4 ms·

"the attacker gained accesses to an unencrypted backup of the wallet keys" <shakes head> What is with these bitcoin exchanges and their pathetic records on se

• wmf 14y ago
  Hey man, they're just doing lean MVPs.
  • meepmorp 14y ago
    I guess they just tend to use a somewhat different value for viable than I might.
• jamescun 14y ago
  Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure and STILL have the occasional lapse in security; how do you think a couple of guys in their spare time will fare?
  • wickedchicken 14y ago
    > Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure Those banks are often guarding a considerably larger amount of money, which is something to take into consideration. I think your point still stands though.
  • spamizbad 14y ago
    A bank's software infrastructure and "attack surface" dwarfs these tiny bit coin exchanges. Banks also have byzantine processes and guidelines that encumber their technical teams so building their software is inherently costly regardless of security. Meanwhile unregulated, nimble BitCoin exchanges struggle with the OWASP top 10.
    • ajross 14y ago
      I'm not quite sure I buy that. Obviously banks are more complicated. But because of the regulatory environment what they are not is "just servers on the internet". You can break into a bitcoin exchange and steal BTC by copying data. You can't do that with a bank -- banks can only transfer electronically to other banks, and "being a bank" is a tightly regulated state. So while the complexity is there, it's not clear to me that it correlates to an "attack surface" in the sense network security people use the term.
• genwin 14y ago
  The quote makes sense if you want some plausible deniability for an inside job.
• dclusin 14y ago
  I work for a finance related technology provider and as a consequence get to see the technology practices of many brokers and other market makers. Often times their security is just as bad. The key difference is that trade settlement (a.k.a clearing) is a separate process (usually also separate company from exchange). This adds a layer of security because compromising the exchange doesn't always get you access to the clearing details. Clearing details are usually things like "Depoist X million dollars in bank account A, I will deposit x million euros in your bank account B." With Bitcoin quoting, trading, and clearing are all rolled into one.
• fusiongyro 14y ago
  Moreover, how is it going to go mainstream without mainstream exchanges? If these bitcoin thefts continue putting exchanges out of business, the thieves will wind up with a big pile of currency nobody is willing to convert back into dollars.
• JulianMorrison 14y ago
  It's hacker attitude. Build what seems like it will work, and launch. The true flaw of hacker attitude is underestimation of the job by focusing on the part that looks straightforward, namely the part in code. A bitcoin bank is the application. The bit that's written in code is just a part of it. The actual spec is: under all circumstances, this will either work as a bitcoin bank, or fail safe, or in the worst possible case fail with data loss. That spec requires you to examine the behaviors of the system as a system - you may be sure your opponents see it as such.