7 ms·

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I

Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. I see a lot of victim-blaming suggestions that it's the fault of the person who didn't set up a new crypto wallet for every interaction they might want to make and then transfer enough money into said wallet to cover unpredictable gas fees (while also paying gas fees to transfer the money) and then, presumably pay even more gas fees to transfer everything back out of the wallet if it turns out to not be a scam. It's incredible that crypto has reached a point where some people seem to think this is all totally reasonable and natural to expect the average user to know.

joshgroban 4y ago
You don't know what you're talking about.
nubb 4y ago
you’re right. the unreasonable complexity of crypto is why people fall for phishing scams. thanks.
- mushbino 4y ago
  Right? It's a good thing our monetary system and financial instruments aren't complex, phew!
  - giaour 4y ago
    It's one thing to have complex payment instruments where innocent mistakes are reversible. Having them in a world where everything is permanent is another situation entirely.
    - mitchdoogle 4y ago
      Tell that to everyone who has had their identity stolen through no action of their own
MomoXenosaga 4y ago
Banking the unbanked lol.
- wp381640 4y ago
  More unbanking the banked recently
dcolkitt 4y ago
That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.
- gowld 4y ago
  What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?
  - bko 4y ago
    This is what I do: When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, you should add it to your saved addresses on your wallet and next time you'll see the name of the address. Also you can create a new throw away address, transfer just a little bit of coins to it and interact with the contract. If it does what you think it should do, then you can create a new account and do it again. It's not perfect. It could be a proxy, so you're not guaranteed the contract you're interacting with. There's no easy way to "see what a transaction does". You just need to do risk management.
    - happyopossum 4y ago
      > When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, you should add it to your saved addresses on your wallet and next time you'll see the name of the address Oh, that’s it? So simple.
giaour 4y ago
Users might think to themselves, I give my credit card number to all kinds of sites; how is this any different? The internet has kind of conditioned all of us to be OK with passing around complex payment instruments without paying too much attention. If you're a hardcore believer in cryptocurrency as a political project, you almost certainly understand the difference and see the "code is law" dark forest as a feature, not a bug. But if you started buying crypto and NFTs because Matt Damon and Larry David told you to, then you're in for a world of hurt.
- jensvdh 4y ago
  Because credit cards have consumer protection and laws and regulations. Crypto has none of that.
  - Gigachad 4y ago
    The crypto space is rediscovering the financial system from first principals. At least by the end they can hopefully appreciate that the original government controlled system actually works the way it does for a reason.
    - cowtools 4y ago
      The crypto space isn't rediscovering anything. Speculative investors and other noobs are discovering cryptocurrency for the first time.
      - Gigachad 4y ago
        All of these scams, crashes, and exploits are things that happens previously with regular currencies and have since been regulated away. Now crypto comes in with unregulated currency and runs in to every issue the regulations existed to prevent.
        cowtools 4y ago
        These scams, crashes, are exploits are non-issues to anyone with a reasonable degree of competence and skepticism. The solution is not to "fix" the system by removing user agency so that even an idiot can use it safely, but to educate users so that an idiot doesn't need to use cryptocurrency in the first place. This criticism of cryptocurrency would be analogous to criticizing the concept of fiat currency by pointing to the inflation of the deutsche mark as an example. The cryptocurrencies being discussed here are real cryptocurrencies, they are bloated and useless shitcoins. Any credible project would not have all the bloated crap that enables the "exploits" mentioned in the article in the first place.
melony 4y ago
Yeah they should pay Plaid a grand a month for that privilege instead.
- xur17 4y ago
  Oh man.. don't get me started on Plaid. The fact that we normalized entering your bank login details in random apps is absolutely insane to me.
trompetenaccoun 4y ago
It turns out you're not the first person to realize that this is an issue. If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits. Basically the fraud described is a twist on the classic "Musk giving away BTC" scam that's all over Youtube because Google is apparently unable to prevent it. You have to be fairly naive to fall for it in the first place. But ok, no victim-blaming. The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Same as having a withdrawal limit on your bank card. And you can also whitelist wallets, the contract then automatically blocks any transfers to untrusted wallets. If the user manually overrides this by getting his guardians to agree, there's no stopping them of course. Ultimately you won't be able to protect everyone. A determined enough fool can also go to Western Union and mail money to the scammer. In the US they have those prepaid card scammers. Or they come to your home, telling you they're police and need to inspect your valuables. Yes, that's a real actual scam that exists in Europe.
- infotogivenm 4y ago
  > The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Yes, so simple! Just put your coins into this website’s smart contract and you’ll be much more secure.
  - trompetenaccoun 4y ago
    It's not a website. Read this if you're unsure what a smart contract is: https://ethereum.org/en/developers/docs/smart-contracts/ https://ethereum.org/en/developers/docs/smart-contracts/ Btw yes, from a user perspective it actually is very simple and easy to use. It's a good wallet for beginners. Most who're more active and understand the tech have hardware wallets. You could combine the two solutions as well.
daniel-cussen 4y ago
This is why you use a reputable website, like Coinbase, despite the outrageous fees. They have a brand as collateral if they fuck up. They had that crazy early growth rate, and at the very least the dot-com of a word Satoshi coined, and he's coined more wealth than literally anybody. Modern day Croesus of Lydia. Literally as rich as Croesus.
epigramx 4y ago
That's literally like saying Windows is terrible because it allows you to run programs outside a phone-like sandbox.
luxuryballs 4y ago
I’d probably blame the victim if they kept their USD as 1 dollar bills scotch taped to the outside of their clothing though. I think it’s the nature of crypto that part of the benefit comes from the cost of it being up to the individual to maintain. Selling a product/service that consumes crypto or holds it easily might be the answer (like a bank is to usd), now the individual is giving up the keys though. There’s a trade-off there that is very cool because it only exists because bitcoin adds the option of more reliably securing the money “all by yourself” rather than needing a bank due to physical limitations. In that sense there are many crypto holders out there that may wish they had just kept it on Coinbase… TLDR the cost of having it be serious to use crypto is well worth it for the power and value of crypto itself, it’s like the cost otherwise paid to run a bank, put into a different form, the average economy of carelessness
julianlam 4y ago
> unpredictable gas fees The fact that gas fees even exist just boggles the mind. Bank fees at least on paper pay for overhead of running the wire transfer system. Gas fees (to my uninitiated understanding) literally just pay for the excess waste that is Ethereum, by design.
Thorrez 4y ago
>Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. Is it worse than browsers+OSes allowing you to download and run a program? Or Github or npm or browser extensions? All 4 of those could steal all your crypto too if you install them.

joshgroban 4y ago

You don't know what you're talking about.

nubb 4y ago

you’re right. the unreasonable complexity of crypto is why people fall for phishing scams. thanks.

mushbino 4y ago
Right? It's a good thing our monetary system and financial instruments aren't complex, phew!
- giaour 4y ago
  It's one thing to have complex payment instruments where innocent mistakes are reversible. Having them in a world where everything is permanent is another situation entirely.
  - mitchdoogle 4y ago
    Tell that to everyone who has had their identity stolen through no action of their own

MomoXenosaga 4y ago

Banking the unbanked lol.

wp381640 4y ago
More unbanking the banked recently

dcolkitt 4y ago

That's not how it works at all. When you connect a wallet, the only unrestricted access it gives the app is the ability to see your public address. The app does not have the ability to sign transactions on your behalf without your explicit approval.

gowld 4y ago
What does a user see? How should a user investigate a transaction to check what it does? Is there any good automated explanation/visualization of the effect of a transaction?
- bko 4y ago
  This is what I do: When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, you should add it to your saved addresses on your wallet and next time you'll see the name of the address. Also you can create a new throw away address, transfer just a little bit of coins to it and interact with the contract. If it does what you think it should do, then you can create a new account and do it again. It's not perfect. It could be a proxy, so you're not guaranteed the contract you're interacting with. There's no easy way to "see what a transaction does". You just need to do risk management.
  - happyopossum 4y ago
    > When a site initiates a transaction, you can see the address you're interacting with. You should then look up the address on etherscan to see if it has public code and a lot of transactions. Then you should search that address in google and see if the main site links to it. A lot of projects have a list of addresses in their github. You can also inspect the function code. Once you're comfortable, you should add it to your saved addresses on your wallet and next time you'll see the name of the address Oh, that’s it? So simple.

giaour 4y ago

Users might think to themselves, I give my credit card number to all kinds of sites; how is this any different? The internet has kind of conditioned all of us to be OK with passing around complex payment instruments without paying too much attention. If you're a hardcore believer in cryptocurrency as a political project, you almost certainly understand the difference and see the "code is law" dark forest as a feature, not a bug. But if you started buying crypto and NFTs because Matt Damon and Larry David told you to, then you're in for a world of hurt.

jensvdh 4y ago
Because credit cards have consumer protection and laws and regulations. Crypto has none of that.
- Gigachad 4y ago
  The crypto space is rediscovering the financial system from first principals. At least by the end they can hopefully appreciate that the original government controlled system actually works the way it does for a reason.
  - cowtools 4y ago
    The crypto space isn't rediscovering anything. Speculative investors and other noobs are discovering cryptocurrency for the first time.
    - Gigachad 4y ago
      All of these scams, crashes, and exploits are things that happens previously with regular currencies and have since been regulated away. Now crypto comes in with unregulated currency and runs in to every issue the regulations existed to prevent.
      - cowtools 4y ago
        These scams, crashes, are exploits are non-issues to anyone with a reasonable degree of competence and skepticism. The solution is not to "fix" the system by removing user agency so that even an idiot can use it safely, but to educate users so that an idiot doesn't need to use cryptocurrency in the first place. This criticism of cryptocurrency would be analogous to criticizing the concept of fiat currency by pointing to the inflation of the deutsche mark as an example. The cryptocurrencies being discussed here are real cryptocurrencies, they are bloated and useless shitcoins. Any credible project would not have all the bloated crap that enables the "exploits" mentioned in the article in the first place.

melony 4y ago

Yeah they should pay Plaid a grand a month for that privilege instead.

xur17 4y ago
Oh man.. don't get me started on Plaid. The fact that we normalized entering your bank login details in random apps is absolutely insane to me.

trompetenaccoun 4y ago

It turns out you're not the first person to realize that this is an issue. If you'd actually read up on cryptocurrency wallets before commenting, you might have found there are multiple solutions for this out already, including one of the most popular Ethereum wallets called Argent, which let's you set limits. Basically the fraud described is a twist on the classic "Musk giving away BTC" scam that's all over Youtube because Google is apparently unable to prevent it. You have to be fairly naive to fall for it in the first place. But ok, no victim-blaming. The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Same as having a withdrawal limit on your bank card. And you can also whitelist wallets, the contract then automatically blocks any transfers to untrusted wallets. If the user manually overrides this by getting his guardians to agree, there's no stopping them of course. Ultimately you won't be able to protect everyone. A determined enough fool can also go to Western Union and mail money to the scammer. In the US they have those prepaid card scammers. Or they come to your home, telling you they're police and need to inspect your valuables. Yes, that's a real actual scam that exists in Europe.

infotogivenm 4y ago
> The way you can prevent it on smart contract platforms is simply holding the funds in a smart contract that allows users to set restrictions so that they couldn't take that expensive NFT even if the user mindlessly clicks on a fishing link, connects the wallet and approves the transaction without checking what it is. Yes, so simple! Just put your coins into this website’s smart contract and you’ll be much more secure.
- trompetenaccoun 4y ago
  It's not a website. Read this if you're unsure what a smart contract is: https://ethereum.org/en/developers/docs/smart-contracts/ https://ethereum.org/en/developers/docs/smart-contracts/ Btw yes, from a user perspective it actually is very simple and easy to use. It's a good wallet for beginners. Most who're more active and understand the tech have hardware wallets. You could combine the two solutions as well.

daniel-cussen 4y ago

This is why you use a reputable website, like Coinbase, despite the outrageous fees. They have a brand as collateral if they fuck up. They had that crazy early growth rate, and at the very least the dot-com of a word Satoshi coined, and he's coined more wealth than literally anybody. Modern day Croesus of Lydia. Literally as rich as Croesus.

epigramx 4y ago

That's literally like saying Windows is terrible because it allows you to run programs outside a phone-like sandbox.

luxuryballs 4y ago

I’d probably blame the victim if they kept their USD as 1 dollar bills scotch taped to the outside of their clothing though. I think it’s the nature of crypto that part of the benefit comes from the cost of it being up to the individual to maintain. Selling a product/service that consumes crypto or holds it easily might be the answer (like a bank is to usd), now the individual is giving up the keys though. There’s a trade-off there that is very cool because it only exists because bitcoin adds the option of more reliably securing the money “all by yourself” rather than needing a bank due to physical limitations. In that sense there are many crypto holders out there that may wish they had just kept it on Coinbase… TLDR the cost of having it be serious to use crypto is well worth it for the power and value of crypto itself, it’s like the cost otherwise paid to run a bank, put into a different form, the average economy of carelessness

julianlam 4y ago

> unpredictable gas fees The fact that gas fees even exist just boggles the mind. Bank fees at least on paper pay for overhead of running the wire transfer system. Gas fees (to my uninitiated understanding) literally just pay for the excess waste that is Ethereum, by design.

Thorrez 4y ago

>Absolutely baffling that the crypto community normalized this process of connecting your wallet to a random website and letting it access all of your money. Is it worse than browsers+OSes allowing you to download and run a program? Or Github or npm or browser extensions? All 4 of those could steal all your crypto too if you install them.