11 ms·
Researchers cracked an 11-year-old password to a $3M crypto wallet
- Ajay-p 2y agohttps://archive.is/BZal2 https://archive.is/BZal2
- malshe 2y ago> Michael says he was lucky that he lost the password years ago because, otherwise, he would have sold off the bitcoin when it was worth $40,000 a coin and missed out on a greater fortune. This is so true for stocks too
- INTPenis 2y agoYes but stocks are usually tied to a business producing some sort of service that people want, and therefore have value. Crypto is tied to, checks notes nothing.
- jen729w 2y agoI’m no shill for crypto, but you can’t with a straight face claim that all non-crypto financial instruments are ‘tied to … some sort of service that people want’. There’s a whole world of shady crap going on in the ‘legitimate’ financial space.
- INTPenis 2y agoOh absolutely. Money is the root of all evil. But crypto bros are often delusional about what intrinsical value exists in the normal market, compared to crypto coins where they invent the value. Therefore manipulation of value compared to real world markets becomes a lot more abstract.
- ColinWright 2y agoThe original saying is: "For the love of money is the root of all evil: ..." -- 1 Timothy, 6:10 It's not the money that is evil, it is the things we do because of the desire we have for it.
- brightball 2y agoYep, greed. Further correction though, it actually says “the love of money is the root of all kinds of evil.” If you really go down the rabbit hole, pride is probably the root of all evil. It’s certainly the root of greed.
- ColinWright 2y ago> it actually says “the love of money is the root of all kinds of evil.” That depends on the translation you're using[0] ... it might be interesting to go back to the original (as best we can). Also "all kinds of evil" can be interpreted in (at least) two ways, so it's ambiguous anyway. But as with all these things, it's perhaps best to use the text to spark a search for a truth, or at least a useful guiding principle. [0] https://www.biblegateway.com/verse/en/1%20Timothy%206:10 https://www.biblegateway.com/verse/en/1%20Timothy%206:10
- Natsu 2y agoYoung's literal translation is pretty good for those who don't read Koine Greek or otherwise aren't eager to break out a copy of Strong's concordance. It's interesting to see the minor difference between "a root" and "the root" for example: 9 and those wishing to be rich, do fall into temptation and a snare, and many desires, foolish and hurtful, that sink men into ruin and destruction, 10 for a root of all the evils is the love of money, which certain longing for did go astray from the faith, and themselves did pierce through with many sorrows;
- portaouflop 2y agoGod is the root of all evil, he created it after all.
- kube-system 2y agoI hate on crypto any chance I get, but crypto has damn near a monopoly in facilitating black and/or grey market electronic transactions. It is very in demand, for instance, in helping dictators evade sanctions, or helping criminals extort or trade illegally.
- DANmode 2y agoI suppose you could count Venezuelans going hungry as "criminals". But I wouldn't.
- demondemidi 2y agoOh god this gets trotted out every time someone points out the evil that crypto facilitates. Give it a rest. It pales in comparison and there are many other solutions that your argument conveniently ignores.
- fallingsquirrel 2y agoThe vast majority of bitcoin use is legal. https://www.nber.org/system/files/working_papers/w29396/w29396.pdf https://www.nber.org/system/files/working_papers/w29396/w293... > For example, illegal transactions, scams and gambling together make up less than 3% of volume. Sure there's the odd dumb criminal who doesn't understand the prosecutorial implications of an immutable public ledger. But it pales in comparison, according to the actual data.
- evilfred 2y agowash trading is rampant https://www.bloomberg.com/news/articles/2023-09-12/wash-trading-is-rampant-on-decentralized-crypto-exchanges https://www.bloomberg.com/news/articles/2023-09-12/wash-trad...
- unusualmonkey 2y agoI love how you quote that, but not other lines like: "We first document that 90% of transaction volume on the Bitcoin blockchain is not tied to economically meaningful activities". How much of the actually meaningful use is legal? E.g. buying good and services, not evading laws, regulations, sales taxes etc.
- OJFord 2y agoThat argument doesn't make sense, without taking a side, because it's not supposed to be like a share in a business. You'd do better to argue 'currencies are usually tied to a productive country with some measurable GDP and therefore [...]'.
- walterbell 2y ago> Crypto is tied to.. nothing. It's being tied to US state law, via the Uniform Commercial Code (UCC Article 12 for Digital Assets), https://www.clearygottlieb.com//news-and-insights/publication-listing/ucc-digital-asset-amendments-finalized https://www.clearygottlieb.com//news-and-insights/publicatio... Article 12 – dealing directly with the acquisition and disposition of interests (including security interests) in “controllable electronic records,” which would include Bitcoin, Ether, and a variety of other digital assets ... Control under Article 12 is designed to be a technology-neutral functional equivalent of “possession.” It generally encompasses circumstances when a party has the “private key”
- ars 2y agoDollars are also tied to nothing. A towel with the logo of a sports team also has zero intrinsic value. Same with a shiny lump of useless metal. That's because being tied to something, or having intrinsic value is not how things gain value. Things, crypto, dollars, gold, and towels, have value because people WANT them. That's it. You even touched on it: "some sort of service that people want, and therefore have value" - crypto provides a service people want, therefore by your own words it has value.
- astrange 2y agoDollars have fundamental demand because, among other things, you have to pay US sales taxes in them. > Things, crypto, dollars, gold, and towels, have value because people WANT them. That's it. People would want a lot of things if those things were free, question is what the demand curve is.
- evilfred 2y agoUS dollars are backed by the US economy and military
- roenxi 2y agoIf US dollars can be backed by a military, crypto is backed by mining networks. The mining network is a lot more productive than the US military which has vastly negative economic output. At least ASICs doesn't wander around wrecking countries in a semi-random fashion. The mining network even operates at a profit, which is much better than the US government by a huge margin. Someone thinks they are worth the money.
- darkclouds 2y ago[dead]
- from-nibly 2y agoStocks arent tied to company performance unless they have divendends. Which would mean most stocks are also tied to nothing. Except stocks have recognizable logos I guess.
- solumunus 2y agoPeople want drugs, it’s a huge industry. Drugs aren’t going away buddy.
- deleted 2y ago[deleted]
- koonsolo 2y agoCrypto is bootstrapped internet money. If you can't see the value in that, it's because you don't want to see it.
- ozgrakkurt 2y agoCryto is excellent for keeping money and transfers. Especially if you don’t live in eu our us. Big coins are getting very stable and are good long term investments depending on how you see it will go :) Bank system is terribly inefficient comparatively and it is a huge market
- massysett 2y agoIs it true if you had Apple stock, or Amazon? Yes. Unfortunately others owned Sears Roebuck, or Enron.
- joquarky 2y agoHey, Kodak was a safe bet. Who could have guessed they'd pass on digital even though they practically invented it.
- stouset 2y agoSet up monthly purchases of index funds into a Roth and a 401(k). Forget about them and learn to completely ignore financial news.
- deleted 2y ago[deleted]
- coffeeri 2y agoThe original video by Joe Grand: https://youtu.be/o5IySpAkThg https://youtu.be/o5IySpAkThg
- Stagnant 2y agoHighly recommended, didn't think I'd watch the whole thing but the production quality was great and it explains everything much better than the wired article.
- dylan604 2y agoAfter your reco after the GP's reco, I would have to agree. This is well done. However, coming from a coding/dev background, it was easy to follow and it all makes sense. However, it goes to show why hacking will never be made interesting in movies without a bunch of fake nonsense like hacking the Gibson's 3D virtual environment.
- kevindamm 2y agoThe best and worst examples were in the same movie, IMO: Nedry's finger-wagging admonishment and all hell breaking loose, then later, "it's a Unix system, I know this!" and some exotic file manager visualization.
- dylan604 2y agoMr Robot has some decent hacking scenes. At least they put up prompt windows with commands that are generic enough to not be hackTheGibson.exe type lame.
- nfriedly 2y agoI used to work with a couple of the guys who consulted on the technical aspects of Mr Robot. From what I recall, the general idea was to use realistic hacks, but speed through the boring parts to keep the show interesting.
- 2y ago
- therein 2y agoSo the version of password manager he was using was vulnerable because it was generating low entropy passwords. They also found the seed was from time and knew when he had created it. He got lucky there a little.
- dylan604 2y ago> He got lucky there a little. Who is he in that sentence? Do you mean the owner of the wallet who is absouletly very lucky, or the hackers that did a lot of investigating and reverse engineering to learn that the datetime was the seed. Was that luck or l337skillz?
- jrflowers 2y agoI’m going to guess it’s the same “he” from the sentence that came immediately before the one you quoted
- brailsafe 2y agoSeems like they all were lucky that he luckily used a vulnerable password manager and knew the approximate parameters and time it was created. If he didn't get lucky, they might not have been paid.
- kbenson 2y agoIt was both, like it usually is. All that investigating and reverse engineering would have been for nought if the program didn't have the problems in the first place. Hard work is often how you capitalize on luck. Sometimes the work is enough by itself, and sometimes it's not and the luck is integral.
- shermanyo 2y agoNearly every crypto wallet I've created, I've initiated a transfer the same day. With the public ledger I can look up the first transaction for one of my wallet addresses and know with near certainty when that wallet was created. I wouldn't be surprised if this was the case for most people.
- hnbear 2y agoTime for a new investment strategy that involves buying whatever (index funds?) then losing your password to force a hold till the encryption algo has been cracked or compute power makes it easy to brute-force. Call it the Moore’s Law Fund.
- buildbot 2y agoAn interesting but not entirely practical offshoot of this idea is a fund that buys (collects legally?) wallets with lots of crypto & lost passwords and tries to crack them over time.
- sandworm101 2y agoOr just buy random used digital storage devices in bulk and scan them for potential wallets, or other marketable data. Half the "broken" USB drives out there still have plenty of retrievable data on them. It would be like the "Storage Wars" show, but digital. (Fyi, one very marketed video tape was discovered when the contents of a certain celeb's storage locker was put up for auction. Imagine the possibilities if one collected all the storage devices thrown away in a particular LA neighborhood. Or DC.)
- kube-system 2y agoI don't think it's necessarily legal (at least in some jurisdictions) to collect bitcoin that way, even if you've legally obtained the storage device.
- paulpauper 2y agoThis is already done. The feds and hackers have huge troves of wallets and files that they are trying to crack, either by finding holes in the encryption method used or brute force.
- sneak 2y agoThis is already how bitcoin mining works. Compute is used to calculate partial hash collisions via brute force. The number of bits required in the collision adjusts dynamically based on the duration of the last 2016 blocks. If you're the first to find a valid collision for the next block, you get 3.125 BTC.
- hartator 2y ago> They really annoyed me, because who knows what I did 10 years ago, He doesn’t seem to be very thankful.
- floam 2y agoI think it’s an artifact of translation or ESL. Imagine he said “pestered”. I don’t think he necessarily meant the effect it had on his mood.
- declan_roberts 2y agoIt's not clear how datetime was used and why that became a weakness? Doesn't it improve the password security by taking some bytes from /dev/random and salting it with <timestamp>?
- Stagnant 2y agoThe roboform password manager used datetime value as the seed of the pseudorandom generator, meaning that it would always generate the same password if the system clock time was the same. They managed to crack the wallet by reverse engineering the password manager and feeding its pseudonumber generator all datetime values between certain dates that were thought to be near the time when the original wallet owner had generated the password.
- fragmede 2y agoyes so knowing the datetime that was used to salt reduces the search space.
- JohnKemeny 2y agoSalt is not the same as seed.
- fragmede 2y agoyou're right. too late to edit now though
- arp242 2y agoSo Roboform has almost certainly thousands (of not millions) of users with weak passwords, and not only didn't they tell anyone, all they give is a shrug when asked about it. What a bunch of bozos.
- paulpauper 2y agoBecause the vast majority of ppl who use it will not be storing millions of dollars of crypto with it. Crypto changes the game totally.
- yreg 2y agoNo it doesn't. What kind of an excuse is that? When a password manager maker finds a vulnerability they should absolutely tell their users to regenerate their passwords!
- paulpauper 2y agodidn't the vendor fix it?
- yreg 2y agoThey are supposed to disclose the vulnerability after fixing it, so their users know they need to take action. That's what the original commenter rightly complained about.
- wepple 2y agoCrypto doesn’t change the game. Products that generate passwords should do so securely. You may be using it to protect extremely sensitive information that could have people killed - that’s more important than a few million dollars in imaginary money
- lazide 2y agoWhat if a few million dollars in imaginary money is more than enough to pay someone to kill some folks?
- kick_in_the_dor 2y ago"Michael... now has 30 BTC, now worth $3 million, and is waiting for the value to rise to $100,000 per coin." What the ? You presumably go from not a millionaire to having $3,000,000, and you decide to risk it to triple it? That's some next level greed right there.
- pjkundert 2y agoHow do you know he isn’t hedged? NOT keeping it in Bitcoin is some next-level stupidity, by the simple analysis of trends over the time he’s held it. And the inflation produced by the creation of broad money over the last 3 years hasn’t even come home to roost, yet. I’d say he’s being ruthlessly analytical, not greedy.
- metabagel 2y agoPast performance does not guarantee future results.
- kube-system 2y agoTrue, but if he were looking for guaranteed returns he picked the wrong investment. I presume this person is has some level of risk tolerance far exceeding zero.
- tosl559 2y agoYou want him to swap absolutely scarce Bitcoin for something that can be printed infinitely out of thin air? Swapping to dollars would be the risk here.
- Manabu-eo 2y agoOnly since crypto boom I see people (crypto aficionados) thinking of money as an investment. And that makes no sense, as you explain yourself. Dollars are much less volatile and thus less risky than any crypto currency I know. A perfect intermediate step before investing in some equity or some other thing that produces value.
- ggm 2y agoWhat was their fee?
- neoecos 2y agoI think about 50%, they only gave a 1.6M check
- 4gotunameagain 2y agoIn the beginning they mentioned that since filming the price jumped to 3M, so I would assume the 1.6M was the rate back then.
- hm-nah 2y agoMind your entropy.
- o0-0o 2y agoOh gosh, I need help with this. It's not nearly that much, but damn I need this.
- subpixel 2y agoLast I checked my lost-password fortune was about $8k. Now, had I spend the same amount of money on bitcoin that I did on the janky underpowered miner setup I put together by not quite understanding the math, my lost-password fortune would approach $1MM. Either way, I lost my password.
- demondemidi 2y agoThat is super lucky. They didn’t break the crypto, they broke the PRNG. Amateur wallet design. Any security programmer with a passing knowledge of NIST entropy requirements 800-90 a/b/c would have never done this.
- AlotOfReading 2y agoAlmost all cryptosystems are broken by implementation issues, not attacks on the algorithms themselves. This may be a particularly straightforward attack, but crypto is hard. There's a lot of details you have to get right and a single mistake can destroy all the effort, regardless of how much else you got right.
- ipython 2y agoThis happens all the time. If I had a nickel for every system I broke with a time based prng, I’d have like 10 bucks by now.
- udev4096 2y agoWhat's the most random and wildly known way, apart from time based, to pick a seed value then?
- oniony 2y agoI'm guessing "wildly known" was a typo, but I'll bite onto that type anyway and put forward https://en.wikipedia.org/wiki/Lavarand https://en.wikipedia.org/wiki/Lavarand and Cloudfare's pendulums https://blog.cloudflare.com/harnessing-office-chaos https://blog.cloudflare.com/harnessing-office-chaos.
- ipython 2y agoFrom a developers point of view- if you are given an option to provide a seed value, you’re using the wrong api. Libraries exist to provide cryptographically appropriate rngs in every major programming language- use those instead.
- koliber 2y ago
- pentagrama 2y agoI was completely engrossed throughout the entire article, and by the end, I was left eagerly wanting to know what the password was. I guess I've watched too many movies.
- slicktux 2y agoSomeone linked the YouTube video…it shows the password… Great watch!
- deleted 2y ago[deleted]
- framapotari 2y ago"Michael... now has 30 BTC, now worth $3 million, and is waiting for the value to rise to $100,000 per coin." Can someone help me understand this? If his 30 BTC are now worth $3 million, that comes down to $100,000 per coin. But he's waiting for the value to rise to... $100,000 per coin?
- jwilk 2y agoElsewhere the article says it's 43.6 BTC. https://services.packetizer.com/btc/ https://services.packetizer.com/btc/ says the current BTC price is ~$68K.