3 ms·

The app and its infrastructure was created by a single, very inexperienced programmer. The app's original author, Zhou Tong, is only 17[1]. Not that age is an

The app and its infrastructure was created by a single, very inexperienced programmer. The app's original author, Zhou Tong, is only 17[1]. Not that age is an indicator of experience in general, but it's certainly the case here. I'm honestly shocked at the amount of trust placed in Bitcoinica. An interesting display of the oft mentioned Stockholm Syndrome happening elsewhere on the forum here https://bitcointalk.org/index.php?topic=93100.0 https://bitcointalk.org/index.php?topic=93100.0 [1] http://coinabul.tumblr.com/post/24022841613/10qs-zhou-tong-bitcoinica http://coinabul.tumblr.com/post/24022841613/10qs-zhou-tong-b... Edit: added reference.

coinabul 14y ago
Hey, that post happened after the first hack. Also, I feel this hack is not Zhou's fault. Edit: Oh, misread that. You were just citing source. Gotcha.
zhoutong 14y ago
Well I do agree with you that Bitcoinica was not 100% secure. This hack really has nothing to do with the app or its infrastructure. - I didn't set the password. - I didn't have the power to change the password. - I shouldn't have access to the account. The root cause is LastPass account being stolen.
- mmcnickle 14y ago
  Agreed that you are not personally responsible for this particular attack, though I see it as the latest in a series of cascading failures, beginning with the initial attack. It's the lack of consideration of security - that can only be baked in from the outset - that's the real root cause. If the application had been self-hosted in a physically secured location, the attack that exposed the LastPass credentials would not have happened (email reset of root passwords). It may not be cool, but the cloud/consumer-level hosting is not appropriate for applications handling large sums of money.
  - zhoutong 14y ago
    Agreed. But one of the team members explicitly released the source code and that caused the hacker to correctly guess LastPass account. (At least this is the most "right" version of the story I've heard.)
rorrr 14y ago
What makes you think he wasn't in on this breach? It's far more profitable than running a bitcoin exchange.

coinabul 14y ago

Hey, that post happened after the first hack. Also, I feel this hack is not Zhou's fault. Edit: Oh, misread that. You were just citing source. Gotcha.

zhoutong 14y ago

Well I do agree with you that Bitcoinica was not 100% secure. This hack really has nothing to do with the app or its infrastructure. - I didn't set the password. - I didn't have the power to change the password. - I shouldn't have access to the account. The root cause is LastPass account being stolen.

mmcnickle 14y ago
Agreed that you are not personally responsible for this particular attack, though I see it as the latest in a series of cascading failures, beginning with the initial attack. It's the lack of consideration of security - that can only be baked in from the outset - that's the real root cause. If the application had been self-hosted in a physically secured location, the attack that exposed the LastPass credentials would not have happened (email reset of root passwords). It may not be cool, but the cloud/consumer-level hosting is not appropriate for applications handling large sums of money.
- zhoutong 14y ago
  Agreed. But one of the team members explicitly released the source code and that caused the hacker to correctly guess LastPass account. (At least this is the most "right" version of the story I've heard.)

rorrr 14y ago

What makes you think he wasn't in on this breach? It's far more profitable than running a bitcoin exchange.