3 ms·

A crypto investor lost $120k from clicking on one bad link

10 points by RickJWagner 5y ago

kragen 5y ago
Perhaps it would be more accurate to say "Lost US$120k because, like nearly everyone else, he was running insecure software, but he gave it control over US$120k." 99% of computer security has been a public relations scam for decades: measures like virus scanners that can't work even in theory. As long as there was no incentive to break into random people's laptops, ordinary users couldn't tell the difference between fake security and real security; either way they were pretty safe. Experts like those at the NSA could tell the difference, but instead of publicizing reliable information about computer security to put the American information economy on a solid footing, they were undermining it with backdoors. And everyday people can't tell the difference between real experts and fake experts any more than they can tell the difference between real security and fake security. Cryptocurrency changes that situation, but it may already be too late. Fortunately we have developed software with real security over the last couple of decades, though very little of it. For example, seL4, NaCl, CHERI, and a few other bright points. Unfortunately, we have broadly adopted interoperability standards like HTML5 that are orders of magnitude too complex to ever be implemented securely by humans, and even Opera and Microsoft have given up on implementing them even insecurely; the progressive concentration of design and fabrication power in the hands of a small number of companies like Intel, AMD, and Huawei has guaranteed hardware backdoors such as Intel ME in most computing devices; and in many cases the legitimization of DRM by malicious actors like Netflix, the US Congress, and Tim Berners-Lee has criminalized the investigation and correction of these dangerous vulnerabilities. So just at the moment when we finally have the tools to do things right and the need to do so, we are unable to apply them. What should we do about that? I don't know. But it's a huge problem, and it's just going to get bigger. Fortune's advice to "Enable two-factor authentication for online accounts", though, is terrible. If you have thousands of dollars, don't store it on somebody else's web site; store it on your own hardware. Someone else's web site is useful as an exchange, not a store of value. If you have tens of thousands of dollars, store it on a separate computer that never connects to the internet, or in a cold wallet. Trezor may be a helpful option, I don't know. It's certainly easier to set up Trezor than a non-internet-connected Linux box, and it weighs less. But Trezor is probably the fattest target for Bitcoin thieves right now, and they might let malicious firmware slip through at some point.
nubb 5y ago
obviously a human must press the button on the ledger to authorize the tx. any speculation what this person did other than hold a bored ape? edit: my guess is his seed was in seeds.txt on his desktop
- kragen 5y ago
  No, cryptocurrency ledgers can function entirely without per-transaction human intervention.
rosndo 5y ago
Nothing in the article supports the claim made by the headline. It is actually rather unlikely that this guy lost his cryptocurrency to a browser driveby attack as claimed, odds are he did something far more stupid to get owned.

10 points by RickJWagner 5y ago

Perhaps it would be more accurate to say "Lost US$120k because, like nearly everyone else, he was running insecure software, but he gave it control over US$120k." 99% of computer security has been a public relations scam for decades: measures like virus scanners that can't work even in theory. As long as there was no incentive to break into random people's laptops, ordinary users couldn't tell the difference between fake security and real security; either way they were pretty safe. Experts like those at the NSA could tell the difference, but instead of publicizing reliable information about computer security to put the American information economy on a solid footing, they were undermining it with backdoors. And everyday people can't tell the difference between real experts and fake experts any more than they can tell the difference between real security and fake security. Cryptocurrency changes that situation, but it may already be too late. Fortunately we have developed software with real security over the last couple of decades, though very little of it. For example, seL4, NaCl, CHERI, and a few other bright points. Unfortunately, we have broadly adopted interoperability standards like HTML5 that are orders of magnitude too complex to ever be implemented securely by humans, and even Opera and Microsoft have given up on implementing them even insecurely; the progressive concentration of design and fabrication power in the hands of a small number of companies like Intel, AMD, and Huawei has guaranteed hardware backdoors such as Intel ME in most computing devices; and in many cases the legitimization of DRM by malicious actors like Netflix, the US Congress, and Tim Berners-Lee has criminalized the investigation and correction of these dangerous vulnerabilities. So just at the moment when we finally have the tools to do things right and the need to do so, we are unable to apply them. What should we do about that? I don't know. But it's a huge problem, and it's just going to get bigger. Fortune's advice to "Enable two-factor authentication for online accounts", though, is terrible. If you have thousands of dollars, don't store it on somebody else's web site; store it on your own hardware. Someone else's web site is useful as an exchange, not a store of value. If you have tens of thousands of dollars, store it on a separate computer that never connects to the internet, or in a cold wallet. Trezor may be a helpful option, I don't know. It's certainly easier to set up Trezor than a non-internet-connected Linux box, and it weighs less. But Trezor is probably the fattest target for Bitcoin thieves right now, and they might let malicious firmware slip through at some point.

nubb 5y ago

obviously a human must press the button on the ledger to authorize the tx. any speculation what this person did other than hold a bored ape? edit: my guess is his seed was in seeds.txt on his desktop

kragen 5y ago
No, cryptocurrency ledgers can function entirely without per-transaction human intervention.

rosndo 5y ago

Nothing in the article supports the claim made by the headline. It is actually rather unlikely that this guy lost his cryptocurrency to a browser driveby attack as claimed, odds are he did something far more stupid to get owned.