6 ms·

This is both sad and dangerous. A person I know has recently found out that their Coinbase wallet is empty. She has not used it in about four years or so and is

This is both sad and dangerous. A person I know has recently found out that their Coinbase wallet is empty. She has not used it in about four years or so and is disheartened. So disheartened that I am encouraging her by taking a few actions to recover her assets.

judell 5y ago
I think about this a lot. This recent tweet from Simon Willison (https://twitter.com/simonw/status/1444071543902912513 https://twitter.com/simonw/status/1444071543902912513) really resonates: "One of the most obvious flaws in using blockchains for anything involving regular human beings is one I've not seen much discussion of: Regular human beings cannot protect their passwords, credentials or private keys. They just can't." I guess I'm not a regular human or I wouldn't have an AWS dev account, but I still hardly feel secure w/respect to the continuity of my various digital assets.
- chillfox 5y ago
  Just being aware of the risks and counters helps a lot. Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.
  - dna_polymerase 5y ago
    The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.
    - wahern 5y ago
      At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.
- encryptluks2 5y ago
  Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.
  - mhdhn 5y ago
    how do you do this, any hints?
    - daave 5y ago
      I use LastPass’s Emergency Access feature for this. You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period. There are written instructions for my next of kin on what to look for in the Vault. The main difficulty is if my next of kin forget their LastPass master password. I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.
      - elcritch 5y ago
        One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.
- sneak 5y ago
  Even users who know how generally fail to properly store, transmit, and authenticate key material. https://youtu.be/9k4GP3Evh9c https://youtu.be/9k4GP3Evh9c
  - dspillett 5y ago
    It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox. It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload). I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.
marcelnita 5y ago
Why do you think it's sad?
lmm 5y ago
Most things in life require regular maintenance or checking on. When my dad went to the garage and saw that some of the boxes of comics he'd left there for years had gotten damp, he was pretty sad, but ultimately accepted that that kind of thing is part of life. If this person wasn't using their "wallet" for four years it sounds like it wasn't a huge part of their life.
- ivalm 5y ago
  That’s not really a justification for a financial crime.
- mhdhn 5y ago
  what do you mean? it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value. why is it gone, that's not supposed to be possible unless credentials were gotten and funds stolen
  - sellyme 5y ago
    > it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value Did the promise of free money for doing nothing not seem slightly too good to be true to you?
    - kube-system 5y ago
      That strategy seems to work fine for my 401k
      - gowld 5y ago
        what happens when you lose your password, or move house so your address is no longer valid, or get a new cell phone number, or got married and changed your name, and you haven't updated your account in years?
        kube-system 5y ago

judell 5y ago

I think about this a lot. This recent tweet from Simon Willison (https://twitter.com/simonw/status/1444071543902912513 https://twitter.com/simonw/status/1444071543902912513) really resonates: "One of the most obvious flaws in using blockchains for anything involving regular human beings is one I've not seen much discussion of: Regular human beings cannot protect their passwords, credentials or private keys. They just can't." I guess I'm not a regular human or I wouldn't have an AWS dev account, but I still hardly feel secure w/respect to the continuity of my various digital assets.

chillfox 5y ago
Just being aware of the risks and counters helps a lot. Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.
- dna_polymerase 5y ago
  The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.
  - wahern 5y ago
    At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.
encryptluks2 5y ago
Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.
- mhdhn 5y ago
  how do you do this, any hints?
  - daave 5y ago
    I use LastPass’s Emergency Access feature for this. You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period. There are written instructions for my next of kin on what to look for in the Vault. The main difficulty is if my next of kin forget their LastPass master password. I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.
    - elcritch 5y ago
      One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.
sneak 5y ago
Even users who know how generally fail to properly store, transmit, and authenticate key material. https://youtu.be/9k4GP3Evh9c https://youtu.be/9k4GP3Evh9c
- dspillett 5y ago
  It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox. It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload). I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.

marcelnita 5y ago

Why do you think it's sad?

lmm 5y ago

Most things in life require regular maintenance or checking on. When my dad went to the garage and saw that some of the boxes of comics he'd left there for years had gotten damp, he was pretty sad, but ultimately accepted that that kind of thing is part of life. If this person wasn't using their "wallet" for four years it sounds like it wasn't a huge part of their life.

ivalm 5y ago
That’s not really a justification for a financial crime.
mhdhn 5y ago
what do you mean? it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value. why is it gone, that's not supposed to be possible unless credentials were gotten and funds stolen
- sellyme 5y ago
  > it was an asset, a long-term investment. it's just supposed to be able to sit there growing in value Did the promise of free money for doing nothing not seem slightly too good to be true to you?
  - kube-system 5y ago
    That strategy seems to work fine for my 401k
    - gowld 5y ago
      what happens when you lose your password, or move house so your address is no longer valid, or get a new cell phone number, or got married and changed your name, and you haven't updated your account in years?
      - kube-system 5y ago