3 ms·
Well I do agree with you that Bitcoinica was not 100% secure. This hack really has nothing to do with the app or its infrastructure. - I didn't set the passwor
by zhoutong 14y ago
Well I do agree with you that Bitcoinica was not 100% secure. This hack really has nothing to do with the app or its infrastructure.
- I didn't set the password.
- I didn't have the power to change the password.
- I shouldn't have access to the account.
The root cause is LastPass account being stolen.
- mmcnickle 14y agoAgreed that you are not personally responsible for this particular attack, though I see it as the latest in a series of cascading failures, beginning with the initial attack. It's the lack of consideration of security - that can only be baked in from the outset - that's the real root cause. If the application had been self-hosted in a physically secured location, the attack that exposed the LastPass credentials would not have happened (email reset of root passwords). It may not be cool, but the cloud/consumer-level hosting is not appropriate for applications handling large sums of money.
- zhoutong 14y agoAgreed. But one of the team members explicitly released the source code and that caused the hacker to correctly guess LastPass account. (At least this is the most "right" version of the story I've heard.)