4 ms·

The bitcoins were stored on a centralized exchange using a phone number as 2FA. Banks and brokerage accounts can be hacked the same way, though at least they'll

The bitcoins were stored on a centralized exchange using a phone number as 2FA. Banks and brokerage accounts can be hacked the same way, though at least they'll make you whole if you catch it soon enough. To really secure bitcoins, a hardware wallet or a passphrase in a safe deposit box are both pretty simple options that nontechnical people use all the time. Neither is expensive and both are widely known.

1024core 5y ago
> a passphrase in a safe deposit box are both pretty simple options _If_ you can get a safe deposit box in your bank, that is. My local bank (Chase) is always sold out of boxes. Sure, you'll next say: change your bank. But the other one (BoA) is also out. My point is, it's not such an easy option as you're making it out to be.
- neilv 5y ago
  When I shopped for a local bank branch that had safe deposit boxes (maybe decade ago), one of the bankers told me a lot of banks and branches were trying to get rid of their boxes, and not wanting to include boxes in new branches. I managed to get a box in the basement of the BofA in Harvard Square back then, and kinda wish I'd kept it, since I doubt I could get one today.
- deleted 5y ago
  [deleted]
- sombremesa 5y ago
  Funnily enough my bank very recently made me sign an agreement which precluded me from subleasing my safe deposit box. Maybe this is the next arbitrage opportunity.
- diveanon 5y ago
  Maybe stop going to big corporate banks? I got one last week without any issue.
- UncleMeat 5y ago
  Yeah I remember trying to open one in the bay area a while back. My local bank had a wait time of more than three years for a box.
TuringNYC 5y ago
This explanation doesnt make total sense to me, so 2FA, by definition is two-factor. This explains how one factor was compromised. How was the other factor compromised?
- np_tedious 5y ago
  Probably password reuse, then leaked. Like you'd see on https://haveibeenpwned.com/ https://haveibeenpwned.com/
- jrootabega 5y ago
  You may be right. A lot of orgs will happily let you use SMS for 2FA at login, but let you recover your account with that same SMS, making it 1FA x 2 (or 0FA, to line up with RAID 0)
adventured 5y ago
> Neither is expensive and both are widely known. I'd say that ~97%-99% of the people in the US and Europe have no idea how to use a hardware wallet. The vast majority have no idea what a hardware wallet is. You're very far off the mark in your estimate. Bitcoin is at the adoption stage where the general public is only beginning to use services like Coinbase. They do not know how to use a hardware wallet, most of them do not know that such a thing exists.
- hanniabu 5y ago
  The vast majority of people in crypto know what a hardware wallet is
  - spiderice 5y ago
    Not really sure how this is relevant, seeing how the original comment said > what hope is that for regular folks could make safe use of said value store
    - DennisP 5y ago
      I just googled "how to safely store bitcoin" and a bunch of articles with good, simple advice came up.
      - UncleMeat 5y ago
        But is it foolproof? "Why Johnny Can't Encrypt" was published decades ago. With this stuff you cannot make any mistake. PGP advice appeared to be good and simple, yet people made errors all the time. I wouldn't expect this to be different.
        DennisP 5y ago
        Hardware wallets are considerably simpler than PGP. I can only think of two ways to screw up: 1) Lose the passphrase. The device does quiz the user on words of the passphrase upon setup, to be sure the user at least wrote it down. Hopefully this reinforces its importance. Ledger provides a card to write the words, with prominent instructions to save it somewhere safe. 2) When sending, don't verify on the device's display that you're sending the money where you think. But the display is right there on the device, and displays the destination address while waiting for you to push a button right next to it. For smart contracts it helps to get a larger device that shows all the contract parameters, but for simple sends that's all there is to it.
breakfastduck 5y ago
So back to shoving cash under the bed, essentially.
viro 5y ago
This shows a fundamental misunderstanding of how cryptocurrency works. Bitcoins aren't stored anywhere. You don't need to get hacked; to have your bitcoins stolen.
- DennisP 5y ago
  If you want to be pedantic about it, you have to store your private key securely.
Blackstone4 5y ago
The difference is that often the institutions (i.e. banks and brokerage firms) are often repay lost funds or can reverse the transactions where as here it is a lot harder.
tobyjsullivan 5y ago
Holding the coins is one thing, transferring is another. I just transferred my bitcoin out of my paper wallets. I can promise you there is absolutely no way for a non-technical person to do this safely. What are they going to do? Visit some random website to sweep their wallets and hope their private keys are not stolen (which they will be)? I haven't used a hardware wallet - I suspect they solve the transferring problem. But what's the risk my hardware wallet still works a year from now? 10 years from now? I decided trusting Coinbase in 2021 is the most reasonable option for the amount I have. (Different calculus back in 2016). I admit I don't know what I'd do with 8-figure balances though.
- DennisP 5y ago
  Hardware wallets do solve that problem. Keep your 24-word passphrase somewhere safe, and you can use that to restore your keys into any hardware wallet, without plugging it in to a computer. The passphrase algorithm is a public standard, so if your hardware breaks, you can restore onto another one. After that, plug the hardware wallet into a computer and you can transfer without the computer ever seeing your private key. The hardware wallet displays the destination address, which you should check. I do agree that Coinbase is reasonably safe, as long as you use a strong password and 2FA, and don't give them your phone number.

1024core 5y ago

> a passphrase in a safe deposit box are both pretty simple options _If_ you can get a safe deposit box in your bank, that is. My local bank (Chase) is always sold out of boxes. Sure, you'll next say: change your bank. But the other one (BoA) is also out. My point is, it's not such an easy option as you're making it out to be.

neilv 5y ago
When I shopped for a local bank branch that had safe deposit boxes (maybe decade ago), one of the bankers told me a lot of banks and branches were trying to get rid of their boxes, and not wanting to include boxes in new branches. I managed to get a box in the basement of the BofA in Harvard Square back then, and kinda wish I'd kept it, since I doubt I could get one today.
deleted 5y ago
[deleted]
sombremesa 5y ago
Funnily enough my bank very recently made me sign an agreement which precluded me from subleasing my safe deposit box. Maybe this is the next arbitrage opportunity.
diveanon 5y ago
Maybe stop going to big corporate banks? I got one last week without any issue.
UncleMeat 5y ago
Yeah I remember trying to open one in the bay area a while back. My local bank had a wait time of more than three years for a box.

TuringNYC 5y ago

This explanation doesnt make total sense to me, so 2FA, by definition is two-factor. This explains how one factor was compromised. How was the other factor compromised?

np_tedious 5y ago
Probably password reuse, then leaked. Like you'd see on https://haveibeenpwned.com/ https://haveibeenpwned.com/
jrootabega 5y ago
You may be right. A lot of orgs will happily let you use SMS for 2FA at login, but let you recover your account with that same SMS, making it 1FA x 2 (or 0FA, to line up with RAID 0)

adventured 5y ago

> Neither is expensive and both are widely known. I'd say that ~97%-99% of the people in the US and Europe have no idea how to use a hardware wallet. The vast majority have no idea what a hardware wallet is. You're very far off the mark in your estimate. Bitcoin is at the adoption stage where the general public is only beginning to use services like Coinbase. They do not know how to use a hardware wallet, most of them do not know that such a thing exists.

hanniabu 5y ago
The vast majority of people in crypto know what a hardware wallet is
- spiderice 5y ago
  Not really sure how this is relevant, seeing how the original comment said > what hope is that for regular folks could make safe use of said value store
  - DennisP 5y ago
    I just googled "how to safely store bitcoin" and a bunch of articles with good, simple advice came up.
    - UncleMeat 5y ago
      But is it foolproof? "Why Johnny Can't Encrypt" was published decades ago. With this stuff you cannot make any mistake. PGP advice appeared to be good and simple, yet people made errors all the time. I wouldn't expect this to be different.
      - DennisP 5y ago
        Hardware wallets are considerably simpler than PGP. I can only think of two ways to screw up: 1) Lose the passphrase. The device does quiz the user on words of the passphrase upon setup, to be sure the user at least wrote it down. Hopefully this reinforces its importance. Ledger provides a card to write the words, with prominent instructions to save it somewhere safe. 2) When sending, don't verify on the device's display that you're sending the money where you think. But the display is right there on the device, and displays the destination address while waiting for you to push a button right next to it. For smart contracts it helps to get a larger device that shows all the contract parameters, but for simple sends that's all there is to it.

breakfastduck 5y ago

So back to shoving cash under the bed, essentially.

viro 5y ago

This shows a fundamental misunderstanding of how cryptocurrency works. Bitcoins aren't stored anywhere. You don't need to get hacked; to have your bitcoins stolen.

DennisP 5y ago
If you want to be pedantic about it, you have to store your private key securely.

Blackstone4 5y ago

The difference is that often the institutions (i.e. banks and brokerage firms) are often repay lost funds or can reverse the transactions where as here it is a lot harder.

tobyjsullivan 5y ago

Holding the coins is one thing, transferring is another. I just transferred my bitcoin out of my paper wallets. I can promise you there is absolutely no way for a non-technical person to do this safely. What are they going to do? Visit some random website to sweep their wallets and hope their private keys are not stolen (which they will be)? I haven't used a hardware wallet - I suspect they solve the transferring problem. But what's the risk my hardware wallet still works a year from now? 10 years from now? I decided trusting Coinbase in 2021 is the most reasonable option for the amount I have. (Different calculus back in 2016). I admit I don't know what I'd do with 8-figure balances though.

DennisP 5y ago
Hardware wallets do solve that problem. Keep your 24-word passphrase somewhere safe, and you can use that to restore your keys into any hardware wallet, without plugging it in to a computer. The passphrase algorithm is a public standard, so if your hardware breaks, you can restore onto another one. After that, plug the hardware wallet into a computer and you can transfer without the computer ever seeing your private key. The hardware wallet displays the destination address, which you should check. I do agree that Coinbase is reasonably safe, as long as you use a strong password and 2FA, and don't give them your phone number.