5 ms·

It sucks that this happened but in all honesty this is why I can't take anything "crypto currency" seriously yet, because the field absolutely refuses to accept

It sucks that this happened but in all honesty this is why I can't take anything "crypto currency" seriously yet, because the field absolutely refuses to accept that mistakes happen. Every developer will push some private key to a repo at some point in their career. It's not fun, and in every other case, you roll the keys, ensure nothing got compromised or moved (and almost everything is reversible), and move on. But in the crypto-currency world, you make *one mistake* and you are done. There's no recourse, no getting your money and/or assets back. And until this gaping hole is fixed, "crypto currencies" will never go mainstream.

thebean11 5y ago
> But in the crypto-currency world, you make one mistake and you are done. There's no recourse, no getting your money and/or assets back. What recourse do you suggest? There are already multi-sig, time locked wallets that can get around many of these issues, if users want to opt in to using them. But making transactions somehow reversible by default would kind of defeat the purpose. Reversible transactions are good for the sender but bad for the receiver. I don't see any way around that, a tradeoff must be made.
- ninepoints 5y ago
  Stating the obvious, but the recourse is to not bother with crypto at all and stick with insured and better safeguarded financial mechanisms.
  - thebean11 5y ago
    > better safeguarded Again, better safeguarded in some ways (or for some participants), less for others.
    - ninepoints 5y ago
      Hard to imagine how an economic system that has literally no real safeguards against wash trading is "safer" in any sense.
    - munk-a 5y ago
      This is the primary barrier to adoption and one that is, IMO, insurmountable. The ways in which traditional currency is safeguarded is far more important to most of the population. I completely understand some people's hesitancy around government regulation and it's totally sane given what some folks have lived through. But the consolidation of banking institutions in the real world is pretty clearly mirrored in the cryptoworld and that side of banking is already far less reliable than real world banking. Mt. Gox was a while ago, sure, but a lot of people lost a lot of money doing something that shouldn't have been dangerous. Most of the population trusts the government more than enough to protect themselves against this sort of blatant fraud and, at this point, I think most crypto currency is legitimately held by speculators which can create liquidity to drive transactions but which, on its own, does not a market make.
      - hdsjfg 5y ago
        >But the consolidation of banking institutions in the real world is pretty clearly mirrored in the cryptoworld and that side of banking is already far less reliable than real world banking. Crypto doesn't have "banking". Exchanges are fairly centralized, but it's a misuse of the technology to use an exchange for custody. There are some crypto lending platforms, but they are not banks. >...most crypto currency is legitimately held by speculators which can create liquidity to drive transactions but which, on its own, does not a market make. Liquidity is provided by market makers, who (by definition) are not holding or speculating.
        elefanten 5y ago
        Except for when those market makers also do a bunch of other things... such as holding and speculating.
        hdsjfg 5y ago
        Of course. Butlers aren't murderers, except for when they are!
- nradov 5y ago
  Cryptocurrency transactions are reversible through the legal system. If you violate a contract or commit fraud then I can sue you in civil court and get a judgment, which you'll have to satisfy by repaying the cryptocurrency (or fiat equivalent). Of course enforcing that judgment against a defendant in another country might be difficult.
viksit 5y ago
Curious to hear your perspective on this thought experiment. From TFA, the analogy seems to be a developer publishing an api key for a read/write access to a bank account (say, Plaid). If someone was to use this key to withdraw money from a checking account that has no two factor, and somehow use an atm to convert it to cash, what legal recourse would the owner of that account have? This seems to be less about crypto going mainstream and more about security mechanisms? or am I misunderstanding the premise here?
- chowells 5y ago
  They report the transaction as fraudulent to the bank and get their money back. It's basically automatic.
  - short12 5y ago
    Actual bank accounts/debit withdrawals can be more difficult than say a credit card theft. But even then it's not flat out impossible to recoup
323 5y ago
> There's no recourse, no getting your money and/or assets back. That's not true. You'll go to a court of law and you'll revert the transaction. Just like this guy did, where he went to the contract owners: > Thankfully I was also able to contact art blocks and OpenSea, who were able to transfer ownership of my projects to my hardware wallet. As much as I'd like my royalties and project ownership to be ironclad and locked into the smart contracts, centralization and individual discretion has its perks sometimes.
- NikolaNovak 5y ago
  It's important to understand that there's no group-think. There's no organization company or group that speaks with single voice. I recognize that there are as many thoughts and motivations and intents as there are people. But it still gets frustrating when in one discussion on cryptocurrencies, it's all about absolute freedom from government/law/court/companies/Authority/TheMan, and in another argument it's "just use courts/laws/government the way you always do". I understand different people have different approaches and points of view. It just feels like with crypto currencies, they cancel each other. (I also recognize I'm an ignorant outsider looking in) Edit: Indeed, as I wrote this, already a sibling comment made a completely opposite "Of course; too bad, so sad, irreversibility is the point" argument.
- snarf21 5y ago
  That's great for him but it kinda defeats the point of the blockchain being censorship resistant. And there have been tons of these like the DAO rollback. If a handful of people can just change the rules anytime they want, what's the point?
dogman144 5y ago
Plenty of existing precedent is out there for the network cooperating with peers to handle reversals. True - when that pattern occurs it is not particularly decentralized. I think what you'll see is the more privacy/anon you value in your transactions, the more you'll rely on no-givebacks network decisions. There is also plenty of precedent that companies can handle incredibly high SLAs, but "no fail" is not something that's targeted. Bitcoin has an 100% uptime record in this regard, but to your point I wonder what an acceptable/achievable SLA is for a p2p network like bitcoin.
yholio 5y ago
The problem here is not the instantaneous and irreversible financial consequences of badly written code. That's a feature, it makes crypto work like cash, a coin is a coin and won't magically evaporate from my wallet because PayPal or Youtube doesn't like my face. The problem is the lack of minimal KYC information and any link to real world identity. It what enables hackers to get close to 100% of the stolen sums with close to 0 risk. Most major crypto networks are essentially giant money laundry machines: cash goes in, anonymous transactions are made over the internet, cash goes out. Of course that when you combine the two, irreversibility and anonymity, you get the giant cluster-crap of scams, embezzlement, Ponzi schemes, narcotics trafficking and cyber-blackmail that the crypto space has become. If you want to fix crypto, the problem is not a tweak to the algorithm, it's the social rules that allow it to interface with the real world. We need to establish a minimal standard of how, when, and by whom can the real identity of a user be unblinded (think Chaum e-cash) and revealed for law enforcement - without compromising the privacy of all, like in the current banking system.
tgsovlerkhgsel 5y ago
In the "real world", the recourse you have against e.g. pickpocketing is similarly non-existent (in theory, you have recourse in both the pickpocket and the crypto theft case, in practice, you're getting recourse in neither). I'd argue that getting a software-only hotwallet stolen is comparable to getting pickpocketed or robbed of the cash you carry on you. The crypto world is special because this often involves much bigger amounts than people usually carry around in cash, and most importantly, people negligently leave huge amounts laying around with minimal security, often because a) it wasn't worth anything when they put it in the wallet but appreciated rapidly, or b) because it's a lot of money, but it's not a lot of money for them because they are now multi-millionaires. With a hardware wallet, it's much harder (not impossible) to make a mistake or get compromised.
- toss1 5y ago
  >>With a hardware wallet, it's much harder (not impossible) to make a mistake or get compromised. Of course, with a HW wallet, there are other footguns. I've read multiple sagas of attempted recovery from things like lost PWs, backups, etc., some successful, some not. And still the risk of HW itself being lost/stolen/destroyed/failed/etc. (&ya I understand that there are some recovery processes, which also must be balanced by how many recovery keys to create & leave around in 'safe' locations for such situations...) It's still a mess
recursive4 5y ago
Check out multi-sig, which transfigures this point of failure into a cooperation problem.

thebean11 5y ago

> But in the crypto-currency world, you make one mistake and you are done. There's no recourse, no getting your money and/or assets back. What recourse do you suggest? There are already multi-sig, time locked wallets that can get around many of these issues, if users want to opt in to using them. But making transactions somehow reversible by default would kind of defeat the purpose. Reversible transactions are good for the sender but bad for the receiver. I don't see any way around that, a tradeoff must be made.

ninepoints 5y ago
Stating the obvious, but the recourse is to not bother with crypto at all and stick with insured and better safeguarded financial mechanisms.
- thebean11 5y ago
  > better safeguarded Again, better safeguarded in some ways (or for some participants), less for others.
  - ninepoints 5y ago
    Hard to imagine how an economic system that has literally no real safeguards against wash trading is "safer" in any sense.
  - munk-a 5y ago
    This is the primary barrier to adoption and one that is, IMO, insurmountable. The ways in which traditional currency is safeguarded is far more important to most of the population. I completely understand some people's hesitancy around government regulation and it's totally sane given what some folks have lived through. But the consolidation of banking institutions in the real world is pretty clearly mirrored in the cryptoworld and that side of banking is already far less reliable than real world banking. Mt. Gox was a while ago, sure, but a lot of people lost a lot of money doing something that shouldn't have been dangerous. Most of the population trusts the government more than enough to protect themselves against this sort of blatant fraud and, at this point, I think most crypto currency is legitimately held by speculators which can create liquidity to drive transactions but which, on its own, does not a market make.
    - hdsjfg 5y ago
      >But the consolidation of banking institutions in the real world is pretty clearly mirrored in the cryptoworld and that side of banking is already far less reliable than real world banking. Crypto doesn't have "banking". Exchanges are fairly centralized, but it's a misuse of the technology to use an exchange for custody. There are some crypto lending platforms, but they are not banks. >...most crypto currency is legitimately held by speculators which can create liquidity to drive transactions but which, on its own, does not a market make. Liquidity is provided by market makers, who (by definition) are not holding or speculating.
      - elefanten 5y ago
        Except for when those market makers also do a bunch of other things... such as holding and speculating.
        hdsjfg 5y ago
        Of course. Butlers aren't murderers, except for when they are!
nradov 5y ago
Cryptocurrency transactions are reversible through the legal system. If you violate a contract or commit fraud then I can sue you in civil court and get a judgment, which you'll have to satisfy by repaying the cryptocurrency (or fiat equivalent). Of course enforcing that judgment against a defendant in another country might be difficult.

viksit 5y ago

Curious to hear your perspective on this thought experiment. From TFA, the analogy seems to be a developer publishing an api key for a read/write access to a bank account (say, Plaid). If someone was to use this key to withdraw money from a checking account that has no two factor, and somehow use an atm to convert it to cash, what legal recourse would the owner of that account have? This seems to be less about crypto going mainstream and more about security mechanisms? or am I misunderstanding the premise here?

chowells 5y ago
They report the transaction as fraudulent to the bank and get their money back. It's basically automatic.
- short12 5y ago
  Actual bank accounts/debit withdrawals can be more difficult than say a credit card theft. But even then it's not flat out impossible to recoup

323 5y ago

> There's no recourse, no getting your money and/or assets back. That's not true. You'll go to a court of law and you'll revert the transaction. Just like this guy did, where he went to the contract owners: > Thankfully I was also able to contact art blocks and OpenSea, who were able to transfer ownership of my projects to my hardware wallet. As much as I'd like my royalties and project ownership to be ironclad and locked into the smart contracts, centralization and individual discretion has its perks sometimes.

NikolaNovak 5y ago
It's important to understand that there's no group-think. There's no organization company or group that speaks with single voice. I recognize that there are as many thoughts and motivations and intents as there are people. But it still gets frustrating when in one discussion on cryptocurrencies, it's all about absolute freedom from government/law/court/companies/Authority/TheMan, and in another argument it's "just use courts/laws/government the way you always do". I understand different people have different approaches and points of view. It just feels like with crypto currencies, they cancel each other. (I also recognize I'm an ignorant outsider looking in) Edit: Indeed, as I wrote this, already a sibling comment made a completely opposite "Of course; too bad, so sad, irreversibility is the point" argument.
snarf21 5y ago
That's great for him but it kinda defeats the point of the blockchain being censorship resistant. And there have been tons of these like the DAO rollback. If a handful of people can just change the rules anytime they want, what's the point?

dogman144 5y ago

Plenty of existing precedent is out there for the network cooperating with peers to handle reversals. True - when that pattern occurs it is not particularly decentralized. I think what you'll see is the more privacy/anon you value in your transactions, the more you'll rely on no-givebacks network decisions. There is also plenty of precedent that companies can handle incredibly high SLAs, but "no fail" is not something that's targeted. Bitcoin has an 100% uptime record in this regard, but to your point I wonder what an acceptable/achievable SLA is for a p2p network like bitcoin.

yholio 5y ago

The problem here is not the instantaneous and irreversible financial consequences of badly written code. That's a feature, it makes crypto work like cash, a coin is a coin and won't magically evaporate from my wallet because PayPal or Youtube doesn't like my face. The problem is the lack of minimal KYC information and any link to real world identity. It what enables hackers to get close to 100% of the stolen sums with close to 0 risk. Most major crypto networks are essentially giant money laundry machines: cash goes in, anonymous transactions are made over the internet, cash goes out. Of course that when you combine the two, irreversibility and anonymity, you get the giant cluster-crap of scams, embezzlement, Ponzi schemes, narcotics trafficking and cyber-blackmail that the crypto space has become. If you want to fix crypto, the problem is not a tweak to the algorithm, it's the social rules that allow it to interface with the real world. We need to establish a minimal standard of how, when, and by whom can the real identity of a user be unblinded (think Chaum e-cash) and revealed for law enforcement - without compromising the privacy of all, like in the current banking system.

tgsovlerkhgsel 5y ago

In the "real world", the recourse you have against e.g. pickpocketing is similarly non-existent (in theory, you have recourse in both the pickpocket and the crypto theft case, in practice, you're getting recourse in neither). I'd argue that getting a software-only hotwallet stolen is comparable to getting pickpocketed or robbed of the cash you carry on you. The crypto world is special because this often involves much bigger amounts than people usually carry around in cash, and most importantly, people negligently leave huge amounts laying around with minimal security, often because a) it wasn't worth anything when they put it in the wallet but appreciated rapidly, or b) because it's a lot of money, but it's not a lot of money for them because they are now multi-millionaires. With a hardware wallet, it's much harder (not impossible) to make a mistake or get compromised.

toss1 5y ago
>>With a hardware wallet, it's much harder (not impossible) to make a mistake or get compromised. Of course, with a HW wallet, there are other footguns. I've read multiple sagas of attempted recovery from things like lost PWs, backups, etc., some successful, some not. And still the risk of HW itself being lost/stolen/destroyed/failed/etc. (&ya I understand that there are some recovery processes, which also must be balanced by how many recovery keys to create & leave around in 'safe' locations for such situations...) It's still a mess

recursive4 5y ago

Check out multi-sig, which transfigures this point of failure into a cooperation problem.