12 ms·

Alleged Coinomi exploit shows how easy it is to have Bitcoin stolen

131 points by timcc50 8y ago

rory096 8y ago
To Google Chrome's spellchecker. It's a bad vulnerability, but it's unlikely that it's really the attack vector here.
- ceejayoz 8y ago
  Yeah. This is pretty far-fetched. > He argues that Coinomi’s built-in spell checker automatically checked his seed phrase which involved sending it as plain text to a Google-owned website. This meant it could have been intercepted, leading to the loss of funds. "As plain text" here almost certainly means "fully encrypted with TLS"...
  - cabaalis 8y ago
    I felt like you did, and watched the video and he is certainly looking at an HTTPS data stream. I think the argument though is that the request is being logged and that some employee is reviewing logs and grabbing data. If that is the case, then it seems there is a known pool of suspects to charge with theft...
    - ceejayoz 8y ago
      Yeah, and the amount of data to sift through there would be truly enormous. I'd wager there was just some malware on the machine.
      - SketchySeaBeast 8y ago
        Apparently it's a list of 12 words from 2048. I guess you could potentially try and pattern match that, but that'd be a ton of a sifting.
      - Phlarp 8y ago
        The amount of data to sift through? What website am I on right now? Just grep for 64 character strings. The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.
        ceejayoz 8y ago
        The stream isn't unencrypted, though. Chrome's cloud spellchecker sends over HTTPS, for obvious reasons. (It's also an opt-in feature.) I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed. Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.
        Phlarp 8y ago
        Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.
    - tbodt 8y ago
      Access to this data is very tightly controlled, it's likely a single digit number of people.
- Veen 8y ago
  Right. The "thief" would have to be extremely lucky to have been intercepting the right data, recognized what the key was, and used it. As mentioned in the story, I suspect this chap found the vulnerability and is hoping to parlay it into a payout.
  - cjbprime 8y ago
    No, more than that: assuming the connection to the spell checker uses TLS, the thief would have to be Google. I'd be surprised if it doesn't use TLS?
    - jakevoytko 8y ago
      The thief in that case would likely be a browser extension
      - cjbprime 8y ago
        It's a desktop app.
    - hackinthebochs 8y ago
      There was another instance of a massive coin theft a year or so ago and the weak link again was the recovery seed being sent to a Google server. The guy described his operational security and it seemed like he did everything right. The only slip up he could point to was that he had mistakenly pasted his seed into his Chrome address bar (which then performs an automatic lookup). It was shortly after that when his funds were drained. I'm certainly not saying it was someone at Google, but it would be a mistake to not consider them an adversary in the battle to secure your funds.
      - 781 8y ago
        A ton of people use GMail for their crypto accounts. Claiming that someone at Google stole the funds is quite an extraordinary claim. You should have more proof than just the seed being sent to their spellchecker.
- sofaofthedamned 8y ago
  Exactly. There's billions of entries there each day, it's just symptomatic of bad secops where the spellchecker upload is the canary for other rank stupidity.
- tzumby 8y ago
  Why in the world would they need a spell checker when the whole mnemonic phrase standard has a checksum (last word in every phrase is the checksum)
  - wcoenen 8y ago
    The Android EditText control has this enabled by default, and the documentation of the control doesn't mention it: https://developer.android.com/reference/android/widget/EditText https://developer.android.com/reference/android/widget/EditT... To disable it, the developer needs to add the "textNoSuggestions" flag to the input type.
- GuB-42 8y ago
  Official response by Coinomi https://medium.com/coinomi/official-statement-on-spell-check-findings-547ca348676b https://medium.com/coinomi/official-statement-on-spell-check... Summary: Yes, there was a bug, we fixed it, but it was not exploitable in practice for a variety of reasons. Most importantly, the seed phrase wasn’t being transmitted in plain text.
chdaniel 8y ago
You know what's the most painful thing? If (I'd say when) years go by and Bitcoin value is a significant multiple of what it is today... Much like those who lost their wallets in 2011-2012-2013, most probably it will be haunting
- SmellyGeekBoy 8y ago
  Pull the other one... That ship has well and truly sailed.
- isostatic 8y ago
  Wasn't there a Big Bang Theory episode where this happened?
  - glaurung_ 8y ago
    Not sure about big bang, but there's a scene in the most recent season on Silicon Valley about this scenario.
api 8y ago
Why does a spell checker need to live in the cloud? To harvest user text for marketing analytics of course. Never mind.
- SketchySeaBeast 8y ago
  You NEED live updates for spellcheck, or you'll end up with a bunch of red squigglies every time you try and write "bingeable" or "rando".
  - api 8y ago
    So you click "learn." Done. This has been a solved problem since the 1980s. Dictionary updates are also tiny and local storage is gigantic compared to the size of even a massive multi-language dictionary. This is just total nonsense.
    - SketchySeaBeast 8y ago
      Yeah, sorry, that didn't come through in my text, it IS a ridiculous scenario.
      - api 8y ago
        Ahh! Yeah, your sarcasm went whoosh. :)
- VikingCoder 8y ago
  "Jake Gyllenhaal". The words people are spelling changes all of the time.
- Filligree 8y ago
  To harvest spelling for the use of the spellchecker. Why would you manually build a database of correct spellings when the spellchecker already sees all of them?
- Arnt 8y ago
  "Never attribute to anything else that which you can attribute to malice", right? In this case my first guess would be the database and deployment. That spell checker supports three hundred and umpty-seven languages, right? And I've heard it's based on the words from Google's web index, which I imagine some people might be happy mirroring on their phone but others not. Just guessing.
yingw787 8y ago
I still don't get cryptocurrencies. Yes, a blockchain works when zero trust is needed/desired for transactions, but that's still an implementation-level concern, and implementations aren't perfect. Without legal means of redress, somebody is always going to get burned. If there are legal means of redress, then by definition you trust somebody, right? I think a blockchain fits well when you need to verify a legal authority, like a felonies database (can you trust the cop that filed the report?), but otherwise it kind of just goes around the legal system; by doing so, you're just re-inventing the wheel.
- duado 8y ago
  It’s great for people who are sheltered enough to think that their governments are the least trustworthy organizations in existence, or who live in countries where they are.
  - treis 8y ago
    When you're buying drugs or transferring money for other illegal purposes the government is definitely the organization you have the least trust in.
    - curiousgal 8y ago
      I always find such opinions quite pigeonholed. Many third world countries do not have access to online banking or credit cards. Cryptocurencies were the only way I could pay for goods and services online and the only thing that made me feel like an actual citizen of the world and not just some content pirate.
      - treis 8y ago
        Those barriers are likely due to money laundering laws and whoever is accepting the bitcoin is (probably) breaking the law when they convert to USD or other currencies. So you're right that it's not necessarily illegal purchases so much as illegal transactions. You can break the cryptocurrency usage into 4 main groups: Speculators, Lawbreakers, Libertarian types, and Techies. Otherwise, the financial system provides cheaper or more convenient options for payment.
40acres 8y ago
Decentralized currency is simply not viable for the mainstream, an economy needs institutions that can be relied upon and a certain level of centralized control to take the wheel when things go sour. There are still gains to be made via speculation but the dreams of folks like Nick Szabo will not be realized with crypto in its current state.
- dylkil 8y ago
  Bitcoin wasnt ready for mainstream 10 years ago, and its not ready today. The one thing that has changed is the amount of people working on making it ready for mainstream.
- hanniabu 8y ago
  Everyone on here seems to be very bitter and salty about this stuff and I'm not sure why they're not seeing the bigger picture. This is probably the same group that would have laughed at predictions that there would be personal computers. As the technology improves, all this stuff will be abstracted from the user. There are ongoing experiments to solve this issue such as a way to store your keys in a decentralized manner in case it is lost. This can be combined with the ability to automatically move funds to different accounts periodically and also to keep funds spread across different accounts. The UX will come and the are many efforts working on this. It just takes time.
  - ChicagoBoy11 8y ago
    I think the claim is the more this infrastructure gets built out, the more players need to enter to make it workout, the bigger the footprint and calls to regulate it get, etc. will certainly make it a more functional system for the end user but also will bring about the same thing we dislike about current financial systems that involve lots of intermediaries, regulations, etc. You have to argue that this maturation process will not be plagued by the sorts of issues that our very mature regular banking system is. And that's not a certainty.
  - anyfoo 8y ago
    > Everyone on here seems to be very bitter and salty about this stuff and I'm not sure why they're not seeing the bigger picture. This is probably the same group that would have laughed at predictions that there would be personal computers. That first sentence is a great way to start an argument. And having been there for the rise of the PC, I do not agree with your analogy. Just like with the Internet analogy that usually comes up, the problem with PCs was more getting one. PCs were very expensive, cryptocurrencies are plenty available to anyone who wants them. There were skeptics with PCs, but still people jumped readily at every use case opportunity that presented itself and constantly came up with new ones. The blockchain is trying to find them for years and years now. As for the abstraction: Well, yeah, you abstract the whole "cryptocurrency" aspect away to make it work, until you may as well just use the proven, regular banking system. And then to allow for such regular processes as litigation or the simple undoing of human mistakes, you abolish the "immutable ledger" concept entirely. Am I bitter and salty about it? Given that cryptocurrencies are now consuming more energy than all solar panels combined, singlehandedly erasing the progresses we made there: Yes, definitely.
wcoenen 8y ago
If I were a security consultant, I would be a bit more hesitant about telling the world that I casually entered a seed phrase worth $60K into an online device, never mind which software it was. The report mentions that the seed phrase originally came from his exodus wallet (desktop software), which is also a wallet that is not suitable for storing such large amounts. For those amounts, use a hardware wallet, or software that supports generating the transactions offline so that the device with the key never has to go online.
- updateYourMind 8y ago
  Can someone who finds your hardware wallet use it to sign tx? I'm guessing there is a PIN.
  - hanniabu 8y ago
    Yes, there is a pin and usually a limit to attempts. Ledger has a 3 attempt limit and then it'll reset the device. You can retrieve your funds by entering a 23 word mnemonic phrase that was generated when first setting up the ledger (and keys).
    - Zenbit_UX 8y ago
      24 word
- deleted 8y ago
  [deleted]
- hombre_fatal 8y ago
  I've been the victim of social-engineering attacks for less. If you know someone holds cryptocurrency, doesn't hurt to attack their AWS account in case they are running bitcoind on EC2.
arcaster 8y ago
Today in Blockchain is Shit...
ccnafr 8y ago
It's not an exploit. It's a vulnerability baked in the wallet app source code. There's a difference. The article seems to have been written by someone who has a poor grasp on security terms. I'd recommend reading the researcher's write-up and avoid getting the wrong idea of what's happening there: https://www.avoid-coinomi.com/ https://www.avoid-coinomi.com/
- Dirlewanger 8y ago
  Yup, not saying that if Coinomi was open source this wouldn't have happened...but, chances are someone would have caught this if it was.
  - AgentME 8y ago
    All I can think is who the hell even uses a closed source cryptocurrency wallet? I'm not completely an open source purist in all places, but if there's ever a place to be one, it's in cryptocurrency. You'd think people that wanted to hold money that they didn't trust to banks wouldn't then trust that money to a random unreviewed app. It frustrates me that unfamiliar people are going to see this article (or ones about random fly-by-night exchanges running away with deposits) and just come away thinking this type of problem is an unavoidable part of cryptocurrency, which it's not. Maybe it is for people who don't do their research, but I'm not telling them to use cryptocurrency. I hate that whenever there's talk about cryptocurrency, these amateur cases dominate the conversation. It'd be like if every time the act of camping was brought up, people were aghast and talked about how unsafe camping is and how it's a horrible thing because of how some family died camping recently (after they went camping in the middle of the desert without supplies).
  - ryanlol 8y ago
    Why would access to the source have helped here? Presumably the code responsible for this is buried deep within some library they're using for the text field. It seems rather likely to me that something like this would never be spotted by looking at the source, you'd have to analyze the application at runtime.
paraxisi 8y ago
The video in the article essentially shows nothing; the claim is "Google stole my coins." Possible? Sure. Likely? No. The corroboration with the two users from Reddit is useless because they didn't use a seed phrase. edit/ To clarify: Yes, this is a stupid practice. You should be doing this locally or ideally not at all. But thinking Google is stealing your coins is a pretty big stretch.
YeahSureWhyNot 8y ago
the crypto tech was marketed as the most secure financial instrument but so far it has been repeatedly proving itself to be quite the opposite:)
anjc 8y ago
Between people losing their keyphrase, to software wallets being hacked, to hardware wallets being compromised...at what point is it more safe to just keep your coins on a reputable, insured, exchange? I think the odds of Coinbase doing a Mt. Gox are a lot more slim than the odds of a random person screwing up their own storage solution.
- AgentME 8y ago
  >to hardware wallets being compromised The only hardware wallet compromises I've heard of still required someone to have physical access to the device. If you can keep the device in your possession, it's still much safer than any of the alternatives.
MusaTheRedGuard 8y ago
This entire thread: "Why don't you just use the post office why do you need email?"
dontbenebby 8y ago
Why would you spell check a password? Passphrases are in vogue, but a field whose very mature is to be high entropy probably doesn't conform to traditional spelling/grammar...
arisAlexis 8y ago
so if an unknown mail provider in Zimbabwe gets hacked email is insecure. Logical

131 points by timcc50 8y ago

rory096 8y ago

To Google Chrome's spellchecker. It's a bad vulnerability, but it's unlikely that it's really the attack vector here.

ceejayoz 8y ago
Yeah. This is pretty far-fetched. > He argues that Coinomi’s built-in spell checker automatically checked his seed phrase which involved sending it as plain text to a Google-owned website. This meant it could have been intercepted, leading to the loss of funds. "As plain text" here almost certainly means "fully encrypted with TLS"...
- cabaalis 8y ago
  I felt like you did, and watched the video and he is certainly looking at an HTTPS data stream. I think the argument though is that the request is being logged and that some employee is reviewing logs and grabbing data. If that is the case, then it seems there is a known pool of suspects to charge with theft...
  - ceejayoz 8y ago
    Yeah, and the amount of data to sift through there would be truly enormous. I'd wager there was just some malware on the machine.
    - SketchySeaBeast 8y ago
      Apparently it's a list of 12 words from 2048. I guess you could potentially try and pattern match that, but that'd be a ton of a sifting.
    - Phlarp 8y ago
      The amount of data to sift through? What website am I on right now? Just grep for 64 character strings. The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.
      - ceejayoz 8y ago
        The stream isn't unencrypted, though. Chrome's cloud spellchecker sends over HTTPS, for obvious reasons. (It's also an opt-in feature.) I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed. Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.
        Phlarp 8y ago
        Sure, but think of how porous this could be even with HTTPS-- it doesn't have to be a google admin grepping inbound traffic. It could be happening with a custom installed certificate for a workplace or university network or it could be happening with a third party service or API behind HTTPS termination. Even something trivial like analytics could potentially leak this info. Malware is certainly a possibility, but it could just as easily have been phished or grabbed with an XSS.
  - tbodt 8y ago
    Access to this data is very tightly controlled, it's likely a single digit number of people.
Veen 8y ago
Right. The "thief" would have to be extremely lucky to have been intercepting the right data, recognized what the key was, and used it. As mentioned in the story, I suspect this chap found the vulnerability and is hoping to parlay it into a payout.
- cjbprime 8y ago
  No, more than that: assuming the connection to the spell checker uses TLS, the thief would have to be Google. I'd be surprised if it doesn't use TLS?
  - jakevoytko 8y ago
    The thief in that case would likely be a browser extension
    - cjbprime 8y ago
      It's a desktop app.
  - hackinthebochs 8y ago
    There was another instance of a massive coin theft a year or so ago and the weak link again was the recovery seed being sent to a Google server. The guy described his operational security and it seemed like he did everything right. The only slip up he could point to was that he had mistakenly pasted his seed into his Chrome address bar (which then performs an automatic lookup). It was shortly after that when his funds were drained. I'm certainly not saying it was someone at Google, but it would be a mistake to not consider them an adversary in the battle to secure your funds.
    - 781 8y ago
      A ton of people use GMail for their crypto accounts. Claiming that someone at Google stole the funds is quite an extraordinary claim. You should have more proof than just the seed being sent to their spellchecker.
sofaofthedamned 8y ago
Exactly. There's billions of entries there each day, it's just symptomatic of bad secops where the spellchecker upload is the canary for other rank stupidity.
tzumby 8y ago
Why in the world would they need a spell checker when the whole mnemonic phrase standard has a checksum (last word in every phrase is the checksum)
- wcoenen 8y ago
  The Android EditText control has this enabled by default, and the documentation of the control doesn't mention it: https://developer.android.com/reference/android/widget/EditText https://developer.android.com/reference/android/widget/EditT... To disable it, the developer needs to add the "textNoSuggestions" flag to the input type.
GuB-42 8y ago
Official response by Coinomi https://medium.com/coinomi/official-statement-on-spell-check-findings-547ca348676b https://medium.com/coinomi/official-statement-on-spell-check... Summary: Yes, there was a bug, we fixed it, but it was not exploitable in practice for a variety of reasons. Most importantly, the seed phrase wasn’t being transmitted in plain text.

chdaniel 8y ago

You know what's the most painful thing? If (I'd say when) years go by and Bitcoin value is a significant multiple of what it is today... Much like those who lost their wallets in 2011-2012-2013, most probably it will be haunting

SmellyGeekBoy 8y ago
Pull the other one... That ship has well and truly sailed.
isostatic 8y ago
Wasn't there a Big Bang Theory episode where this happened?
- glaurung_ 8y ago
  Not sure about big bang, but there's a scene in the most recent season on Silicon Valley about this scenario.

api 8y ago

Why does a spell checker need to live in the cloud? To harvest user text for marketing analytics of course. Never mind.

SketchySeaBeast 8y ago
You NEED live updates for spellcheck, or you'll end up with a bunch of red squigglies every time you try and write "bingeable" or "rando".
- api 8y ago
  So you click "learn." Done. This has been a solved problem since the 1980s. Dictionary updates are also tiny and local storage is gigantic compared to the size of even a massive multi-language dictionary. This is just total nonsense.
  - SketchySeaBeast 8y ago
    Yeah, sorry, that didn't come through in my text, it IS a ridiculous scenario.
    - api 8y ago
      Ahh! Yeah, your sarcasm went whoosh. :)
VikingCoder 8y ago
"Jake Gyllenhaal". The words people are spelling changes all of the time.
Filligree 8y ago
To harvest spelling for the use of the spellchecker. Why would you manually build a database of correct spellings when the spellchecker already sees all of them?
Arnt 8y ago
"Never attribute to anything else that which you can attribute to malice", right? In this case my first guess would be the database and deployment. That spell checker supports three hundred and umpty-seven languages, right? And I've heard it's based on the words from Google's web index, which I imagine some people might be happy mirroring on their phone but others not. Just guessing.

yingw787 8y ago

I still don't get cryptocurrencies. Yes, a blockchain works when zero trust is needed/desired for transactions, but that's still an implementation-level concern, and implementations aren't perfect. Without legal means of redress, somebody is always going to get burned. If there are legal means of redress, then by definition you trust somebody, right? I think a blockchain fits well when you need to verify a legal authority, like a felonies database (can you trust the cop that filed the report?), but otherwise it kind of just goes around the legal system; by doing so, you're just re-inventing the wheel.

duado 8y ago
It’s great for people who are sheltered enough to think that their governments are the least trustworthy organizations in existence, or who live in countries where they are.
- treis 8y ago
  When you're buying drugs or transferring money for other illegal purposes the government is definitely the organization you have the least trust in.
  - curiousgal 8y ago
    I always find such opinions quite pigeonholed. Many third world countries do not have access to online banking or credit cards. Cryptocurencies were the only way I could pay for goods and services online and the only thing that made me feel like an actual citizen of the world and not just some content pirate.
    - treis 8y ago
      Those barriers are likely due to money laundering laws and whoever is accepting the bitcoin is (probably) breaking the law when they convert to USD or other currencies. So you're right that it's not necessarily illegal purchases so much as illegal transactions. You can break the cryptocurrency usage into 4 main groups: Speculators, Lawbreakers, Libertarian types, and Techies. Otherwise, the financial system provides cheaper or more convenient options for payment.

40acres 8y ago

Decentralized currency is simply not viable for the mainstream, an economy needs institutions that can be relied upon and a certain level of centralized control to take the wheel when things go sour. There are still gains to be made via speculation but the dreams of folks like Nick Szabo will not be realized with crypto in its current state.

dylkil 8y ago
Bitcoin wasnt ready for mainstream 10 years ago, and its not ready today. The one thing that has changed is the amount of people working on making it ready for mainstream.
hanniabu 8y ago
Everyone on here seems to be very bitter and salty about this stuff and I'm not sure why they're not seeing the bigger picture. This is probably the same group that would have laughed at predictions that there would be personal computers. As the technology improves, all this stuff will be abstracted from the user. There are ongoing experiments to solve this issue such as a way to store your keys in a decentralized manner in case it is lost. This can be combined with the ability to automatically move funds to different accounts periodically and also to keep funds spread across different accounts. The UX will come and the are many efforts working on this. It just takes time.
- ChicagoBoy11 8y ago
  I think the claim is the more this infrastructure gets built out, the more players need to enter to make it workout, the bigger the footprint and calls to regulate it get, etc. will certainly make it a more functional system for the end user but also will bring about the same thing we dislike about current financial systems that involve lots of intermediaries, regulations, etc. You have to argue that this maturation process will not be plagued by the sorts of issues that our very mature regular banking system is. And that's not a certainty.
- anyfoo 8y ago
  > Everyone on here seems to be very bitter and salty about this stuff and I'm not sure why they're not seeing the bigger picture. This is probably the same group that would have laughed at predictions that there would be personal computers. That first sentence is a great way to start an argument. And having been there for the rise of the PC, I do not agree with your analogy. Just like with the Internet analogy that usually comes up, the problem with PCs was more getting one. PCs were very expensive, cryptocurrencies are plenty available to anyone who wants them. There were skeptics with PCs, but still people jumped readily at every use case opportunity that presented itself and constantly came up with new ones. The blockchain is trying to find them for years and years now. As for the abstraction: Well, yeah, you abstract the whole "cryptocurrency" aspect away to make it work, until you may as well just use the proven, regular banking system. And then to allow for such regular processes as litigation or the simple undoing of human mistakes, you abolish the "immutable ledger" concept entirely. Am I bitter and salty about it? Given that cryptocurrencies are now consuming more energy than all solar panels combined, singlehandedly erasing the progresses we made there: Yes, definitely.

wcoenen 8y ago

If I were a security consultant, I would be a bit more hesitant about telling the world that I casually entered a seed phrase worth $60K into an online device, never mind which software it was. The report mentions that the seed phrase originally came from his exodus wallet (desktop software), which is also a wallet that is not suitable for storing such large amounts. For those amounts, use a hardware wallet, or software that supports generating the transactions offline so that the device with the key never has to go online.

updateYourMind 8y ago
Can someone who finds your hardware wallet use it to sign tx? I'm guessing there is a PIN.
- hanniabu 8y ago
  Yes, there is a pin and usually a limit to attempts. Ledger has a 3 attempt limit and then it'll reset the device. You can retrieve your funds by entering a 23 word mnemonic phrase that was generated when first setting up the ledger (and keys).
  - Zenbit_UX 8y ago
    24 word
deleted 8y ago
[deleted]
hombre_fatal 8y ago
I've been the victim of social-engineering attacks for less. If you know someone holds cryptocurrency, doesn't hurt to attack their AWS account in case they are running bitcoind on EC2.

arcaster 8y ago

Today in Blockchain is Shit...

ccnafr 8y ago

It's not an exploit. It's a vulnerability baked in the wallet app source code. There's a difference. The article seems to have been written by someone who has a poor grasp on security terms. I'd recommend reading the researcher's write-up and avoid getting the wrong idea of what's happening there: https://www.avoid-coinomi.com/ https://www.avoid-coinomi.com/

Dirlewanger 8y ago
Yup, not saying that if Coinomi was open source this wouldn't have happened...but, chances are someone would have caught this if it was.
- AgentME 8y ago
  All I can think is who the hell even uses a closed source cryptocurrency wallet? I'm not completely an open source purist in all places, but if there's ever a place to be one, it's in cryptocurrency. You'd think people that wanted to hold money that they didn't trust to banks wouldn't then trust that money to a random unreviewed app. It frustrates me that unfamiliar people are going to see this article (or ones about random fly-by-night exchanges running away with deposits) and just come away thinking this type of problem is an unavoidable part of cryptocurrency, which it's not. Maybe it is for people who don't do their research, but I'm not telling them to use cryptocurrency. I hate that whenever there's talk about cryptocurrency, these amateur cases dominate the conversation. It'd be like if every time the act of camping was brought up, people were aghast and talked about how unsafe camping is and how it's a horrible thing because of how some family died camping recently (after they went camping in the middle of the desert without supplies).
- ryanlol 8y ago
  Why would access to the source have helped here? Presumably the code responsible for this is buried deep within some library they're using for the text field. It seems rather likely to me that something like this would never be spotted by looking at the source, you'd have to analyze the application at runtime.

paraxisi 8y ago

The video in the article essentially shows nothing; the claim is "Google stole my coins." Possible? Sure. Likely? No. The corroboration with the two users from Reddit is useless because they didn't use a seed phrase. edit/ To clarify: Yes, this is a stupid practice. You should be doing this locally or ideally not at all. But thinking Google is stealing your coins is a pretty big stretch.

YeahSureWhyNot 8y ago

the crypto tech was marketed as the most secure financial instrument but so far it has been repeatedly proving itself to be quite the opposite:)

anjc 8y ago

Between people losing their keyphrase, to software wallets being hacked, to hardware wallets being compromised...at what point is it more safe to just keep your coins on a reputable, insured, exchange? I think the odds of Coinbase doing a Mt. Gox are a lot more slim than the odds of a random person screwing up their own storage solution.

AgentME 8y ago
>to hardware wallets being compromised The only hardware wallet compromises I've heard of still required someone to have physical access to the device. If you can keep the device in your possession, it's still much safer than any of the alternatives.

MusaTheRedGuard 8y ago

This entire thread: "Why don't you just use the post office why do you need email?"

dontbenebby 8y ago

Why would you spell check a password? Passphrases are in vogue, but a field whose very mature is to be high entropy probably doesn't conform to traditional spelling/grammar...

arisAlexis 8y ago

so if an unknown mail provider in Zimbabwe gets hacked email is insecure. Logical