13 ms·

Iota cryptocurrency shuts down entire network after wallet hack

202 points by miked85 7y ago

bfrog 7y ago
What was the purpose of iota anyways, last I looked I couldn't get past the marketing speak.
malux85 7y ago
Good thing there is a centralised node controlled by a single authority Facepalm
- bilekas 7y ago
  It has been known for years that it was not a truely decentralised currency, ironically enough, they probably had some good foresight to retain that auth node.
  - malux85 7y ago
    NO! Absolutely not! They should let the network govern itself because thats one of the main differentiators (for better or worse) of crypto. This always happens with crypto - there's a hack, some people lose money and then the community vibe goes out the window and there's software patches, transactional rollback attempts, network forks, and so on. Part of the risk of a decentralised autonomous system is that it's DECENTRALISED AND AUTONOMOUS. If you lose money because of a hack THATS PART OF YOUR RISK PROFILE. DEAL WITH IT. Having a centralized node with a single authority mitigates some of the uncomfortableness of the original hack, and might get some or all of the money back - but the cost of that is undermining the entire network ethos. This currency is a single issuing authority who can dictate the rules when it suits them and pull the plug if things get uncomfortable.
    - perl4ever 7y ago
      "THATS PART OF YOUR RISK PROFILE. DEAL WITH IT" If you set up a libertarian community in which everything is privatized, and then one day your home catches on fire, but you don't pay for firefighting service, it sucks to be you, but is your neighbor* going to just say "that's part of your risk profile, deal with it"? Laws and philosophies are one thing, but there are predictions you can make about the actions of people separate from that, and so your rules and abstractions have to be compatible. *who shares a wall
      - amyjess 7y ago
        It's almost like cryptocurrency advocates are starting to discover the benefits of fiat currency and modern financial regulation one at a time.
        perl4ever 7y ago
        I mean, governments can collapse, fiat currency can fail, financial regulation can be corrupted, so it's entirely possible in ten years everybody will be using cryptocurrency, because everything else has gone to hell. In general I don't believe in trying to hedge against everything going wrong. I want to be rich in the future where money can buy, say, immortality or space travel, not in the Mad Max future where money just makes you a target.
        TylerE 7y ago
        It’s especially dumb when your “everything goes wrong” system requires power and the internet.
        perl4ever 7y ago
        I think this criticism is a bit off. We can see that there are places in the world today where the government and financial systems are really fucked, but people do use crypto, so it is conceivable that sort of situation will spread and take over the developed world. But it would be the new dark ages, not a glorious future. If it did happen, my hope is that like everything these days it would happen faster and be over sooner.
    - hnews_account_1 7y ago
      You guys realise that all crypto currencies can be programmed with rollbacks and shit using hard forks if they do find an extreme zero day exploit or something? The only difference between the decentralised ones and the centralised ones is that no one can actually stop a compromised chain from functioning while they deploy a hard fork. You can wake up one day to a severe ECDS bug and bitcoin will have to rollback anything that gets compromised afterwards (assuming it isn't a bug that makes the scheme trivially crackable and hence invalidates everything from the genesis block) as they patch up the software. It's not an unforeseen problem. You have to rely on the fact that the attackers also don't compromise your media outreach capabilities so you have no way of informing the world that the chain is no longer secure.
  - geofft 7y ago
    I hardly think that it's "good foresight" for a cryptocurrency to retain properties of centralized systems - unless you're saying that I have even better foresight by keeping all of my savings in fiat currency in the US financial system, which gives me all sorts of convenient properties like rollbacks and legal protections and FDIC insurance.
  - 101404 7y ago
    Some month ago they started to getting rid of it. Was just luck that they still have it now, when this NodeJS/NPM hack happened.
    - duskwuff 7y ago
      The IOTA Foundation has claimed to be working on removing their central coordinator since at least late 2018 [1]. As the expression goes, "rumors of its death are greatly exaggerated". [1]: https://blog.iota.org/coordinator-part-1-the-path-to-coordicide-ee4148a8db08 https://blog.iota.org/coordinator-part-1-the-path-to-coordic...
  - bawolff 7y ago
    Lol, not a "true decentralized currency" is sort of like saying north korea is not a "true democratic republic". Technically true but also misleading because the phrasing implies its sort of close to being there.
brazzy 7y ago
And this right here is why the very basic principle of a cryptocurrency is a terrible idea. You don't want decentralized anonymous immutable transactions for your money. You really, really don't.
- bilekas 7y ago
  > Don't want Thats not really an argument to make. Maybe you can say you "don't need" and make some arguments for that, but telling people what they don't want.. Doesn't seem helpful . Also > very basic principle of a cryptocurrency The BlockChain is a very good principle. But again I don't think you're sure the difference.
  - jmull 7y ago
    That idiom isn’t really about telling people what they want or don’t want. It means literally something like “it is not in your self-interest”.
  - brazzy 7y ago
    > Thats not really an argument to make. Maybe you can say you "don't need" and make some arguments for that, but telling people what they don't want.. Doesn't seem helpful. I stand by my statement. People certainly think they want those things, but they're wrong. Because they want them only until something like this happens and their money is gone because of an error someone else made. Then they suddenly want a way to get back their money a whole lot more, but it's impossible because of exactly those things they thought they wanted. > The BlockChain is a very good principle. It's a good principle for getting distributed, (possibly anonymous) immutable transactions. It's an absolutely terrible idea to apply that to money. I don't think anyone has yet found a practical application it's better suited for than all the alternatives. > But again I don't think you're sure the difference. I'm sure I understand the difference better than you.
- Glosster 7y ago
  Do you have any argument that makes sense?
tanastasiu 7y ago
This seems like fake news because there is no significant crash in the price.
- smt88 7y ago
  So you're saying ZDNet is quoting the tweets of an Iota imposter? Or is it more likely that markets of speculators aren't rational?
- tyingq 7y ago
  "within 25 minutes of receiving reports that hackers were stealing funds from user wallets, the IOTA Foundation shut down "Coordinator," a node in the IOTA network that puts the final seal of approval on any IOTA currency transactions." Hard for the price to crash when they shut down the network 25 minutes after the hack.
  - mihaifm 7y ago
    Trading on exchanges can still theoretically continue, it's just deposits and withdrawals that won't work.
    - Glosster 7y ago
      You must understand that people holding IOTA after the last network halt (which was ~45 days ago), aren't very bright.
- zelly 7y ago
  Altcoin prices do not depend on anyone using the software or the software even working. No one used it before it broke either.
- api 7y ago
  Cryptocurrency prices are fake for all but the top currencies, and even there it's fairly hand-wavey. The entire domain has been totally taken over by scams and ruined by get rich quick idiots. The bubble killed cryptocurrency.
simias 7y ago
For those who haven't been following the previous episodes, IOTA is the cryptocurrency that uses ternary logic because it supposedly makes it more efficient (it very much remains to be proven). The idea is to bring cryptocurrencies to embedded devices, which IMO like much of the cryptocurrency space is very much a solution in search of a problem. Didn't stop them from making a fortune with pre-mined coins during the cryptocurrency boom. I remember that a few years ago there was a lot of debate about whether IOTA was truly decentralized. Advocates were arguing basically that "it's not completely decentralized now but it will be soon". Well I guess we know were we're at right now.
- imglorp 7y ago
  Yeah the pre-mined coins were sketchy, and the ternary was dubious. I don't want the innovation to get lost in the bathwater though: the tangle datastructure was novel. Not an expert, but it was designed to allow for minimal proof of work while retaining some hashed auditability and tamper resistance. I think the key idea would be that you help hash several other blocks into transactions and then your transaction will get hashed by a few other workers. It didn't require heavy POW so it was more suitable for an embedded device to perform on the edge.
  - zitterbewegung 7y ago
    I read the white paper about a Tangle a few years ago. The design doesn't make sense because it doesn't seem like the network would be able to reach some kind of consensus at all. Also, rolling your own POW and making claims about that POW isn't some trivial thing. Hashcash was created in 1997 which is eleven years before bitcoin. Rolling your own crypto system isn't just something where you can just make one up and use in a production environment.
  - simias 7y ago
    Maybe it's the greatest thing since the invention of the Fourier transform but talk is cheap and it looks like despite being many years into development and having access to more cash than most startup would dream of they still haven't managed to make it work without a central node. Cryptocurrency startups sure seem to break things but they don't move very fast. I'll add it to the list of absolutely revolutionary blockchain technologies that are going to change the world [working implementation is left as an exercise for the reader].
dannyw 7y ago
It's not a real cryptocurrency if someone can shut the whole network down.
- bilekas 7y ago
  If you read the article, you would see that just the node with signs the transaction as legit was taken offline for the moment while they work on it. Your definition of crypto currency and decentralised currency is conflated too.
  - vinniejames 7y ago
    The very existence of "the node" makes it not a cryptocurrency
    - Uberphallus 7y ago
      It's a cryptocurrency, just not decentralized.
      - kim0 7y ago
        That makes it a PayPal not a crypto-currency
      - byte1918 7y ago
        I would have agreed with you but after checking wikipedia, decentralization is actually the first requirement for it to be called a cryptocurrency. > 1. The system does not require a central authority, its state is maintained through distributed consensus. https://en.wikipedia.org/wiki/Cryptocurrency#Formal_definition https://en.wikipedia.org/wiki/Cryptocurrency#Formal_definiti... https://www.merriam-webster.com/dictionary/cryptocurrency https://www.merriam-webster.com/dictionary/cryptocurrency
        true_religion 7y ago
        The codebase doesn't require a central authority, but in practice all keys for top level auth are held by the same entity.
Huycfhct 7y ago
It was always a scam for gullible fools
- Huycfhct 7y ago
  Beautiful website though. All these ICOs have nice marketing
  - vorpalhex 7y ago
    Well yeah, how else are you going to get investors past your hand-wavey technical-sounding nonsense? You could sell homeopathy to investors these days as long as it had a nice enough marketing website (see Goop).
    - perl4ever 7y ago
      I think you are downplaying how mainstream homeopathy is. I believe CVS has carried homeopathic OTC products for years. And I don't get the impression it particularly bothers most people. If you think the "placebo effect" is a thing, then homeopathy is justified even if the only person who believes in it is the patient. Someone might see this as moral/intellectual rot and corruption, but that seems kind of like a fringe, wild-eyed/haired attitude.
      - Nursie 7y ago
        > If you think the "placebo effect" is a thing, then homeopathy is justified even if the only person who believes in it is the patient. That depends really - some people are deterred from taking real medicine by homeopaths, and there have been a few high profile deaths where people had been persuaded that homeopathy was superior to, say, mainstream cancer treatments. Further, even if you believe that homeopathy is somehow a 'useful' placebo, that doesn't justify any of the claims of efficacy that are made about it. Unfortunately yes, it is quite mainstream and there are billion-dollar businesses making money from the gullible with this stuff.
        7y ago
Glosster 7y ago
NANO is what IOTA was trying to be. https://nano.org https://nano.org https://nanolinks.info https://nanolinks.info Some important differences: - it's actually decentralized, and there aren't any forces acting toward centralization - transaction times aren't 6 minutes, like in IOTA or BTC, they are SUB-SECOND
- _Kristijan_ 7y ago
  > NANO is what IOTA was trying to be. That's much too sweeping a statement. The Nano currency is a pure currency. IOTA on the other hand wants to sell itself as a data exchange layer for IoT. With emphasis on "wants" ... I would compare Nano more to what the early Bitcoin wanted to be: "A Peer-to-Peer Electronic Cash System" And yes, as such Nano is one of the most promising projects in the world of cryptocurrencies.
  - ValentineC 7y ago
    The first few exchanges that traded it were unfortunately the subject of hacks, and I'm still trying to figure out how someone managed to compromise my Nanowallet.io wallet when I believe I've taken reasonable measures to secure the key and seed.
    - oarsinsync 7y ago
      I can't speak for anything specific, but when it comes to crypto wallets, you should try to always use an offline application to generate your private keys. If you use an online application, it's very difficult to ensure your keys are truly private.
    - leppr 7y ago
      Download the wallet to your computer, most often than not these web wallets are open-source and available on Github. The problem with a web wallet is that since clients potentially re-download the app everytime they use it, the server can be compromised and malicious updates pushed silently, selectively, and make many victims in a short window of time. This has happened several times in the past: https://cointelegraph.com/news/myetherwallet-warns-that-a-couple-of-its-dns-servers-have-been-hacked https://cointelegraph.com/news/myetherwallet-warns-that-a-co... https://mashable.com/2017/12/21/etherdelta-hacked https://mashable.com/2017/12/21/etherdelta-hacked
ronsor 7y ago
I knew this coin would be a disaster, especially after the "tangle" issues and home-grown hash function[1]. Iota also relies on a central server[2]. So many others[3] have criticized it too. [1] https://medium.com/@neha/cryptographic-vulnerabilities-in-iota-9a6a9ddc4367 https://medium.com/@neha/cryptographic-vulnerabilities-in-io... [2] https://domschiener.gitbooks.io/iota-guide/content/chapter1/current-role-of-the-coordinator.html https://domschiener.gitbooks.io/iota-guide/content/chapter1/... [3] https://medium.com/@thedrbits/why-i-also-find-iota-deeply-alarming-99d4f2da3282 https://medium.com/@thedrbits/why-i-also-find-iota-deeply-al...
- akerro 7y ago
  It doesn't matter. IOTA isn't a cryptocurrency, but a decentralized messaging platform. Coin is a funding mechanism, it's more like matrix.org on financial steroids, rather than bitcoin.
  - duskwuff 7y ago
    Can you name any applications that are using this "decentralized messaging platform"? Or point to any technical demonstrations of its capabilities?
  - alfiedotwtf 7y ago
    "decentralized" > the IOTA Foundation shut down "Coordinator," FIFY: centralized
  - bawolff 7y ago
    Lol "on financial steroids" you say that as if it sounds like a good thing.
- 101404 7y ago
  Only that it had nothing to do with "the coin" but with NPM and its chaotic dependency system. What's bad about the tangle? Its like hundreds of interwoven blockchains. Pretty good idea. GIT too uses a directed acyclic graph.
messo 7y ago
The hack was apparently exploiting a vulnerability in a third-party dependency in the wallet app, which is built on node.js. All these dependencies that is used in the majority of modern apps seems like a huge security risk to me. They make rapid cross-platform development possible, but at what cost? Anyway; the network itself was not hacked, which is good I guess. And the coordinator (centralized node) is said to be the training wheels which will be removed at some point, but it still seems to be quite far of into the future.
- jsploit 7y ago
  One of the reasons I've stayed away from Node is the ridiculous attack surface brought by the npm ecosystem. It seems that even the simplest of projects end up with hundreds of dependencies - most having different maintainers and security practices.
  - johnisgood 7y ago
    How does it compare to Rust's cargo and its crates? The above mentioned "small package that do a single thing" philosophy is rampant there as well.
- mrtksn 7y ago
  I am somewhat pleased to see JS dependencies causing real-world problems and losses. I was so fed-up with the dependency hell, I switched to native programming. Especially programming for iOS using Swift is such a pleasure, we still have the concept of dependencies and external libraries but the Apple provided libraries are very rich so you would seldom need to import anything from the wild. After seeing the other side of the fence, I am quite surprised that anyone would make native apps with Node.JS. In the time you set up your dependencies for your Electron, ReactNative or whatever you can have your native macOS or iOS app UI running. Also, wouldn't spin the fan when running.
  - arsome 7y ago
    The biggest problem as a desktop app developer is that all the good UI libraries are barely maintained, obscure, questionably licensed or have limited 3rd party compatibility meaning you have to build too much from scratch yourself. This is why Electron has taken off so much lately for desktop development.
templain 7y ago
IdIOTAs on suicide watch, LINK is gonna save us sirs!
qertoip 7y ago
5 days of downtime and counting: https://status.iota.org/ https://status.iota.org/
catalogia 7y ago
It's a good thing cryptocurrencies aren't used for anything important.
cryptica 7y ago
Funny how even terrible, existential news barely affects the price of a cryptocurrency.
- koonsolo 7y ago
  Since the network is down, can this still be traded? I know exchanges use 1 big wallet, and internally keep track of who owns what. So in practice you would still be able to trade, just not able to add or request funds. But if all exchanges block trading, nothing can happen to the price can it?
  - mopsi 7y ago
    > Since the network is down, can this still be traded? Yes. Trading generally happens off-chain, simply by changing account balances in exchange's database. Actual on-chain transactions don't take place until funds are withdrawn from the exchange (which is why they should not be kept there for long - obvious hacking risk).
  - gruez 7y ago
    >Since the network is down, can this still be traded? All the major exchanges are showing volume, so yes it's still being traded. >But if all exchanges block trading, nothing can happen to the price can it? Not really. All that does is remove an "official" price, and make spread/confidence interval bigger. OTC trades (with trusted parties since the network is down) is always an option, so are derivatives like futures/options/cfds.
- gruez 7y ago
  The price dropped 20% between Feb 12 (when the network was shut down) and today, so I wouldn't call it "barely". I'm guessing all the current owners don't really care about the fundamentals so something like this isn't going to affect their outlook.
  - hnews_account_1 7y ago
    20% is a relatively small move for most crypto currencies. I don't follow iota's price history, but I'd assume this falls well within 2 sigma or something (even assuming returns follow a normal distn which seems suspect for most of these assets).
dutchbrit 7y ago
People tend to forget that this is alpha software - bugs happen. And re: centralization, decentralizing something too fast is the dumbest thing to do. Easier said than done, but it's something they've been working on for a while from what I've read. Last time this happened with Ethereum for example, they split the chain in Ethereum Classic and the "New" Ethereum. Also not an ideal scenario. At least they are transparent/actively working on fixing this issue.
- Nursie 7y ago
  > alpha software That they have been encouraging people to invest in and speculate on for years now.
3fe9a03ccd14ca5 7y ago
> the IOTA Foundation shut down "Coordinator," a node in the IOTA network that puts the final seal of approval on any IOTA currency transactions. Wait a minute... I thought cryptocurrencies were immune to manipulation, and decentralized?! /s
keenmaster 7y ago
Trust is a big part of a credible cryptocurrency. Can you really trust a currency that the vast majority of people don't understand? I don't think cryptos will ever take off without widespread institutional and gubernatorial support. Governments will probably issue cryptos themselves eventually. They are an opportunity for the government to create a centralized Federal Retail Bank that reduces the amount of rents and subsidies captured by commercial banks. Every citizen would have a free digital checking account, fully backed by the issuing government. When someone wants a loan, commercial banks and fintech companies would get temporary access to user data to compete on providing that loan. The data would only be used for that loan in particular, and it would be illegal to use it for any other purposes, or to retain it after the loan is done. The government cryptos would have to be as impermeable to hackers as your current digital bank account with (insert Big Bank here). Obviously, while such a system has tangible consumer benefits, it wouldn't be nearly as libertarian as Bitcoin.
- baby 7y ago
  I don't think your argument makes sense. People use things that they don't understand every day. Do you understand how a plane works? Or how the current banking system works? Or even how HTTPS and the CA system work?
  - keenmaster 7y ago
    People generally know how dollars work. They don’t know much about the monetary system from a macro standpoint, but a dollar is a dollar. There’s no wallet code on a flash drive that you can lose. There’s no weird pseudo-bank. There’s no mining (which adds huge transaction costs to the network). If a new VC-backed company called Mt. Zox said “keep your cryptos with us, we have the latest in crypto security. Here are all the virtually incomprehensible protections we have. Trust us, we’re better than the Other Guys” how can you fully evaluate them? Even if they have great standards on paper, how do you know that they will be upheld in practice? How do you know that there’s no backdoor for hackers or company founders to use? Even if you do all your research before investing, you’re still a sitting duck with the tail risk of capricious losses. My point isn’t that full understanding is a prerequisite for widespread crypto adoption. However, there is a “tangibility-trust” axis with currencies. The less tangible the currency is, the more trust is required in the issuing institution. Gold is more tangible than dollars. Physical dollars are more tangible than digital dollars. Digital dollars are more tangible than cryptos. Bitcoin took a step down in both intangibility and institutional trust. It is, essentially, a currency backed by full faith in speculation, illicit activity, asset hiding, and under the radar transactions. Side note: I changed “trust something” to “trust a currency” in my OP to be more specific.
seanwilson 7y ago
Is this the correct diff for the patch that tries to fix the wallet exploit? https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files... The commit removes these lines: - const script = document.createElement('script'); - script.src = 'https://cdn.moonpay.io/moonpay-sdk.js'; - - document.write(script.outerHTML);
jrpt 7y ago
For those who are wondering what happened, an attacker loaded malicious JavaScript through some compromised third party library. This isn't unique to cryptocurrency, although the permanence of crypto transactions makes it pretty concerning there. Similar Magecart type attacks have been stealing credit card numbers from websites including British Airways, Ticketmaster, or Macy's, right off the checkout page. Most sites still would have no idea if this were to happen to them today. That’s why I’ve developed Enchanted Security (https://enchantedsecurity.com/ https://enchantedsecurity.com/) - a client-side firewall that tracks the network requests and even blocks malicious ones. It’s like a network firewall but running on your users’ browsers. It can run on other JS platforms too, like Electron or React Native, which are commonly used for crypto wallets. Get in touch if you’re interested in learning more.
- bawolff 7y ago
  Bit of an unfair comparison there with csp on your website there. You cite the article that most csp policies are ineffective at preventing xss, but xss and data exfilitration are different things, and csp policies that are ineffective at blocking xss are often effective at blocking data exfiltration.
alfiedotwtf 7y ago
> the IOTA Foundation shut down "Coordinator," If a single org can shut down a cryptocurrency, you might as well use PayPal.
bawolff 7y ago
Everyone concentrating on iota being a bs cryptocurrency. Which fair enough but i think that kind of burries the actual story: People trying to make a currency involving large sums of money don't even have the security controls to check they are not loading malicous dependencies from npm! This is not some fancy crypto hack, this is plain old boring compromised dependency from an ecosystem with a reputation for high profile compromises.
- timdorr 7y ago
  Actually, it's way worse than that. They were directly loading code from someone's CDN: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files...
  - mdni007 7y ago
    It really can't get any dumber than that
RichardHeart 7y ago
If you don't mind lots of cursing, I think I sum up IOTA pretty well here. https://www.youtube.com/watch?v=h6C5DJGg4Lg https://www.youtube.com/watch?v=h6C5DJGg4Lg

202 points by miked85 7y ago

bfrog 7y ago

What was the purpose of iota anyways, last I looked I couldn't get past the marketing speak.

malux85 7y ago

Good thing there is a centralised node controlled by a single authority Facepalm

bilekas 7y ago
It has been known for years that it was not a truely decentralised currency, ironically enough, they probably had some good foresight to retain that auth node.
- malux85 7y ago
  NO! Absolutely not! They should let the network govern itself because thats one of the main differentiators (for better or worse) of crypto. This always happens with crypto - there's a hack, some people lose money and then the community vibe goes out the window and there's software patches, transactional rollback attempts, network forks, and so on. Part of the risk of a decentralised autonomous system is that it's DECENTRALISED AND AUTONOMOUS. If you lose money because of a hack THATS PART OF YOUR RISK PROFILE. DEAL WITH IT. Having a centralized node with a single authority mitigates some of the uncomfortableness of the original hack, and might get some or all of the money back - but the cost of that is undermining the entire network ethos. This currency is a single issuing authority who can dictate the rules when it suits them and pull the plug if things get uncomfortable.
  - perl4ever 7y ago
    "THATS PART OF YOUR RISK PROFILE. DEAL WITH IT" If you set up a libertarian community in which everything is privatized, and then one day your home catches on fire, but you don't pay for firefighting service, it sucks to be you, but is your neighbor* going to just say "that's part of your risk profile, deal with it"? Laws and philosophies are one thing, but there are predictions you can make about the actions of people separate from that, and so your rules and abstractions have to be compatible. *who shares a wall
    - amyjess 7y ago
      It's almost like cryptocurrency advocates are starting to discover the benefits of fiat currency and modern financial regulation one at a time.
      - perl4ever 7y ago
        I mean, governments can collapse, fiat currency can fail, financial regulation can be corrupted, so it's entirely possible in ten years everybody will be using cryptocurrency, because everything else has gone to hell. In general I don't believe in trying to hedge against everything going wrong. I want to be rich in the future where money can buy, say, immortality or space travel, not in the Mad Max future where money just makes you a target.
        TylerE 7y ago
        It’s especially dumb when your “everything goes wrong” system requires power and the internet.
        perl4ever 7y ago
        I think this criticism is a bit off. We can see that there are places in the world today where the government and financial systems are really fucked, but people do use crypto, so it is conceivable that sort of situation will spread and take over the developed world. But it would be the new dark ages, not a glorious future. If it did happen, my hope is that like everything these days it would happen faster and be over sooner.
  - hnews_account_1 7y ago
    You guys realise that all crypto currencies can be programmed with rollbacks and shit using hard forks if they do find an extreme zero day exploit or something? The only difference between the decentralised ones and the centralised ones is that no one can actually stop a compromised chain from functioning while they deploy a hard fork. You can wake up one day to a severe ECDS bug and bitcoin will have to rollback anything that gets compromised afterwards (assuming it isn't a bug that makes the scheme trivially crackable and hence invalidates everything from the genesis block) as they patch up the software. It's not an unforeseen problem. You have to rely on the fact that the attackers also don't compromise your media outreach capabilities so you have no way of informing the world that the chain is no longer secure.
- geofft 7y ago
  I hardly think that it's "good foresight" for a cryptocurrency to retain properties of centralized systems - unless you're saying that I have even better foresight by keeping all of my savings in fiat currency in the US financial system, which gives me all sorts of convenient properties like rollbacks and legal protections and FDIC insurance.
- 101404 7y ago
  Some month ago they started to getting rid of it. Was just luck that they still have it now, when this NodeJS/NPM hack happened.
  - duskwuff 7y ago
    The IOTA Foundation has claimed to be working on removing their central coordinator since at least late 2018 [1]. As the expression goes, "rumors of its death are greatly exaggerated". [1]: https://blog.iota.org/coordinator-part-1-the-path-to-coordicide-ee4148a8db08 https://blog.iota.org/coordinator-part-1-the-path-to-coordic...
- bawolff 7y ago
  Lol, not a "true decentralized currency" is sort of like saying north korea is not a "true democratic republic". Technically true but also misleading because the phrasing implies its sort of close to being there.

brazzy 7y ago

And this right here is why the very basic principle of a cryptocurrency is a terrible idea. You don't want decentralized anonymous immutable transactions for your money. You really, really don't.

bilekas 7y ago
> Don't want Thats not really an argument to make. Maybe you can say you "don't need" and make some arguments for that, but telling people what they don't want.. Doesn't seem helpful . Also > very basic principle of a cryptocurrency The BlockChain is a very good principle. But again I don't think you're sure the difference.
- jmull 7y ago
  That idiom isn’t really about telling people what they want or don’t want. It means literally something like “it is not in your self-interest”.
- brazzy 7y ago
  > Thats not really an argument to make. Maybe you can say you "don't need" and make some arguments for that, but telling people what they don't want.. Doesn't seem helpful. I stand by my statement. People certainly think they want those things, but they're wrong. Because they want them only until something like this happens and their money is gone because of an error someone else made. Then they suddenly want a way to get back their money a whole lot more, but it's impossible because of exactly those things they thought they wanted. > The BlockChain is a very good principle. It's a good principle for getting distributed, (possibly anonymous) immutable transactions. It's an absolutely terrible idea to apply that to money. I don't think anyone has yet found a practical application it's better suited for than all the alternatives. > But again I don't think you're sure the difference. I'm sure I understand the difference better than you.
Glosster 7y ago
Do you have any argument that makes sense?

tanastasiu 7y ago

This seems like fake news because there is no significant crash in the price.

smt88 7y ago
So you're saying ZDNet is quoting the tweets of an Iota imposter? Or is it more likely that markets of speculators aren't rational?
tyingq 7y ago
"within 25 minutes of receiving reports that hackers were stealing funds from user wallets, the IOTA Foundation shut down "Coordinator," a node in the IOTA network that puts the final seal of approval on any IOTA currency transactions." Hard for the price to crash when they shut down the network 25 minutes after the hack.
- mihaifm 7y ago
  Trading on exchanges can still theoretically continue, it's just deposits and withdrawals that won't work.
  - Glosster 7y ago
    You must understand that people holding IOTA after the last network halt (which was ~45 days ago), aren't very bright.
zelly 7y ago
Altcoin prices do not depend on anyone using the software or the software even working. No one used it before it broke either.
api 7y ago
Cryptocurrency prices are fake for all but the top currencies, and even there it's fairly hand-wavey. The entire domain has been totally taken over by scams and ruined by get rich quick idiots. The bubble killed cryptocurrency.

simias 7y ago

For those who haven't been following the previous episodes, IOTA is the cryptocurrency that uses ternary logic because it supposedly makes it more efficient (it very much remains to be proven). The idea is to bring cryptocurrencies to embedded devices, which IMO like much of the cryptocurrency space is very much a solution in search of a problem. Didn't stop them from making a fortune with pre-mined coins during the cryptocurrency boom. I remember that a few years ago there was a lot of debate about whether IOTA was truly decentralized. Advocates were arguing basically that "it's not completely decentralized now but it will be soon". Well I guess we know were we're at right now.

imglorp 7y ago
Yeah the pre-mined coins were sketchy, and the ternary was dubious. I don't want the innovation to get lost in the bathwater though: the tangle datastructure was novel. Not an expert, but it was designed to allow for minimal proof of work while retaining some hashed auditability and tamper resistance. I think the key idea would be that you help hash several other blocks into transactions and then your transaction will get hashed by a few other workers. It didn't require heavy POW so it was more suitable for an embedded device to perform on the edge.
- zitterbewegung 7y ago
  I read the white paper about a Tangle a few years ago. The design doesn't make sense because it doesn't seem like the network would be able to reach some kind of consensus at all. Also, rolling your own POW and making claims about that POW isn't some trivial thing. Hashcash was created in 1997 which is eleven years before bitcoin. Rolling your own crypto system isn't just something where you can just make one up and use in a production environment.
- simias 7y ago
  Maybe it's the greatest thing since the invention of the Fourier transform but talk is cheap and it looks like despite being many years into development and having access to more cash than most startup would dream of they still haven't managed to make it work without a central node. Cryptocurrency startups sure seem to break things but they don't move very fast. I'll add it to the list of absolutely revolutionary blockchain technologies that are going to change the world [working implementation is left as an exercise for the reader].

dannyw 7y ago

It's not a real cryptocurrency if someone can shut the whole network down.

bilekas 7y ago
If you read the article, you would see that just the node with signs the transaction as legit was taken offline for the moment while they work on it. Your definition of crypto currency and decentralised currency is conflated too.
- vinniejames 7y ago
  The very existence of "the node" makes it not a cryptocurrency
  - Uberphallus 7y ago
    It's a cryptocurrency, just not decentralized.
    - kim0 7y ago
      That makes it a PayPal not a crypto-currency
    - byte1918 7y ago
      I would have agreed with you but after checking wikipedia, decentralization is actually the first requirement for it to be called a cryptocurrency. > 1. The system does not require a central authority, its state is maintained through distributed consensus. https://en.wikipedia.org/wiki/Cryptocurrency#Formal_definition https://en.wikipedia.org/wiki/Cryptocurrency#Formal_definiti... https://www.merriam-webster.com/dictionary/cryptocurrency https://www.merriam-webster.com/dictionary/cryptocurrency
      - true_religion 7y ago
        The codebase doesn't require a central authority, but in practice all keys for top level auth are held by the same entity.

Huycfhct 7y ago

It was always a scam for gullible fools

Huycfhct 7y ago
Beautiful website though. All these ICOs have nice marketing
- vorpalhex 7y ago
  Well yeah, how else are you going to get investors past your hand-wavey technical-sounding nonsense? You could sell homeopathy to investors these days as long as it had a nice enough marketing website (see Goop).
  - perl4ever 7y ago
    I think you are downplaying how mainstream homeopathy is. I believe CVS has carried homeopathic OTC products for years. And I don't get the impression it particularly bothers most people. If you think the "placebo effect" is a thing, then homeopathy is justified even if the only person who believes in it is the patient. Someone might see this as moral/intellectual rot and corruption, but that seems kind of like a fringe, wild-eyed/haired attitude.
    - Nursie 7y ago
      > If you think the "placebo effect" is a thing, then homeopathy is justified even if the only person who believes in it is the patient. That depends really - some people are deterred from taking real medicine by homeopaths, and there have been a few high profile deaths where people had been persuaded that homeopathy was superior to, say, mainstream cancer treatments. Further, even if you believe that homeopathy is somehow a 'useful' placebo, that doesn't justify any of the claims of efficacy that are made about it. Unfortunately yes, it is quite mainstream and there are billion-dollar businesses making money from the gullible with this stuff.
      - 7y ago

Glosster 7y ago

NANO is what IOTA was trying to be. https://nano.org https://nano.org https://nanolinks.info https://nanolinks.info Some important differences: - it's actually decentralized, and there aren't any forces acting toward centralization - transaction times aren't 6 minutes, like in IOTA or BTC, they are SUB-SECOND

_Kristijan_ 7y ago
> NANO is what IOTA was trying to be. That's much too sweeping a statement. The Nano currency is a pure currency. IOTA on the other hand wants to sell itself as a data exchange layer for IoT. With emphasis on "wants" ... I would compare Nano more to what the early Bitcoin wanted to be: "A Peer-to-Peer Electronic Cash System" And yes, as such Nano is one of the most promising projects in the world of cryptocurrencies.
- ValentineC 7y ago
  The first few exchanges that traded it were unfortunately the subject of hacks, and I'm still trying to figure out how someone managed to compromise my Nanowallet.io wallet when I believe I've taken reasonable measures to secure the key and seed.
  - oarsinsync 7y ago
    I can't speak for anything specific, but when it comes to crypto wallets, you should try to always use an offline application to generate your private keys. If you use an online application, it's very difficult to ensure your keys are truly private.
  - leppr 7y ago
    Download the wallet to your computer, most often than not these web wallets are open-source and available on Github. The problem with a web wallet is that since clients potentially re-download the app everytime they use it, the server can be compromised and malicious updates pushed silently, selectively, and make many victims in a short window of time. This has happened several times in the past: https://cointelegraph.com/news/myetherwallet-warns-that-a-couple-of-its-dns-servers-have-been-hacked https://cointelegraph.com/news/myetherwallet-warns-that-a-co... https://mashable.com/2017/12/21/etherdelta-hacked https://mashable.com/2017/12/21/etherdelta-hacked

ronsor 7y ago

I knew this coin would be a disaster, especially after the "tangle" issues and home-grown hash function[1]. Iota also relies on a central server[2]. So many others[3] have criticized it too. [1] https://medium.com/@neha/cryptographic-vulnerabilities-in-iota-9a6a9ddc4367 https://medium.com/@neha/cryptographic-vulnerabilities-in-io... [2] https://domschiener.gitbooks.io/iota-guide/content/chapter1/current-role-of-the-coordinator.html https://domschiener.gitbooks.io/iota-guide/content/chapter1/... [3] https://medium.com/@thedrbits/why-i-also-find-iota-deeply-alarming-99d4f2da3282 https://medium.com/@thedrbits/why-i-also-find-iota-deeply-al...

akerro 7y ago
It doesn't matter. IOTA isn't a cryptocurrency, but a decentralized messaging platform. Coin is a funding mechanism, it's more like matrix.org on financial steroids, rather than bitcoin.
- duskwuff 7y ago
  Can you name any applications that are using this "decentralized messaging platform"? Or point to any technical demonstrations of its capabilities?
- alfiedotwtf 7y ago
  "decentralized" > the IOTA Foundation shut down "Coordinator," FIFY: centralized
- bawolff 7y ago
  Lol "on financial steroids" you say that as if it sounds like a good thing.
101404 7y ago
Only that it had nothing to do with "the coin" but with NPM and its chaotic dependency system. What's bad about the tangle? Its like hundreds of interwoven blockchains. Pretty good idea. GIT too uses a directed acyclic graph.

messo 7y ago

The hack was apparently exploiting a vulnerability in a third-party dependency in the wallet app, which is built on node.js. All these dependencies that is used in the majority of modern apps seems like a huge security risk to me. They make rapid cross-platform development possible, but at what cost? Anyway; the network itself was not hacked, which is good I guess. And the coordinator (centralized node) is said to be the training wheels which will be removed at some point, but it still seems to be quite far of into the future.

jsploit 7y ago
One of the reasons I've stayed away from Node is the ridiculous attack surface brought by the npm ecosystem. It seems that even the simplest of projects end up with hundreds of dependencies - most having different maintainers and security practices.
- johnisgood 7y ago
  How does it compare to Rust's cargo and its crates? The above mentioned "small package that do a single thing" philosophy is rampant there as well.
mrtksn 7y ago
I am somewhat pleased to see JS dependencies causing real-world problems and losses. I was so fed-up with the dependency hell, I switched to native programming. Especially programming for iOS using Swift is such a pleasure, we still have the concept of dependencies and external libraries but the Apple provided libraries are very rich so you would seldom need to import anything from the wild. After seeing the other side of the fence, I am quite surprised that anyone would make native apps with Node.JS. In the time you set up your dependencies for your Electron, ReactNative or whatever you can have your native macOS or iOS app UI running. Also, wouldn't spin the fan when running.
- arsome 7y ago
  The biggest problem as a desktop app developer is that all the good UI libraries are barely maintained, obscure, questionably licensed or have limited 3rd party compatibility meaning you have to build too much from scratch yourself. This is why Electron has taken off so much lately for desktop development.

templain 7y ago

IdIOTAs on suicide watch, LINK is gonna save us sirs!

qertoip 7y ago

5 days of downtime and counting: https://status.iota.org/ https://status.iota.org/

catalogia 7y ago

It's a good thing cryptocurrencies aren't used for anything important.

cryptica 7y ago

Funny how even terrible, existential news barely affects the price of a cryptocurrency.

koonsolo 7y ago
Since the network is down, can this still be traded? I know exchanges use 1 big wallet, and internally keep track of who owns what. So in practice you would still be able to trade, just not able to add or request funds. But if all exchanges block trading, nothing can happen to the price can it?
- mopsi 7y ago
  > Since the network is down, can this still be traded? Yes. Trading generally happens off-chain, simply by changing account balances in exchange's database. Actual on-chain transactions don't take place until funds are withdrawn from the exchange (which is why they should not be kept there for long - obvious hacking risk).
- gruez 7y ago
  >Since the network is down, can this still be traded? All the major exchanges are showing volume, so yes it's still being traded. >But if all exchanges block trading, nothing can happen to the price can it? Not really. All that does is remove an "official" price, and make spread/confidence interval bigger. OTC trades (with trusted parties since the network is down) is always an option, so are derivatives like futures/options/cfds.
gruez 7y ago
The price dropped 20% between Feb 12 (when the network was shut down) and today, so I wouldn't call it "barely". I'm guessing all the current owners don't really care about the fundamentals so something like this isn't going to affect their outlook.
- hnews_account_1 7y ago
  20% is a relatively small move for most crypto currencies. I don't follow iota's price history, but I'd assume this falls well within 2 sigma or something (even assuming returns follow a normal distn which seems suspect for most of these assets).

dutchbrit 7y ago

People tend to forget that this is alpha software - bugs happen. And re: centralization, decentralizing something too fast is the dumbest thing to do. Easier said than done, but it's something they've been working on for a while from what I've read. Last time this happened with Ethereum for example, they split the chain in Ethereum Classic and the "New" Ethereum. Also not an ideal scenario. At least they are transparent/actively working on fixing this issue.

Nursie 7y ago
> alpha software That they have been encouraging people to invest in and speculate on for years now.

3fe9a03ccd14ca5 7y ago

> the IOTA Foundation shut down "Coordinator," a node in the IOTA network that puts the final seal of approval on any IOTA currency transactions. Wait a minute... I thought cryptocurrencies were immune to manipulation, and decentralized?! /s

keenmaster 7y ago

Trust is a big part of a credible cryptocurrency. Can you really trust a currency that the vast majority of people don't understand? I don't think cryptos will ever take off without widespread institutional and gubernatorial support. Governments will probably issue cryptos themselves eventually. They are an opportunity for the government to create a centralized Federal Retail Bank that reduces the amount of rents and subsidies captured by commercial banks. Every citizen would have a free digital checking account, fully backed by the issuing government. When someone wants a loan, commercial banks and fintech companies would get temporary access to user data to compete on providing that loan. The data would only be used for that loan in particular, and it would be illegal to use it for any other purposes, or to retain it after the loan is done. The government cryptos would have to be as impermeable to hackers as your current digital bank account with (insert Big Bank here). Obviously, while such a system has tangible consumer benefits, it wouldn't be nearly as libertarian as Bitcoin.

baby 7y ago
I don't think your argument makes sense. People use things that they don't understand every day. Do you understand how a plane works? Or how the current banking system works? Or even how HTTPS and the CA system work?
- keenmaster 7y ago
  People generally know how dollars work. They don’t know much about the monetary system from a macro standpoint, but a dollar is a dollar. There’s no wallet code on a flash drive that you can lose. There’s no weird pseudo-bank. There’s no mining (which adds huge transaction costs to the network). If a new VC-backed company called Mt. Zox said “keep your cryptos with us, we have the latest in crypto security. Here are all the virtually incomprehensible protections we have. Trust us, we’re better than the Other Guys” how can you fully evaluate them? Even if they have great standards on paper, how do you know that they will be upheld in practice? How do you know that there’s no backdoor for hackers or company founders to use? Even if you do all your research before investing, you’re still a sitting duck with the tail risk of capricious losses. My point isn’t that full understanding is a prerequisite for widespread crypto adoption. However, there is a “tangibility-trust” axis with currencies. The less tangible the currency is, the more trust is required in the issuing institution. Gold is more tangible than dollars. Physical dollars are more tangible than digital dollars. Digital dollars are more tangible than cryptos. Bitcoin took a step down in both intangibility and institutional trust. It is, essentially, a currency backed by full faith in speculation, illicit activity, asset hiding, and under the radar transactions. Side note: I changed “trust something” to “trust a currency” in my OP to be more specific.

seanwilson 7y ago

Is this the correct diff for the patch that tries to fix the wallet exploit? https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files... The commit removes these lines: - const script = document.createElement('script'); - script.src = 'https://cdn.moonpay.io/moonpay-sdk.js'; - - document.write(script.outerHTML);

jrpt 7y ago

For those who are wondering what happened, an attacker loaded malicious JavaScript through some compromised third party library. This isn't unique to cryptocurrency, although the permanence of crypto transactions makes it pretty concerning there. Similar Magecart type attacks have been stealing credit card numbers from websites including British Airways, Ticketmaster, or Macy's, right off the checkout page. Most sites still would have no idea if this were to happen to them today. That’s why I’ve developed Enchanted Security (https://enchantedsecurity.com/ https://enchantedsecurity.com/) - a client-side firewall that tracks the network requests and even blocks malicious ones. It’s like a network firewall but running on your users’ browsers. It can run on other JS platforms too, like Electron or React Native, which are commonly used for crypto wallets. Get in touch if you’re interested in learning more.

bawolff 7y ago
Bit of an unfair comparison there with csp on your website there. You cite the article that most csp policies are ineffective at preventing xss, but xss and data exfilitration are different things, and csp policies that are ineffective at blocking xss are often effective at blocking data exfiltration.

alfiedotwtf 7y ago

> the IOTA Foundation shut down "Coordinator," If a single org can shut down a cryptocurrency, you might as well use PayPal.

bawolff 7y ago

Everyone concentrating on iota being a bs cryptocurrency. Which fair enough but i think that kind of burries the actual story: People trying to make a currency involving large sums of money don't even have the security controls to check they are not loading malicous dependencies from npm! This is not some fancy crypto hack, this is plain old boring compromised dependency from an ecosystem with a reputation for high profile compromises.

timdorr 7y ago
Actually, it's way worse than that. They were directly loading code from someone's CDN: https://github.com/iotaledger/trinity-wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38 https://github.com/iotaledger/trinity-wallet/pull/2565/files...
- mdni007 7y ago
  It really can't get any dumber than that

RichardHeart 7y ago

If you don't mind lots of cursing, I think I sum up IOTA pretty well here. https://www.youtube.com/watch?v=h6C5DJGg4Lg https://www.youtube.com/watch?v=h6C5DJGg4Lg