017/12/05/parity-ceo-says-shes-confident-that-its-280m-in-frozen-ethereum-isnt-lost-forever/ https://techcrunch.com/2017/12/05/parity-ceo-says-shes-confi... The co-founder of Parity has $90M at stake in this PR. If it was me and I had $90M at stake, I would totally slip Vitalik a million or two to ensure that this PR was merged.
  - warent 9y ago
    Vitalik's net worth is a lot higher than that, I highly doubt he can be bribed for a couple million (or any dollar amount)
    - foepys 9y ago
      Everybody can be bought. Rich people don't stop caring about more money just because they are rich.

slavik81 9y ago

> the hack happened because of a weak passphrase [...] Levy [expected] his private key would still be needed to access the wallet. But the wallet generation tool Levy used, developed by ethereum creator Vitalik Buterin, had a critical flaw in that others could access the wallet just with the passphrase. Neither gpg nor ssh keys work that way. Why would Vitalik design the etherium wallet key like that? The passphrase is the last line of defense against people who have managed to access to your system, it's not the first and only defense against remote attackers.

mabbo 9y ago
> Why would Vitalik design the etherium wallet key like that? Because he may be very clever at having come up with this whole ethereum system, but that doesn't mean he's wise and experienced. It's a rookie mistake, made by a rookie. It happens. He seems the type to learn from it at least.
- ibarrac 9y ago
  No, the tool works like a brainwallet. The seed phrase determines the ethereum public and private keys. That way there is nothing else to save, no file backup is necessary. Knowledge of the seed phrase is sufficient. That's a feature, not a bug. It is not like gpg where the private key is independent, stored on disk and encrypted by the passphrase. The user messed up in that he didn't understand that he needed to use a strong passphrase or it was possible for anyone in the world to guess it.
  - Buge 9y ago
    >No, the tool works like a brainwallet. Are you saying that is a good thing? It's well known that brainwallet is a footgun. https://en.bitcoin.it/wiki/Brainwallet https://en.bitcoin.it/wiki/Brainwallet >An early old-style brainwallet was created by by memorization of a passphrase and converting it a private key with a hashing or key derivation algorithm (example: SHA256). That private key is then used to compute a Bitcoin address. This method was found to be very insecure and should not be used. Humans are not a good source of entropy.