4 ms·

Third sentence: > If only the wallet file was encrypted on the HD. Yep. Anyone who doesn't do this is stupid.

by cheez 15y ago

berberich 15y ago
I haven't used Bitcoin, so this is an honest question - Why doesn't the software encrypt the wallet automatically?
- cheez 15y ago
  Beats me. Probably one of those "get around to it later" things.
- nickik 15y ago
  Bitcoin is a Thesis of one Guy. Its great in many ways but in terms of Softwaredesing and Engeniering at least the Client sucks. I've the Auther had knew it would be blowing up like this he would probebly have build something better. Its Open Source and you can interact via JSON so it would be that hard to build a good client that does this kind of stuff.
- adrianwaj 15y ago
  It's in the works: http://goo.gl/XAiBr http://goo.gl/XAiBr and http://goo.gl/7HvQ4 http://goo.gl/7HvQ4 (see quote in #3)
- stuhood 15y ago
  See https://github.com/bitcoin/bitcoin/pull/232 https://github.com/bitcoin/bitcoin/pull/232
DrewHintz 15y ago
I doubt that encrypting the wallet on the HD would have helped much. It sounds like allinvain's computer was compromised. The attacker could have copied the decryption key when it was used legitimately by allinvain.
- Ixiaus 15y ago
  I put my wallet on an IronKey - I imagine that helps the situation.
  - recoiledsnake 15y ago
    Until you plug into a compromised computer and type the password? Or does it include protection against that?
    - Ixiaus 15y ago
      Well then I'm buggered. But the plan is to not plug into a compromised computer...
      - jonknee 15y ago
        Sounds like a plan... Why bother with the IronKey?
simias 15y ago
He then proceeds to say that he backed up his unencrypted wallet to "dropbox, wuala, and spideroak", which doesn't strike me as extremely clever when you're talking about something in the half a million price range. On the other end it's a good cautionary tale. I'm quite curious about this bitcoin thing, but this reminds me I definitely don't want to secure all my money myself without any insurance or guarantees. A stupid mistake and shazam you lost all your money. Regarding the issue of whether the application should encrypt the wallet by default, it'd probably be a good thing to have but I'm not sure it would have helped in this case. The wallet would have to be decrypted in order to mine or execute any transaction and the attacker was obviously targeting the bitcoin wallet specifically, so it could just have installed a keylogger or whatever to catch the passphrase, like they do with banking sites (or wait until the walled is decrypted and dump it then, or install a backdoored version of the bitcoin client...).
BoppreH 15y ago
Could a hacker move the file somewhere else and ask for ransom? If so, that's a lot easier to deal with than losing everything outright, but not risk proof.
- chwahoo 15y ago
  I don't see why a hacker would do this. They've already broken the law so this just increases their chances of being caught. If they wanted to be "nice", they could just have stolen fewer of the bitcoins.

Third sentence: > If only the wallet file was encrypted on the HD. Yep. Anyone who doesn't do this is stupid.

by cheez 15y ago

Third sentence: > If only the wallet file was encrypted on the HD. Yep. Anyone who doesn't do this is stupid.

berberich 15y ago

I haven't used Bitcoin, so this is an honest question - Why doesn't the software encrypt the wallet automatically?

cheez 15y ago
Beats me. Probably one of those "get around to it later" things.
nickik 15y ago
Bitcoin is a Thesis of one Guy. Its great in many ways but in terms of Softwaredesing and Engeniering at least the Client sucks. I've the Auther had knew it would be blowing up like this he would probebly have build something better. Its Open Source and you can interact via JSON so it would be that hard to build a good client that does this kind of stuff.
adrianwaj 15y ago
It's in the works: http://goo.gl/XAiBr http://goo.gl/XAiBr and http://goo.gl/7HvQ4 http://goo.gl/7HvQ4 (see quote in #3)
stuhood 15y ago
See https://github.com/bitcoin/bitcoin/pull/232 https://github.com/bitcoin/bitcoin/pull/232

DrewHintz 15y ago

I doubt that encrypting the wallet on the HD would have helped much. It sounds like allinvain's computer was compromised. The attacker could have copied the decryption key when it was used legitimately by allinvain.

Ixiaus 15y ago
I put my wallet on an IronKey - I imagine that helps the situation.
- recoiledsnake 15y ago
  Until you plug into a compromised computer and type the password? Or does it include protection against that?
  - Ixiaus 15y ago
    Well then I'm buggered. But the plan is to not plug into a compromised computer...
    - jonknee 15y ago
      Sounds like a plan... Why bother with the IronKey?

simias 15y ago

He then proceeds to say that he backed up his unencrypted wallet to "dropbox, wuala, and spideroak", which doesn't strike me as extremely clever when you're talking about something in the half a million price range. On the other end it's a good cautionary tale. I'm quite curious about this bitcoin thing, but this reminds me I definitely don't want to secure all my money myself without any insurance or guarantees. A stupid mistake and shazam you lost all your money. Regarding the issue of whether the application should encrypt the wallet by default, it'd probably be a good thing to have but I'm not sure it would have helped in this case. The wallet would have to be decrypted in order to mine or execute any transaction and the attacker was obviously targeting the bitcoin wallet specifically, so it could just have installed a keylogger or whatever to catch the passphrase, like they do with banking sites (or wait until the walled is decrypted and dump it then, or install a backdoored version of the bitcoin client...).

BoppreH 15y ago

Could a hacker move the file somewhere else and ask for ransom? If so, that's a lot easier to deal with than losing everything outright, but not risk proof.

chwahoo 15y ago
I don't see why a hacker would do this. They've already broken the law so this just increases their chances of being caught. If they wanted to be "nice", they could just have stolen fewer of the bitcoins.