6 ms·
Also, there is a requirement for the hacker to actually publish the results of how they did it. Otherwise, you run the risk of the hacker just walking away with
by _red 7y ago
Also, there is a requirement for the hacker to actually publish the results of how they did it. Otherwise, you run the risk of the hacker just walking away with the funds or giving a bogus reason (after they've already spent the wallet).
Therefore, the wallets should be stored GPG encrypted in some published location. After the hacker has successfully penetrated and retrieved the file, they need to publish a "how I did it" document along with the hash of the GPG encrypted wallet.
Once devs have confirmed the vulnerabilities exist, they respond with the passphrase to decrypt the wallet.
- ipoopatwork 7y agoUnless I'm missing the joke, this is a bug bounty with extra steps.
- comboy 7y agoMy idea was to not require any explanations, so that blackhat could grab that wallet too. It's just about being able to say "this server is $1k secure". I think it's fantastic that we have a technology to do that. You still need some trust that private keys to given wallet are on the server, but apart from that, when you know there's $10,000 dollars on the server for anybody who can access it, it says something about how secure this machine is. Plus you get instant notification when the server is compromised. Not every hacker is kind enough to let you know.
- KiDD 7y agoI like this idea!
- ipoopatwork 7y agoHow would a blackhat grab the wallet if it's GPG encrypted and needs the passphrase from the dev?