7 ms·

When random teen can easily steal $46M from a "Bitcoin pioneer" what hope is that for regular folks could make safe use of said value store?

Jerrrry 5y ago
The issue is that most communication is centralized between two companies, Verizon and ATT, and those companies have employees that are very, very fallible. We need to decentralize our communication infrastructure.
- mym1990 5y ago
  No real reason to point the finger at people at Verizon and ATT are more fallible than others. Almost anyone can fall for social engineering if done right/often enough. I know you probably think you're too smart to be fooled like that, but that's exactly how you'll fall to a scam.
  - Jerrrry 5y ago
    The people Verizon/ATT are more fallible, because of the implicit risk/threat model that is imposed on us by duopolistic infrastructure. They have vastly more power without the required training. This asymmetry makes them larger targets, and therefore, more fallible. ATT/Verizon employees are the weakest link in almost all threat models, including our national one. I don't think I am personally infallible; and I am/used to be the reason you have to take cyber, social engineer, and spear attack trainings every year. It is because I know the true weakest links (humans with unrelegated access) that compel me to remind others: do not use SMS for 2FA. There are other ways of getting the nonce/temporal secret to the end-user without pitting the security to a overworked 27 year old druggy CSR in upstate new york.
    - mym1990 5y ago
      Eh to be honest your whole argument fell apart as I read the last few words. Hope you change your outlook on the world, for your own good.
- mindslight 5y ago
  That's a problem for sure, but it's not the problem here. The problem here is cryptocurrency trustees implementing snake oil "2FA" using the PSTN, which was never intended to provide the needed security properties.
azth 5y ago
It will take some time for the infrastructure to mature.
- djbusby 5y ago
  And until then? We just say "oh, fraud, oh well"?
  - VWWHFSfQ 5y ago
    This is what banks and credit card companies do already. It's the cost of doing the business. If someone steals your credit card and uses it then you're not responsible, the bank is. And you get your money back. But there's no such recourse or security for individuals in this new system.
  - azth 5y ago
    Straw man argument.
- cactus2093 5y ago
  It's been 10 years, meanwhile everyone is hyping up how awesome and fast-moving the "web3" space is and how all the best developers have left their day jobs and are building for it. What's taking so long?
  - hanniabu 5y ago
    They're literally building all the foundational infrastructure from scratch. It took the web a long time to mature as well.
    - astoor 5y ago
      web3.js has been around for at least 5 years. Think how much the WWW evolved in that amount of time.
      - hanniabu 5y ago
DennisP 5y ago
The bitcoins were stored on a centralized exchange using a phone number as 2FA. Banks and brokerage accounts can be hacked the same way, though at least they'll make you whole if you catch it soon enough. To really secure bitcoins, a hardware wallet or a passphrase in a safe deposit box are both pretty simple options that nontechnical people use all the time. Neither is expensive and both are widely known.
- 1024core 5y ago
  > a passphrase in a safe deposit box are both pretty simple options _If_ you can get a safe deposit box in your bank, that is. My local bank (Chase) is always sold out of boxes. Sure, you'll next say: change your bank. But the other one (BoA) is also out. My point is, it's not such an easy option as you're making it out to be.
  - neilv 5y ago
    When I shopped for a local bank branch that had safe deposit boxes (maybe decade ago), one of the bankers told me a lot of banks and branches were trying to get rid of their boxes, and not wanting to include boxes in new branches. I managed to get a box in the basement of the BofA in Harvard Square back then, and kinda wish I'd kept it, since I doubt I could get one today.
  - deleted 5y ago
    [deleted]
  - sombremesa 5y ago
    Funnily enough my bank very recently made me sign an agreement which precluded me from subleasing my safe deposit box. Maybe this is the next arbitrage opportunity.
  - diveanon 5y ago
    Maybe stop going to big corporate banks? I got one last week without any issue.
  - UncleMeat 5y ago
lvass 5y ago
The stolen sum was taken from a centralized, bank-like account. Not your keys, not your coins. Given how incredibly likely people are to trust these untrustworthy organizations, not much hope regular folks can be safe.
tigereyeTO 5y ago
People steal USD from companies and people all the time. "What hope is that for regular folks could make safe use of said USD?"
DeathArrow 5y ago
>When random teen can easily steal $46M from a "Bitcoin pioneer" what hope is that for regular folks could make safe use of said value store? That's easy. Regular folks don't have $46M to store. Also being rich doesn't mean you always take the best decisions.

Jerrrry 5y ago

The issue is that most communication is centralized between two companies, Verizon and ATT, and those companies have employees that are very, very fallible. We need to decentralize our communication infrastructure.

mym1990 5y ago
No real reason to point the finger at people at Verizon and ATT are more fallible than others. Almost anyone can fall for social engineering if done right/often enough. I know you probably think you're too smart to be fooled like that, but that's exactly how you'll fall to a scam.
- Jerrrry 5y ago
  The people Verizon/ATT are more fallible, because of the implicit risk/threat model that is imposed on us by duopolistic infrastructure. They have vastly more power without the required training. This asymmetry makes them larger targets, and therefore, more fallible. ATT/Verizon employees are the weakest link in almost all threat models, including our national one. I don't think I am personally infallible; and I am/used to be the reason you have to take cyber, social engineer, and spear attack trainings every year. It is because I know the true weakest links (humans with unrelegated access) that compel me to remind others: do not use SMS for 2FA. There are other ways of getting the nonce/temporal secret to the end-user without pitting the security to a overworked 27 year old druggy CSR in upstate new york.
  - mym1990 5y ago
    Eh to be honest your whole argument fell apart as I read the last few words. Hope you change your outlook on the world, for your own good.
mindslight 5y ago
That's a problem for sure, but it's not the problem here. The problem here is cryptocurrency trustees implementing snake oil "2FA" using the PSTN, which was never intended to provide the needed security properties.

azth 5y ago

It will take some time for the infrastructure to mature.

djbusby 5y ago
And until then? We just say "oh, fraud, oh well"?
- VWWHFSfQ 5y ago
  This is what banks and credit card companies do already. It's the cost of doing the business. If someone steals your credit card and uses it then you're not responsible, the bank is. And you get your money back. But there's no such recourse or security for individuals in this new system.
- azth 5y ago
  Straw man argument.
cactus2093 5y ago
It's been 10 years, meanwhile everyone is hyping up how awesome and fast-moving the "web3" space is and how all the best developers have left their day jobs and are building for it. What's taking so long?
- hanniabu 5y ago
  They're literally building all the foundational infrastructure from scratch. It took the web a long time to mature as well.
  - astoor 5y ago
    web3.js has been around for at least 5 years. Think how much the WWW evolved in that amount of time.
    - hanniabu 5y ago

DennisP 5y ago

The bitcoins were stored on a centralized exchange using a phone number as 2FA. Banks and brokerage accounts can be hacked the same way, though at least they'll make you whole if you catch it soon enough. To really secure bitcoins, a hardware wallet or a passphrase in a safe deposit box are both pretty simple options that nontechnical people use all the time. Neither is expensive and both are widely known.

1024core 5y ago
> a passphrase in a safe deposit box are both pretty simple options _If_ you can get a safe deposit box in your bank, that is. My local bank (Chase) is always sold out of boxes. Sure, you'll next say: change your bank. But the other one (BoA) is also out. My point is, it's not such an easy option as you're making it out to be.
- neilv 5y ago
  When I shopped for a local bank branch that had safe deposit boxes (maybe decade ago), one of the bankers told me a lot of banks and branches were trying to get rid of their boxes, and not wanting to include boxes in new branches. I managed to get a box in the basement of the BofA in Harvard Square back then, and kinda wish I'd kept it, since I doubt I could get one today.
- deleted 5y ago
  [deleted]
- sombremesa 5y ago
  Funnily enough my bank very recently made me sign an agreement which precluded me from subleasing my safe deposit box. Maybe this is the next arbitrage opportunity.
- diveanon 5y ago
  Maybe stop going to big corporate banks? I got one last week without any issue.
- UncleMeat 5y ago

lvass 5y ago

The stolen sum was taken from a centralized, bank-like account. Not your keys, not your coins. Given how incredibly likely people are to trust these untrustworthy organizations, not much hope regular folks can be safe.

tigereyeTO 5y ago

People steal USD from companies and people all the time. "What hope is that for regular folks could make safe use of said USD?"

DeathArrow 5y ago

>When random teen can easily steal $46M from a "Bitcoin pioneer" what hope is that for regular folks could make safe use of said value store? That's easy. Regular folks don't have $46M to store. Also being rich doesn't mean you always take the best decisions.