4 ms·

It's not an exploit. It's a vulnerability baked in the wallet app source code. There's a difference. The article seems to have been written by someone who has

by ccnafr 8y ago

It's not an exploit. It's a vulnerability baked in the wallet app source code. There's a difference. The article seems to have been written by someone who has a poor grasp on security terms. I'd recommend reading the researcher's write-up and avoid getting the wrong idea of what's happening there: https://www.avoid-coinomi.com/ https://www.avoid-coinomi.com/

Dirlewanger 8y ago
Yup, not saying that if Coinomi was open source this wouldn't have happened...but, chances are someone would have caught this if it was.
- AgentME 8y ago
  All I can think is who the hell even uses a closed source cryptocurrency wallet? I'm not completely an open source purist in all places, but if there's ever a place to be one, it's in cryptocurrency. You'd think people that wanted to hold money that they didn't trust to banks wouldn't then trust that money to a random unreviewed app. It frustrates me that unfamiliar people are going to see this article (or ones about random fly-by-night exchanges running away with deposits) and just come away thinking this type of problem is an unavoidable part of cryptocurrency, which it's not. Maybe it is for people who don't do their research, but I'm not telling them to use cryptocurrency. I hate that whenever there's talk about cryptocurrency, these amateur cases dominate the conversation. It'd be like if every time the act of camping was brought up, people were aghast and talked about how unsafe camping is and how it's a horrible thing because of how some family died camping recently (after they went camping in the middle of the desert without supplies).
- ryanlol 8y ago
  Why would access to the source have helped here? Presumably the code responsible for this is buried deep within some library they're using for the text field. It seems rather likely to me that something like this would never be spotted by looking at the source, you'd have to analyze the application at runtime.

by ccnafr 8y ago

Dirlewanger 8y ago

Yup, not saying that if Coinomi was open source this wouldn't have happened...but, chances are someone would have caught this if it was.

AgentME 8y ago
All I can think is who the hell even uses a closed source cryptocurrency wallet? I'm not completely an open source purist in all places, but if there's ever a place to be one, it's in cryptocurrency. You'd think people that wanted to hold money that they didn't trust to banks wouldn't then trust that money to a random unreviewed app. It frustrates me that unfamiliar people are going to see this article (or ones about random fly-by-night exchanges running away with deposits) and just come away thinking this type of problem is an unavoidable part of cryptocurrency, which it's not. Maybe it is for people who don't do their research, but I'm not telling them to use cryptocurrency. I hate that whenever there's talk about cryptocurrency, these amateur cases dominate the conversation. It'd be like if every time the act of camping was brought up, people were aghast and talked about how unsafe camping is and how it's a horrible thing because of how some family died camping recently (after they went camping in the middle of the desert without supplies).
ryanlol 8y ago
Why would access to the source have helped here? Presumably the code responsible for this is buried deep within some library they're using for the text field. It seems rather likely to me that something like this would never be spotted by looking at the source, you'd have to analyze the application at runtime.