4 ms·

There was another instance of a massive coin theft a year or so ago and the weak link again was the recovery seed being sent to a Google server. The guy describ

There was another instance of a massive coin theft a year or so ago and the weak link again was the recovery seed being sent to a Google server. The guy described his operational security and it seemed like he did everything right. The only slip up he could point to was that he had mistakenly pasted his seed into his Chrome address bar (which then performs an automatic lookup). It was shortly after that when his funds were drained. I'm certainly not saying it was someone at Google, but it would be a mistake to not consider them an adversary in the battle to secure your funds.

781 8y ago
A ton of people use GMail for their crypto accounts. Claiming that someone at Google stole the funds is quite an extraordinary claim. You should have more proof than just the seed being sent to their spellchecker.
- hackinthebochs 8y ago
  I'm not sure what the volume of gmail accounts is supposed to demonstrate. But gmail is known to be high value, and so it stands to reason that internal safeguards around access to gmail accounts would be much greater than data from a spellcheck API or search autocomplete. It certainly is an extraordinary claim, but there does come a point where the totality of evidence points to the likelihood of it. I'm not saying we're at that point, but in my mind we've reached the point of reasonably possible.
  - eridius 8y ago
    Spellcheck API or autocomplete is also expected to end up with a ton of sensitive information sent to it. I would expect them to either not keep logs of the actual query strings to begin with, or heavily restrict access to them.
cjbprime 8y ago
That's the weak link they knew about. It is very unlikely to be the actual weak link.
dontbenebby 8y ago
So, I'm not super familiar with crypto/blockchain beyond reading a couple academic papers but... how can you use it "offline"? I saw someone in the parent comments mention that using your phrase on a machine connected to the internet can be risky... how can you make use of those coins then? Do you download some onto a usb to manually transfer over?
- hackinthebochs 8y ago
  You identify yourself to the network as the legitimate owner of an address by signing a transaction with a private key for that address. So using your coins offline involves signing your transaction using a computer that is air-gapped and then manually transferring the signed transaction to the online computer to be pushed to the network. There are user friendly ways of doing this using QR codes and similar things.
  - dontbenebby 8y ago
    Thanks for the explanation.

781 8y ago

A ton of people use GMail for their crypto accounts. Claiming that someone at Google stole the funds is quite an extraordinary claim. You should have more proof than just the seed being sent to their spellchecker.

hackinthebochs 8y ago
I'm not sure what the volume of gmail accounts is supposed to demonstrate. But gmail is known to be high value, and so it stands to reason that internal safeguards around access to gmail accounts would be much greater than data from a spellcheck API or search autocomplete. It certainly is an extraordinary claim, but there does come a point where the totality of evidence points to the likelihood of it. I'm not saying we're at that point, but in my mind we've reached the point of reasonably possible.
- eridius 8y ago
  Spellcheck API or autocomplete is also expected to end up with a ton of sensitive information sent to it. I would expect them to either not keep logs of the actual query strings to begin with, or heavily restrict access to them.

cjbprime 8y ago

That's the weak link they knew about. It is very unlikely to be the actual weak link.

dontbenebby 8y ago

So, I'm not super familiar with crypto/blockchain beyond reading a couple academic papers but... how can you use it "offline"? I saw someone in the parent comments mention that using your phrase on a machine connected to the internet can be risky... how can you make use of those coins then? Do you download some onto a usb to manually transfer over?

hackinthebochs 8y ago
You identify yourself to the network as the legitimate owner of an address by signing a transaction with a private key for that address. So using your coins offline involves signing your transaction using a computer that is air-gapped and then manually transferring the signed transaction to the online computer to be pushed to the network. There are user friendly ways of doing this using QR codes and similar things.
- dontbenebby 8y ago
  Thanks for the explanation.