5 ms·

These bitcoin hacks have amazed me every single time. The old-school financial industry goes to extreme lengths in order to protect the money it's in charge of.

by h2s 14y ago

These bitcoin hacks have amazed me every single time. The old-school financial industry goes to extreme lengths in order to protect the money it's in charge of. Physical money is stored securely and guarded. IT infrastructure is carefully guarded both physically and electronically. By comparison, these bitcoin folks seem quite content to store what is essentially money on run-of-the-mill servers in run-of-the-mill data centres. Linode? Rackspace? Are you people fucking serious? It keeps happening, and I keep wondering why any thinking person would trust plain old data centre security staff with their money like this.

eli 14y ago
I agree with what you're saying. I'd argue that Bitcoin sites are at even higher risk than old-school financial sites because (I assume) the FBI actively investigates bank hacks, but not Bitcoin trading site hacks. If I were a bad guy, I know which I'd target.
soup10 14y ago
I keep wondering why any thinking person would buy bitcoins. Could be related.
- skeptical 14y ago
  It's rather difficult to make money these days without notifying a shitload of institutionalized entities. I'm not saying that I disagree with taxpaying, but things got to a ridiculous level where everything is set up to make sure you have very little opportunities to make money with your work, and if you succeed after all, you're only entitle to a rather small slice. About the original post, I couldn't agree more.
icebraining 14y ago
They go through great lengths, except apparently verifying if you're authorized to access an account, as in the Citigroup hack. Or having two-factor auth. Or being able to use passwords with decent length. Or providing a better payment system than a single set of codes that you have to hope no company leaks, or you'll have to get a new CC (see the Global Payments hack), when even fucking Twitter knows how to develop an authorization scheme that can be individually revoked. Seriously, the banking industry is hardly a paragon of security. Many startups give you better ways to protect your cat pictures than the average bank gives you to protect your money.
- jarek 14y ago
  Very true, the difference is banks will give you back your money after you're/they're hacked.
  - h2s 14y ago
    In fairness to Bitcoinica, they've promised to do this: > The thief stole from us not you. > All withdrawal requests will be honored. > http://www.bitcoinica.com/
- rplnt 14y ago
  I have not seen an online banking without two factor auth though.
  - eli 14y ago
    It's pretty common for commercial banking... which is good because in the US the laws protecting you from loss due to hacking are much weaker for a corporate account.
  - lbotos 14y ago
    I assume you are not in America? PNC, M&T, and TD all do not have two factor auth. (That I've seen.)
    - rplnt 14y ago
      Yes, Europe. Maybe there are different laws? Some decade ago you used to get plastic card with grid of passwords. Now it's usually SMS verification for every transaction (and sometimes for login).
  - loeg 14y ago
    I have.
  - Danieru 14y ago
    Well up here in Canada I have never seen a bank with two factor auth. I would love to switch to one. Instead we get online banking with password restrictions like: 1. 8 to 12 chars 2. No non-alphanumerics.
lhnn 14y ago
There's really not any problem with hosting servers at a cloud provider that isn't shady. Encrypt the data on the drive, use a reasonable firewall policy, then all you have to be concerned about is application layer breaches. Trust me, lots of payment data goes through secure servers at Rackspace. /Not a rackspace employee, but I know
- h2s 14y ago
  I get what you're saying, but my point is this: This hack happened because Bitcoinica doesn't own the bare metal servers on which the money is hosted. The break in was possible because somebody abused Rackspace's password reset functionality. The last time Bitcoinica got owned, it was because somebody managed to exploit Linode's customer service portal. To me this trend would strongly suggest the need to outright own the production hardware so that attackers have to attack you directly or physically break in to your data centre.
- deleted 14y ago
  [deleted]

by h2s 14y ago

eli 14y ago

I agree with what you're saying. I'd argue that Bitcoin sites are at even higher risk than old-school financial sites because (I assume) the FBI actively investigates bank hacks, but not Bitcoin trading site hacks. If I were a bad guy, I know which I'd target.

soup10 14y ago

I keep wondering why any thinking person would buy bitcoins. Could be related.

skeptical 14y ago
It's rather difficult to make money these days without notifying a shitload of institutionalized entities. I'm not saying that I disagree with taxpaying, but things got to a ridiculous level where everything is set up to make sure you have very little opportunities to make money with your work, and if you succeed after all, you're only entitle to a rather small slice. About the original post, I couldn't agree more.

icebraining 14y ago

They go through great lengths, except apparently verifying if you're authorized to access an account, as in the Citigroup hack. Or having two-factor auth. Or being able to use passwords with decent length. Or providing a better payment system than a single set of codes that you have to hope no company leaks, or you'll have to get a new CC (see the Global Payments hack), when even fucking Twitter knows how to develop an authorization scheme that can be individually revoked. Seriously, the banking industry is hardly a paragon of security. Many startups give you better ways to protect your cat pictures than the average bank gives you to protect your money.

jarek 14y ago
Very true, the difference is banks will give you back your money after you're/they're hacked.
- h2s 14y ago
  In fairness to Bitcoinica, they've promised to do this: > The thief stole from us not you. > All withdrawal requests will be honored. > http://www.bitcoinica.com/
rplnt 14y ago
I have not seen an online banking without two factor auth though.
- eli 14y ago
  It's pretty common for commercial banking... which is good because in the US the laws protecting you from loss due to hacking are much weaker for a corporate account.
- lbotos 14y ago
  I assume you are not in America? PNC, M&T, and TD all do not have two factor auth. (That I've seen.)
  - rplnt 14y ago
    Yes, Europe. Maybe there are different laws? Some decade ago you used to get plastic card with grid of passwords. Now it's usually SMS verification for every transaction (and sometimes for login).
- loeg 14y ago
  I have.
- Danieru 14y ago
  Well up here in Canada I have never seen a bank with two factor auth. I would love to switch to one. Instead we get online banking with password restrictions like: 1. 8 to 12 chars 2. No non-alphanumerics.

lhnn 14y ago

There's really not any problem with hosting servers at a cloud provider that isn't shady. Encrypt the data on the drive, use a reasonable firewall policy, then all you have to be concerned about is application layer breaches. Trust me, lots of payment data goes through secure servers at Rackspace. /Not a rackspace employee, but I know

h2s 14y ago
I get what you're saying, but my point is this: This hack happened because Bitcoinica doesn't own the bare metal servers on which the money is hosted. The break in was possible because somebody abused Rackspace's password reset functionality. The last time Bitcoinica got owned, it was because somebody managed to exploit Linode's customer service portal. To me this trend would strongly suggest the need to outright own the production hardware so that attackers have to attack you directly or physically break in to your data centre.
deleted 14y ago
[deleted]