4 ms·

I think the first and most expensive hire should be a top-notch security expert. There have been too many screw-ups in the Bitcoin space and a hack at this lev

by jboggan 14y ago

I think the first and most expensive hire should be a top-notch security expert. There have been too many screw-ups in the Bitcoin space and a hack at this level of prominence would be disastrous for the community.

rmc 14y ago
Agreed. Aside from the obvious "companies dealing with money need much better security", bitcoin itself has a bad rep, being security amateur hour. They need to fight this head on, and show they aren't idiots.
- waterlesscloud 14y ago
  Their Security page offers some hope in that direction. http://support.coinbase.com/customer/portal/articles/628970-how-do-i-know-you-won-t-get-hacked- http://support.coinbase.com/customer/portal/articles/628970-...
  - jboggan 14y ago
    Yes but the big problem really boils down to "What % of the total bitcoin deposits are in the hot wallet at any given time?" To me bitcoin security should first be concerned with minimizing this number in any way possible. Hacks will happen; the companies involved need to make sure it's never worth their time.
    - toomim 14y ago
      ...and last I heard, coinbase keeps most coins hot! They need to fix this. Brian (ceo) doesn't recommend keeping lots of money there yet for this reason.
    - trotsky 14y ago
      If you want to be taken seriously as an online wallet then do what every other currency depository does - tell the public about your 3rd party deposit insurance, and tell your insurer about your security. Anyone unable or unwilling to secure insurance has essentially made their advertising slogan "we might as well rob you ourselves"
      - illuminate 14y ago
        "we might as well rob you ourselves" Which appears to be the motto for most all of the wallet-thefts so far.
Greynum 14y ago
I don't think bitcoin related sites have less security than other sites that claim to be secure, it just that they are such a high value target and attract the attention of nearly all criminal hackers. Also nearly all of the thefts that occurred where a result of a compromised email account which eventually led to root level access of the server through a virtual server console. Not as a result of bad programming that led to an exploit.
- hnolable 14y ago
  All the incidents to date except the first Bitcoinica heist were due to bad security practices one way or another. Even that one could be considered bad security practices by trusting that Linode was secure. That said, I expect we will see some really hardcore Bitcoin security incidents in the future that rival state sponsored hacking. Stealing Bitcoin requires no additional effort to profit. Since Bitcoin is money and easily made anonymous, stealing Bitcoin == profit. Therefore there exists an arbitrage opportunity between the cost of buying 0-day exploits and the Bitcoins that can be stolen by use of those exploits. I expect as Bitcoin goes up in value so will the cost of a certain class of exploit. What kind of software stack would you run if you were operating a Bitcoin bank that held a large amount of funds?
  - mey 14y ago
    This is the downside of Bitcoin's operating in a cash like nature. There is no FDIC for these "banks", the bank walls are digital and porous in ways unknown, and the bank can be robbed across international boundaries. What these companies need is insurance, but that insurance would be very hard/impossible to obtain.
    - Dylan16807 14y ago
      On the plus side, the way transactions work, the vault never needs to be connected to any networks at all. Hot storage is risky but cold storage is extremely safe.
      - 14y ago
TallboyOne 14y ago
That and get a better site design that doesn't use bootstrap. It looks like I'm staring at some early, somewhat-thought out prototype.
h2s 14y ago
It is really getting quite silly at this point. People keep building Bitcoin infrastructure in regular data centres as if that's perfectly sufficient. Check out this article about security at a Visa data centre: http://www.usatoday.com/tech/news/story/2012-03-25/visa-data-center/53774904/1 http://www.usatoday.com/tech/news/story/2012-03-25/visa-data... It even has a moat! Here's an article that illustrates the kind of scrutiny faced by banks when it comes to their data protection practices: http://www.finextra.com/news/fullstory.aspx?newsitemid=22595 http://www.finextra.com/news/fullstory.aspx?newsitemid=22595 It's incredibly stringent stuff and banks get fined hard when they fuck it up. By contrast, one of the recent Bitcoin heists was made possible because the hackers requested a password reset for the exchange's Rackspace account. Seriously.

by jboggan 14y ago

rmc 14y ago

Agreed. Aside from the obvious "companies dealing with money need much better security", bitcoin itself has a bad rep, being security amateur hour. They need to fight this head on, and show they aren't idiots.

waterlesscloud 14y ago
Their Security page offers some hope in that direction. http://support.coinbase.com/customer/portal/articles/628970-how-do-i-know-you-won-t-get-hacked- http://support.coinbase.com/customer/portal/articles/628970-...
- jboggan 14y ago
  Yes but the big problem really boils down to "What % of the total bitcoin deposits are in the hot wallet at any given time?" To me bitcoin security should first be concerned with minimizing this number in any way possible. Hacks will happen; the companies involved need to make sure it's never worth their time.
  - toomim 14y ago
    ...and last I heard, coinbase keeps most coins hot! They need to fix this. Brian (ceo) doesn't recommend keeping lots of money there yet for this reason.
  - trotsky 14y ago
    If you want to be taken seriously as an online wallet then do what every other currency depository does - tell the public about your 3rd party deposit insurance, and tell your insurer about your security. Anyone unable or unwilling to secure insurance has essentially made their advertising slogan "we might as well rob you ourselves"
    - illuminate 14y ago
      "we might as well rob you ourselves" Which appears to be the motto for most all of the wallet-thefts so far.

Greynum 14y ago

I don't think bitcoin related sites have less security than other sites that claim to be secure, it just that they are such a high value target and attract the attention of nearly all criminal hackers. Also nearly all of the thefts that occurred where a result of a compromised email account which eventually led to root level access of the server through a virtual server console. Not as a result of bad programming that led to an exploit.

hnolable 14y ago
All the incidents to date except the first Bitcoinica heist were due to bad security practices one way or another. Even that one could be considered bad security practices by trusting that Linode was secure. That said, I expect we will see some really hardcore Bitcoin security incidents in the future that rival state sponsored hacking. Stealing Bitcoin requires no additional effort to profit. Since Bitcoin is money and easily made anonymous, stealing Bitcoin == profit. Therefore there exists an arbitrage opportunity between the cost of buying 0-day exploits and the Bitcoins that can be stolen by use of those exploits. I expect as Bitcoin goes up in value so will the cost of a certain class of exploit. What kind of software stack would you run if you were operating a Bitcoin bank that held a large amount of funds?
- mey 14y ago
  This is the downside of Bitcoin's operating in a cash like nature. There is no FDIC for these "banks", the bank walls are digital and porous in ways unknown, and the bank can be robbed across international boundaries. What these companies need is insurance, but that insurance would be very hard/impossible to obtain.
  - Dylan16807 14y ago
    On the plus side, the way transactions work, the vault never needs to be connected to any networks at all. Hot storage is risky but cold storage is extremely safe.
    - 14y ago

TallboyOne 14y ago

That and get a better site design that doesn't use bootstrap. It looks like I'm staring at some early, somewhat-thought out prototype.

h2s 14y ago

It is really getting quite silly at this point. People keep building Bitcoin infrastructure in regular data centres as if that's perfectly sufficient. Check out this article about security at a Visa data centre: http://www.usatoday.com/tech/news/story/2012-03-25/visa-data-center/53774904/1 http://www.usatoday.com/tech/news/story/2012-03-25/visa-data... It even has a moat! Here's an article that illustrates the kind of scrutiny faced by banks when it comes to their data protection practices: http://www.finextra.com/news/fullstory.aspx?newsitemid=22595 http://www.finextra.com/news/fullstory.aspx?newsitemid=22595 It's incredibly stringent stuff and banks get fined hard when they fuck it up. By contrast, one of the recent Bitcoin heists was made possible because the hackers requested a password reset for the exchange's Rackspace account. Seriously.