14 ms·

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if co

Context now that the editorialised title has changed, this is a core Bitcoin developer. These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion)

spicymaki 4y ago
Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.
- psychphysic 4y ago
  That's why hardware based security is really the only way at this point. He might be a bitcoin core Dev but does he use ledger/trezor etc? Is his PGP key on his hardrive or a smartcard? In this day and age your computer not a bastion it once was. (It never really was but it's more of a problem in 2022 than 1982).
  - woodruffw 4y ago
    This completely talks past what the person you're replying to is saying: it doesn't matter if "hardware based security is [...] the only way," because its conspicuous absence indicates that even the experts fail to meet the onerous requirements placed on them by cryptocurrency.
    - bena 4y ago
      Yeah, this only highlights how ridiculous the requirements are. The system needs to be tolerant of failures and faults of multiple natures. And cryptocurrency is very intolerant or many types of failures and faults.
    - psychphysic 4y ago
      Well his PGP key was compromised too. So why is crypto the only thing getting attention?
      - woodruffw 4y ago
        My speculation there would be that PGP's usability weaknesses have been known for decades, and so there isn't all that much to be said about it.
  - JW_00000 4y ago
    When someone writes: > Soon you will see people saying you should have done this or that complicated thing and you answer: > Is his PGP key on his hardrive or a smartcard? you're proving their point.
    - bawolff 4y ago
      But is it a reasonable point? I would assume that if you are a major player in the bitcoin world, you should do complicated things to secure yourself. Its sort of like if someone wins the lottery, and tells the world they are putting the money under their mattress in their home. Its not unreasonable to say that such a person faces more risk than an ordinary person and should install an alarm system or something.
      - psychphysic 4y ago
        Exactly they are ignoring that this is a solved problem. If you don't take up the easy convenient solution to your problem that's on you. Hopefully this is a starting red flag for the bitcoin Dev team to implement hardware wallet support.
      - AnimalMuppet 4y ago
        You would assume. But, empirically, users don't - even users who should know better. Users don't. If your model doesn't take that into account, your model is broken. The Bitcoin model is broken. It very intentionally got rid of all the institutions that regulate and control finance, and in doing so, it got rid of everything that protects regular people from the wolves. The regular people aren't up to the task of protecting themselves, and they regularly show it. The model is broken.
        bawolff 4y ago
        So to be clear - i agree that bitcoin is a shitshow, haven for fraudsters and generally sucks. But to the specific point, there is no model that fully takes this into account. There is no model that puts risk to zero. There will always be adversaries that can attack you if the payoff is large enough. There will always be people with increased risk exposure who have to take special precautions because the effort/reward calculus makes sense for malicious people to attack them. The reason bitcoin sucks is not because its model includes such situations; it sucks because the bar for someone to be the type of person who has to care about such things in bitcoin is so much lower than in traditional banking.
  - MrMan 4y ago
    a really obtuse and clueless response which literally makes the previous posters post for them by dint of its cluelessness
- 300bps 4y ago
  This is why lack of consumer protections suck Agreed, and the problem is that this is a feature. Without that feature of a lack of central control, Bitcoin's main use case is invalid.
  - hugs_vs_toph 4y ago
    [flagged]
  - jshen 4y ago
    [flagged]
    - Psychoshy_bc1q 4y ago
      [flagged]
      - dang 4y ago
        Please don't do this, even in response to a provocation - we have to ban such accounts. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
    - dang 4y ago
      Please don't post unsubstantive or flamebait comments.
- bsder 4y ago
  Give someone enough incentive and they will hack you. Internet security is 99% "nobody gives enough damn to do it".
- 2OEH8eoCRo0 4y ago
  > if the experts can’t secure their accounts, what hope does anyone else have? This is my opinion of the entire software industry. Chrome exploits, iPhone hacks, etc. These are nearly trillion dollar companies. If they can't do it then nobody can. Something is fundamentally broken.
  - AnimalMuppet 4y ago
    Something is fundamentally broken. "We can write perfect software to prevent all attacks" is fundamentally broken, because we have empirically proven that we can't. (The previous model, "we can trust people", is even more broken. But maybe it's the same breakage? "If this packet that came over the internet passes all of our filters of known bad things, then we should go ahead and process it.") People have touted capability-based security, but I don't think that's the answer, at least for consumer devices (phones and not-administered-by-IT computers). Users will give an app whatever permissions it asks for in order for it to shut up and start running, and those permissions will be used to gut their security. It may limit the damage somewhat, depending on how disciplined the app and the user are, but it will only reduce the damage. We need a completely different answer. I don't know what it is.
    - fsflover 4y ago
      The answer is security through isolation. See: https://qubes-os.org https://qubes-os.org. My daily driver for years.
      - 2OEH8eoCRo0 4y ago
        Qubes, as great as it may be, is still another abstraction on top of an insecure base. The fact that things like spectre and meltdown are even possible is worrying. How does Qubes solve this? As another poster said, we need some other computing paradigm, but I don't know what that would look like. All I know is something is broken if these behemoth companies with limitless resources still get it wrong.
        4y ago
- willnonya 4y ago
  "This is why lack of consumer protections suck" So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over?
  - sp332 4y ago
    Consumer protections protect against fraud. Not "risky behaviors".
  - jnsaff2 4y ago
    Well the "trust me bro" marketers (and developers) have told them this is all good. Is it responsible, idk, probably not. Then again, the point the GP seems to make is that this kind of platform should not be adopted for anything important, let the gamblers gamble if they want but don't try to sell it to the general public.
  - arcticbull 4y ago
    > So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over? Yes. Every time you make a foolproof system the world brings us a bigger fool. I'd rather a few irresponsible people get a do-over than otherwise responsible people getting rekt like this.
  - ilyt 4y ago
    The consumer in this case needs to be world class security expert (as "just" being good enough to be core bitcoin developer is clearly not enough) to just not lose money. That's unreasonable for something that's supposed to be used as money
  - danaris 4y ago
    This is a false dichotomy. There is a big middle ground between "cover for users engaging in whatever risky behavior they like" and "cover for nothing whatsoever". In this case, the problem is expecting users to be perfectly diligent, and either discard all convenience or all security. Cryptocurrency continues to be a case study demonstrating why so many of the systems it's trying (unsuccessfully) to replace operate in ways that it doesn't.
- bawolff 4y ago
  Experts are also bigger targets and face more risks than ordinary people. Like in the non-crypto world, banks are the experts on storing money securely, but people still try and rob banks despite ordinary people being much easier targets.
  - naikrovek 4y ago
    except this wasn't a targeted attack, it was just a run of the mill shotgun approach to capture wallets. cryptocurrency is stupid. regulation around banks is there for many very good reasons. https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609655629903265795 you won’t trust highly regulated banks, but you will trust random strangers on the internet whom you know want your wallet and all the coins in it, without any guarantees whatsoever that any security is in place. you only need to trust yourself, which is already 8-10 orders of magnitude less trustworthy than a bank, AT BEST. even in the rare event that an established bank does go under, and it holds some of your money when it does, FDIC insurance will get you at least some of that money back. cryptocurrency has zero recourse if you are harmed. i laugh when cryptobros and NFTbros lose money, because anyone with any critical thinking skills whatsoever saw these things as shams at the outset, and we tried to speak up, but none of those who have lost money even considered listening at the time. it is hilarious to me when these things happen. i actually, literally, laugh out loud, without a single hint of remorse.
    - bawolff 4y ago
      > except this wasn't a targeted attack, it was just a run of the mill shotgun approach to capture wallets. Do we know that? The tweet you linked to basically says, we have no idea what happened so we have no idea if it was targeted or not. But i do agree generally that i have no idea why "imagine the financial system but with no regulation or oversight" is considered a selling point.
- gruez 4y ago
  > Exactly! if the experts can’t secure their accounts, what hope does anyone else have? A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affected the user with the most basic setup of a software wallet running on a computer behind a NAT firewall.
  - arcticbull 4y ago
    If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again. Every random walk down the timeline results in 100% of coins lost or stolen. [edit] You can only blame the user so many times before you have to really look inward haha.
    - s1artibartfast 4y ago
      Who is foisting anything here? I'm not aware of anyone who has been forced to use crypto
      - arcticbull 4y ago
        Anyone with a direct or indirect stake in one of the few companies silly enough to throw it on their balance sheet. Since TSLA made the S&P that's basically everyone with a market investment, an IRA, a 401(k), a pension. CPPIB invested in FTX. CDPQ in Celsius. Everyone in El Salvador. It's a bit of a cancer. Anyways those doing the foisting also includes all the shills, the laser-eyed, the influencers. [edit] It's not enough to say because they weren't forced at gunpoint, it's not coercive or immoral. We don't accept that behavior from people shilling penny stocks. And of course Salvadoran shopowners were in fact coerced with force.
        4y ago
- DoItToMe81 4y ago
  He left his keys on an insecure server exposed to the internet. This is the equivalent of "LOCKSMITH LEAVES KEYS IN LETTERBOX EVERY DAY AND THEY GET STOLEN, HOW CAN U TRUST PEOPLE 2 LOCK HOME?????"
paulpauper 4y ago
Experts make mistakes all the time, fail to see hidden risks, like Challenger explosion. This will never see mainstream adoption at this rate. If the hacker is smarter, being smart is not good enough.
- nkrisc 4y ago
  So? Just proves how difficult it is to make rockets that never explode. Are you saying that a non-expert would have more success?
  - paulpauper 4y ago
    re-read. experts make mistakes too
    - m-richthoven 4y ago
      [flagged]
- georgyo 4y ago
  This is not quite the same. Experts did make mistakes for the challenger explosion, but they did much better than the average person. Put 1000 people at complete random into a room and say design and build a rocket, I suspect they won't even get to the build phase after several years. When it comes to something everyone should be able to do, an expert making a mistake is a bad omen for the rest of us.
  - psychphysic 4y ago
    Nah we just need to give up the fantasy that you can be sure a computer isn't compromised. Hardware all the way. I have my pgp key on a yubikey, my crypto on a ledger. My passwords on a mooltipass. There are few mistakes I could make leading to this kind of compromise. Perhaps none!
  - paulpauper 4y ago
    The vast majority of people do not get hacked, because they are not worth being hacked. But being a big target means hackers will devote more resources to getting your coins.
SkyMarshal 4y ago
Looks like possibly a supply chain attack targeted specifically at Luke Jr's server: https://twitter.com/naka_frodo/status/1609655813789949959/photo/1 https://twitter.com/naka_frodo/status/1609655813789949959/ph...
- MonkeyMalarky 4y ago
  The salty posts about his hosting provider are confusing to me. He is paying $55/month and is expecting aid in forensics and audits? Is that normal for a low cost provider? Edit: Also it sounds like he didn't immediately shut down the server after the first hack? That is completely insane. I understand you want to investigate but you are leaving yourself wide open leaving the system running. It's been compromised. End of story.
  - HL33tibCe7 4y ago
    It’s not normal for any provider
  - johnklos 4y ago
    To be fair, even if he was only paying $5 a month, if there was a tiny chance that the compromise was done by an employee, any reasonable provider would be all over it.
    - adql 4y ago
      He had no proof aside from "I have found no proof therefore hosting provider must've did it". Then in his arrogance he thought he's expert enough to "clean" the compromised server even when every security guy will tell you to take the data out and burn it to the ground if there is even a suspicion of compromise.
- mikojan 4y ago
  I do not understand any of this. 1. Was he storing important secrets on a random server somewhere? A PGP key? Why? 2. Before this went down, he noticed someone broke in TWICE and he didn't shut down the server? What was the rationale? Security wise, is there something preventing you from downloading what is important to you and wiping the whole thing?
deleted 4y ago
[deleted]
tmpburning 4y ago
> These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Because no one can create secure software yet, Bitcoin isn't 100% secure.
- deleted 4y ago
  [deleted]
- willnonya 4y ago
  What percentage secure would you say it is?
- lrvick 4y ago
  This has nothing to do with the security of Bitcoin. No one has ever compromised the Bitcoin protocol. This is a case of someone expecting a single machine connected to the internet that had been compromised in the past, to not be compromised again. Very little software has rigorous security review, even the Linux kernel. Linux Odays sell for $50-100k. If you are storing anything more valuable than that on an internet connected Linux machine, it will eventually be stolen. Use an offline machine or a hardware wallet for anything that matters to you.
  - numbsafari 4y ago
    Lol… “finance” is a social construct. People are the protocol. The Bitcoin protocol is subject to a vast number of people related hacks. Other financial markets aren’t perfect, but at least they have mechanisms and acknowledge reality.
- VMG 4y ago
  by that logic, no banking software can ever be secure either
nope96 4y ago
He also lost a lot of Bitcoins on the Mt Gox hack b/c he thought it would be safe. He's just one person and I wouldn't draw any big conclusions about it. (One person who has been a massive target for something like this for many years, I would add)
gruez 4y ago
>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the internet. You're trying to paint a story of "well if a bitcoin core developer can't secure his coins, then who can!?!?", but in this case it looks like he was being an idiot. You can lead a horse to water, but you can't make him drink. [1] https://bitcoin.org/en/choose-your-wallet https://bitcoin.org/en/choose-your-wallet edit: on twitter he denied that he kept his wallet file on a server
- fshbbdssbbgdd 4y ago
  So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? (I obviously don’t expect them to guarantee the value of the crypto, just that the broker doesn’t lose it).
  - s5300 4y ago
    No, the only thing you need is an infallible memory.
    - panarky 4y ago
      Maybe Luke used LassPass.
      - SyzygistSix 4y ago
        This was my first paranoid thought.
  - gruez 4y ago
    > So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Yeah, that's how most things work in the physical world. If you want to secure a widget, then you need to "secure a physical object that grants irrevocable ownership" of it. Cryptocurrencies improve on this slightly by allowing you set up multisignature schemes, so you can get redundancy in the event of a loss. >Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? If you want government guarantees, crypto might not be right for you.
chris123 4y ago
Nice straw-man argument. Eventually, you will understand that bitcoin is not crypto. There's bitcoin and there's everything else. Everything else is a scam. Bitcoin is the hardest money ever.
- _zllx 4y ago
  Please, stop doing that. You won't get anywhere by saying all other major projects that occupy the same space as Bitcoin are scams. You're not helping bitcoin by doing that. You're not convincing anyone that bitcoin isn't crypto; it's the first crypto, and frankly it's been superseded by other FOSS projects like Monero and Ethereum in various places. Either all of crypto is a scam, or we have to take things on a case-by-case basis. By using this Bitcoin-only logic, you're just turning more people over to the former position. Many of the best innovators in the scene have been working on anything but Bitcoin for a long time.
louloulou 4y ago
If it's even true. Seems more likely that his twitter account was compromised than his bitcoins.
rsync 4y ago
"Context now that the editorialised title has changed, this is a core Bitcoin developer." I don't know this person, I am not involved in any way in the bitcoin ecosystem ... but I have thought about it a fair amount, specifically wrt opsec and security practices, self custody, etc. One of the conclusions I have always come to was: If I was known to have a lot of bitcoin, for any reason, I would work hard to make it public knowledge that all that bitcoin was gone.

spicymaki 4y ago

Exactly! if the experts can’t secure their accounts, what hope does anyone else have? Soon you will see people saying you should have done this or that complicated thing, or how somebody so smart could should have known better. No matter what they say it is never enough. This is why lack of consumer protections suck.

psychphysic 4y ago
That's why hardware based security is really the only way at this point. He might be a bitcoin core Dev but does he use ledger/trezor etc? Is his PGP key on his hardrive or a smartcard? In this day and age your computer not a bastion it once was. (It never really was but it's more of a problem in 2022 than 1982).
- woodruffw 4y ago
  This completely talks past what the person you're replying to is saying: it doesn't matter if "hardware based security is [...] the only way," because its conspicuous absence indicates that even the experts fail to meet the onerous requirements placed on them by cryptocurrency.
  - bena 4y ago
    Yeah, this only highlights how ridiculous the requirements are. The system needs to be tolerant of failures and faults of multiple natures. And cryptocurrency is very intolerant or many types of failures and faults.
  - psychphysic 4y ago
    Well his PGP key was compromised too. So why is crypto the only thing getting attention?
    - woodruffw 4y ago
      My speculation there would be that PGP's usability weaknesses have been known for decades, and so there isn't all that much to be said about it.
- JW_00000 4y ago
  When someone writes: > Soon you will see people saying you should have done this or that complicated thing and you answer: > Is his PGP key on his hardrive or a smartcard? you're proving their point.
  - bawolff 4y ago
    But is it a reasonable point? I would assume that if you are a major player in the bitcoin world, you should do complicated things to secure yourself. Its sort of like if someone wins the lottery, and tells the world they are putting the money under their mattress in their home. Its not unreasonable to say that such a person faces more risk than an ordinary person and should install an alarm system or something.
    - psychphysic 4y ago
      Exactly they are ignoring that this is a solved problem. If you don't take up the easy convenient solution to your problem that's on you. Hopefully this is a starting red flag for the bitcoin Dev team to implement hardware wallet support.
    - AnimalMuppet 4y ago
      You would assume. But, empirically, users don't - even users who should know better. Users don't. If your model doesn't take that into account, your model is broken. The Bitcoin model is broken. It very intentionally got rid of all the institutions that regulate and control finance, and in doing so, it got rid of everything that protects regular people from the wolves. The regular people aren't up to the task of protecting themselves, and they regularly show it. The model is broken.
      - bawolff 4y ago
        So to be clear - i agree that bitcoin is a shitshow, haven for fraudsters and generally sucks. But to the specific point, there is no model that fully takes this into account. There is no model that puts risk to zero. There will always be adversaries that can attack you if the payoff is large enough. There will always be people with increased risk exposure who have to take special precautions because the effort/reward calculus makes sense for malicious people to attack them. The reason bitcoin sucks is not because its model includes such situations; it sucks because the bar for someone to be the type of person who has to care about such things in bitcoin is so much lower than in traditional banking.
- MrMan 4y ago
  a really obtuse and clueless response which literally makes the previous posters post for them by dint of its cluelessness
300bps 4y ago
This is why lack of consumer protections suck Agreed, and the problem is that this is a feature. Without that feature of a lack of central control, Bitcoin's main use case is invalid.
- hugs_vs_toph 4y ago
  [flagged]
- jshen 4y ago
  [flagged]
  - Psychoshy_bc1q 4y ago
    [flagged]
    - dang 4y ago
      Please don't do this, even in response to a provocation - we have to ban such accounts. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
  - dang 4y ago
    Please don't post unsubstantive or flamebait comments.
bsder 4y ago
Give someone enough incentive and they will hack you. Internet security is 99% "nobody gives enough damn to do it".
2OEH8eoCRo0 4y ago
> if the experts can’t secure their accounts, what hope does anyone else have? This is my opinion of the entire software industry. Chrome exploits, iPhone hacks, etc. These are nearly trillion dollar companies. If they can't do it then nobody can. Something is fundamentally broken.
- AnimalMuppet 4y ago
  Something is fundamentally broken. "We can write perfect software to prevent all attacks" is fundamentally broken, because we have empirically proven that we can't. (The previous model, "we can trust people", is even more broken. But maybe it's the same breakage? "If this packet that came over the internet passes all of our filters of known bad things, then we should go ahead and process it.") People have touted capability-based security, but I don't think that's the answer, at least for consumer devices (phones and not-administered-by-IT computers). Users will give an app whatever permissions it asks for in order for it to shut up and start running, and those permissions will be used to gut their security. It may limit the damage somewhat, depending on how disciplined the app and the user are, but it will only reduce the damage. We need a completely different answer. I don't know what it is.
  - fsflover 4y ago
    The answer is security through isolation. See: https://qubes-os.org https://qubes-os.org. My daily driver for years.
    - 2OEH8eoCRo0 4y ago
      Qubes, as great as it may be, is still another abstraction on top of an insecure base. The fact that things like spectre and meltdown are even possible is worrying. How does Qubes solve this? As another poster said, we need some other computing paradigm, but I don't know what that would look like. All I know is something is broken if these behemoth companies with limitless resources still get it wrong.
      - 4y ago
willnonya 4y ago
"This is why lack of consumer protections suck" So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over?
- sp332 4y ago
  Consumer protections protect against fraud. Not "risky behaviors".
- jnsaff2 4y ago
  Well the "trust me bro" marketers (and developers) have told them this is all good. Is it responsible, idk, probably not. Then again, the point the GP seems to make is that this kind of platform should not be adopted for anything important, let the gamblers gamble if they want but don't try to sell it to the general public.
- arcticbull 4y ago
  > So, rather than the consumer being responsible for their actions you support consumers engaging in whatever risky behavior they like as long as someone else is there to protect them or give them a do-over? Yes. Every time you make a foolproof system the world brings us a bigger fool. I'd rather a few irresponsible people get a do-over than otherwise responsible people getting rekt like this.
- ilyt 4y ago
  The consumer in this case needs to be world class security expert (as "just" being good enough to be core bitcoin developer is clearly not enough) to just not lose money. That's unreasonable for something that's supposed to be used as money
- danaris 4y ago
  This is a false dichotomy. There is a big middle ground between "cover for users engaging in whatever risky behavior they like" and "cover for nothing whatsoever". In this case, the problem is expecting users to be perfectly diligent, and either discard all convenience or all security. Cryptocurrency continues to be a case study demonstrating why so many of the systems it's trying (unsuccessfully) to replace operate in ways that it doesn't.
bawolff 4y ago
Experts are also bigger targets and face more risks than ordinary people. Like in the non-crypto world, banks are the experts on storing money securely, but people still try and rob banks despite ordinary people being much easier targets.
- naikrovek 4y ago
  except this wasn't a targeted attack, it was just a run of the mill shotgun approach to capture wallets. cryptocurrency is stupid. regulation around banks is there for many very good reasons. https://twitter.com/peterktodd/status/1609655629903265795 https://twitter.com/peterktodd/status/1609655629903265795 you won’t trust highly regulated banks, but you will trust random strangers on the internet whom you know want your wallet and all the coins in it, without any guarantees whatsoever that any security is in place. you only need to trust yourself, which is already 8-10 orders of magnitude less trustworthy than a bank, AT BEST. even in the rare event that an established bank does go under, and it holds some of your money when it does, FDIC insurance will get you at least some of that money back. cryptocurrency has zero recourse if you are harmed. i laugh when cryptobros and NFTbros lose money, because anyone with any critical thinking skills whatsoever saw these things as shams at the outset, and we tried to speak up, but none of those who have lost money even considered listening at the time. it is hilarious to me when these things happen. i actually, literally, laugh out loud, without a single hint of remorse.
  - bawolff 4y ago
    > except this wasn't a targeted attack, it was just a run of the mill shotgun approach to capture wallets. Do we know that? The tweet you linked to basically says, we have no idea what happened so we have no idea if it was targeted or not. But i do agree generally that i have no idea why "imagine the financial system but with no regulation or oversight" is considered a selling point.
gruez 4y ago
> Exactly! if the experts can’t secure their accounts, what hope does anyone else have? A lot of hope, actually. If he followed the simple and oft repeated advice of using a cold wallet and/or offline computer, this attacked would have been mitigated. Hell, if some of the comments/speculation in this thread is true (ie. he kept his wallet.dat on a server connected to the internet), then this hack wouldn't have affected the user with the most basic setup of a software wallet running on a computer behind a NAT firewall.
- arcticbull 4y ago
  If it was that simple and easy why wasn't he doing it. It's simply a ridiculous failure mode that you can lose your entire life savings with no recourse if you make a silly mistake. What a dreadful idea to foist upon ordinary people as the future of finance. We've never accepted this before and let's never accept this again. Every random walk down the timeline results in 100% of coins lost or stolen. [edit] You can only blame the user so many times before you have to really look inward haha.
  - s1artibartfast 4y ago
    Who is foisting anything here? I'm not aware of anyone who has been forced to use crypto
    - arcticbull 4y ago
      Anyone with a direct or indirect stake in one of the few companies silly enough to throw it on their balance sheet. Since TSLA made the S&P that's basically everyone with a market investment, an IRA, a 401(k), a pension. CPPIB invested in FTX. CDPQ in Celsius. Everyone in El Salvador. It's a bit of a cancer. Anyways those doing the foisting also includes all the shills, the laser-eyed, the influencers. [edit] It's not enough to say because they weren't forced at gunpoint, it's not coercive or immoral. We don't accept that behavior from people shilling penny stocks. And of course Salvadoran shopowners were in fact coerced with force.
      - 4y ago
DoItToMe81 4y ago
He left his keys on an insecure server exposed to the internet. This is the equivalent of "LOCKSMITH LEAVES KEYS IN LETTERBOX EVERY DAY AND THEY GET STOLEN, HOW CAN U TRUST PEOPLE 2 LOCK HOME?????"

paulpauper 4y ago

Experts make mistakes all the time, fail to see hidden risks, like Challenger explosion. This will never see mainstream adoption at this rate. If the hacker is smarter, being smart is not good enough.

nkrisc 4y ago
So? Just proves how difficult it is to make rockets that never explode. Are you saying that a non-expert would have more success?
- paulpauper 4y ago
  re-read. experts make mistakes too
  - m-richthoven 4y ago
    [flagged]
georgyo 4y ago
This is not quite the same. Experts did make mistakes for the challenger explosion, but they did much better than the average person. Put 1000 people at complete random into a room and say design and build a rocket, I suspect they won't even get to the build phase after several years. When it comes to something everyone should be able to do, an expert making a mistake is a bad omen for the rest of us.
- psychphysic 4y ago
  Nah we just need to give up the fantasy that you can be sure a computer isn't compromised. Hardware all the way. I have my pgp key on a yubikey, my crypto on a ledger. My passwords on a mooltipass. There are few mistakes I could make leading to this kind of compromise. Perhaps none!
- paulpauper 4y ago
  The vast majority of people do not get hacked, because they are not worth being hacked. But being a big target means hackers will devote more resources to getting your coins.

SkyMarshal 4y ago

Looks like possibly a supply chain attack targeted specifically at Luke Jr's server: https://twitter.com/naka_frodo/status/1609655813789949959/photo/1 https://twitter.com/naka_frodo/status/1609655813789949959/ph...

MonkeyMalarky 4y ago
The salty posts about his hosting provider are confusing to me. He is paying $55/month and is expecting aid in forensics and audits? Is that normal for a low cost provider? Edit: Also it sounds like he didn't immediately shut down the server after the first hack? That is completely insane. I understand you want to investigate but you are leaving yourself wide open leaving the system running. It's been compromised. End of story.
- HL33tibCe7 4y ago
  It’s not normal for any provider
- johnklos 4y ago
  To be fair, even if he was only paying $5 a month, if there was a tiny chance that the compromise was done by an employee, any reasonable provider would be all over it.
  - adql 4y ago
    He had no proof aside from "I have found no proof therefore hosting provider must've did it". Then in his arrogance he thought he's expert enough to "clean" the compromised server even when every security guy will tell you to take the data out and burn it to the ground if there is even a suspicion of compromise.
mikojan 4y ago
I do not understand any of this. 1. Was he storing important secrets on a random server somewhere? A PGP key? Why? 2. Before this went down, he noticed someone broke in TWICE and he didn't shut down the server? What was the rationale? Security wise, is there something preventing you from downloading what is important to you and wiping the whole thing?

deleted 4y ago

[deleted]

tmpburning 4y ago

deleted 4y ago
[deleted]
willnonya 4y ago
What percentage secure would you say it is?
lrvick 4y ago
This has nothing to do with the security of Bitcoin. No one has ever compromised the Bitcoin protocol. This is a case of someone expecting a single machine connected to the internet that had been compromised in the past, to not be compromised again. Very little software has rigorous security review, even the Linux kernel. Linux Odays sell for $50-100k. If you are storing anything more valuable than that on an internet connected Linux machine, it will eventually be stolen. Use an offline machine or a hardware wallet for anything that matters to you.
- numbsafari 4y ago
  Lol… “finance” is a social construct. People are the protocol. The Bitcoin protocol is subject to a vast number of people related hacks. Other financial markets aren’t perfect, but at least they have mechanisms and acknowledge reality.
VMG 4y ago
by that logic, no banking software can ever be secure either

nope96 4y ago

He also lost a lot of Bitcoins on the Mt Gox hack b/c he thought it would be safe. He's just one person and I wouldn't draw any big conclusions about it. (One person who has been a massive target for something like this for many years, I would add)

gruez 4y ago

>These things happen every day, but happening to a core developer (if confirmed!) who has a deep understanding of the systems and security indicates just how fragile crypto can be (in my opinion) Based on the other comments in this thread it looks like he didn't bother using a hardware wallet (which is literally something that's recommended on bitcoin.org[1]), and kept his wallet.dat on a server exposed to the internet. You're trying to paint a story of "well if a bitcoin core developer can't secure his coins, then who can!?!?", but in this case it looks like he was being an idiot. You can lead a horse to water, but you can't make him drink. [1] https://bitcoin.org/en/choose-your-wallet https://bitcoin.org/en/choose-your-wallet edit: on twitter he denied that he kept his wallet file on a server

fshbbdssbbgdd 4y ago
So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? (I obviously don’t expect them to guarantee the value of the crypto, just that the broker doesn’t lose it).
- s5300 4y ago
  No, the only thing you need is an infallible memory.
  - panarky 4y ago
    Maybe Luke used LassPass.
    - SyzygistSix 4y ago
      This was my first paranoid thought.
- gruez 4y ago
  > So you’re saying that to use crypto properly, I have to secure a physical object that grants irrevocable ownership of my wealth? That sounds bad. Yeah, that's how most things work in the physical world. If you want to secure a widget, then you need to "secure a physical object that grants irrevocable ownership" of it. Cryptocurrencies improve on this slightly by allowing you set up multisignature schemes, so you can get redundancy in the event of a loss. >Is there a way I can get my crypto held my an institution with SIPC insurance, the way I hold stocks at a brokerage, so I can outsource this issue to someone else who is backed by a government guarantee? If you want government guarantees, crypto might not be right for you.

chris123 4y ago

Nice straw-man argument. Eventually, you will understand that bitcoin is not crypto. There's bitcoin and there's everything else. Everything else is a scam. Bitcoin is the hardest money ever.

_zllx 4y ago
Please, stop doing that. You won't get anywhere by saying all other major projects that occupy the same space as Bitcoin are scams. You're not helping bitcoin by doing that. You're not convincing anyone that bitcoin isn't crypto; it's the first crypto, and frankly it's been superseded by other FOSS projects like Monero and Ethereum in various places. Either all of crypto is a scam, or we have to take things on a case-by-case basis. By using this Bitcoin-only logic, you're just turning more people over to the former position. Many of the best innovators in the scene have been working on anything but Bitcoin for a long time.

louloulou 4y ago

If it's even true. Seems more likely that his twitter account was compromised than his bitcoins.

rsync 4y ago

"Context now that the editorialised title has changed, this is a core Bitcoin developer." I don't know this person, I am not involved in any way in the bitcoin ecosystem ... but I have thought about it a fair amount, specifically wrt opsec and security practices, self custody, etc. One of the conclusions I have always come to was: If I was known to have a lot of bitcoin, for any reason, I would work hard to make it public knowledge that all that bitcoin was gone.