9 ms·
Instawallet Hacked
- dcc1 14y agoWhat made Instawallet better than Blockchain for an online wallet? why did people use it? what was the selling point??
- acebarry 14y agoBurner bitcoin addresses. When you loaded the site you got a fresh wallet with one address. It would help people stay anonymous.
- bdcravens 14y agoLooks like the address isn't all that was burning...
- GigabyteCoin 14y agoWho ever said that it was better? No online wallets are secure, nobody should be using them, but unfortunately the bitcoin system is still a bit too complicated for a lot of people.
- adrr 14y agoThis what i don't get. Banks can secure themselves, large e-commerce sites as well. Do any of these guys run Hardware security modules and use them to manage encryption of the keys?
- GigabyteCoin 14y agoInstawallet's only form of a login was a URL, which Google indexed 1,000s of just last week: http://www.adaptiveglass.com/?p=656 http://www.adaptiveglass.com/?p=656 Honestly, I am curious if the security researcher (who alerted them to this problem and then griped out lack of payment in the article) is the person responsible.
- smtddr 14y agoYa know, that blog you linked to - I don't like that he's upset he didn't get a reward for his good deed. He should be just happy to do a good deed, IMHO.
- danielweber 14y agoYeah, if you were expecting a reward, it's not a good deed. I informed some BTC places of security problems a few years ago, and was roundly ignored, although they put the fixes in place, from what I recall. I wasn't upset because I wasn't expecting anything. EDIT Reading that page . . . depending on a URL staying secret as your security? Wow, that is asking for disaster. I don't like to shame people who make security mistakes, but if you are online wallet vendor, shouldn't you have some common sense?
- deleted 14y ago[deleted]
- acebarry 14y agoInstawallet always made it clear that no one should keep anything more than spare change there.
- GigabyteCoin 14y agoI don't think they said that on the homepage, they advertised themselves as a bitcoin wallet. They did say so at one time or another I believe, but that was long long ago.
- ams6110 14y agoGiven the recent trends in Bitcoin values, yesterday's spare change was today's real money.
- tlrobinson 14y agoIt's not that it's impossible to for online wallets to be secure, it's that most of the people implementing them are amateurs when it comes to security. The Bitcoin industry needs bank level security. They're doing some things right (most exchanges offer 2FA), but they've got a long ways to go.
- wmf 14y agoNobody besides Gox is making enough money to afford real security AFAIK.
- haakon 14y agoWhen depositing to Instawallet, your money would be stored in a common pool, so upon withdrawal you'd get different coins back. So it functioned as a "mixing service", which helps improve anonymity for those who need that. And it was super easy to use, which made it popular with newbies with little understanding of how foolish it is to give a service like this full control over your money.
- facorreia 14y agoFrom the description, it sounds like a money laundering service.
- kami8845 14y agoNo that's already bitcoin itself.
- stcredzero 14y ago"Just use Bitcoin" is a money laundering meme governments should love.
- gesman 14y agoLol, and i think that's where it's main business came from. Law enforcement hired hackers to screw it and now awaiting at the front door to take a much closer look at everyone who'll start whining about lost funds. :)
- stcredzero 14y agoThey'd do much better to subvert it and observe the movement of funds.
- danielweber 14y agoYou made me think "if there's a site for online storage of wallets and someone has paid the amount of money needed for decent security for it, it's probably because the government is running it."
- jerguismi 14y agoIt wasn't better as in more secure, it was instant and easy. It was a low-security wallet designed for trying out bitcoin.
- afreak 14y agohttps://bitcointalk.org/index.php?topic=83794.0 https://bitcointalk.org/index.php?topic=83794.0 A good look at previous thefts. The last page contains links to the current Instawallet issue.
- deleted 14y ago[deleted]
- error54 14y agoI know it's been said many times before, but we're only going to see a rise in bitcoin thefts. With the price being over $100/coin and you're stealing virtually untraceable currency, I'm honestly just surprised that there hasn't been more thefts. I'm sure the security team at Mt. Gox is top notch as they probably have dozens of hack attempts per day.
- emgre 14y agoWhich is going to be a huge limit on sustained value/adoption, for better or worse. Bitcoin's rooted in the community most capable of stealing it.
- nym 14y agoThe bitcoin community spends a ton of time trying to educate people on cold-storage wallets and two-factor authentication for online wallets. MtGox has even given away free YubiKeys in the past to help keep people's accounts secure. Does Chase or BofA anyone else offer that kind of security? :) https://en.bitcoin.it/wiki/Cold_storage https://en.bitcoin.it/wiki/Cold_storage https://mtgox.com/press_release_20120215.html https://mtgox.com/press_release_20120215.html
- lhc- 14y agoThe thing is, Chase and BoA are often capable of reversing fraud and catching the people behind it. Bitcoins don't really allow for that sort of restitution.
- tensafefrogs 14y agoBitcoin is not a bank, and does not replace banks. There's nothing stopping anyone from setting up a bank that handles your bitcoin transactions, and therefore can reverse transactions between two parties. Replace "Bitcoin" with "Dollar" and you see how strange your statement is.
- 14y ago
- bluetooth 14y agoI expect nothing less from Instawallet. Previously, they used to keep private keys in the URL and allowed google to index these URLs. It took a lot of pestering and hand-holding to get this fixed. I should have figured this would have happened sooner or later, given their incompetency regarding security.
- stcredzero 14y agoDunning-Kruger is an order of magnitude stronger for security.
- danielweber 14y agoIf you are doing security for a Bitcoin site, your motto should be "I am an idiot and am forgetting something very basic." Then you should try to figure out how to protect yourself from your own idiocy despite being stupid. And you should never assume you just got smart.
- wmf 14y agoAnd then a 17 year old launches before you and takes your customers.
- stcredzero 14y agoIn that case, you need to out-last the 17 year old until his site dies from the security breach.
- illuminate 14y agoAnd the 17 y/o takes their customers' wallets, what's your point?
- wmf 14y agoThe market can stay irrational longer than you can stay solvent. Everybody who tried to "do it right" (TradeHill, CampBX, etc.) seems to have failed while users flock to the joker du jour.
- jonjohn84 14y agologo link on this notice page points to localhost:3000, looks like dev/prod mixup
- shocks 14y agoHow many more times do we need to go through this? People: Only keep an amount you are willing to lose in an online wallet. Keep the rest offline and encrypted.
- GigabyteCoin 14y agoIf only "Keep the rest offline and encrypted." didn't sound like Charlie Brown's teacher speaking to 99% of the world...
- danielweber 14y agoIf you are using it as a currency, "offline and encrypted" is "unusable." If you are using it as a commodity to trade, well, it's perfect.
- bigiain 14y agoMaybe. Perhaps it might be useful to compare online bitcoin storage with cash in your pocket. You wouldn't convert your entire nett worth to cash, stick it in your pocket (or for "added security", hide it in your sock!) then go out clubbing. Unless you're about to buy a car or a house with bitcoin, there's no need to store tens or hundreds of thousands of dollars worth in an immediately useable (and hence potentially stealable) status.
- GigabyteCoin 14y agoGiven the fact that instawallet was rarely used in the previous few years, I doubt this will have much of an impact on the Bitcoin market: http://www.alexa.com/siteinfo/instawallet.org http://www.alexa.com/siteinfo/instawallet.org
- itsprofitbaron 14y agoFWIW Alexa isn't accurate and can easily be gamed.
- GigabyteCoin 14y agoI am aware, but at least it doesn't look like this: http://www.alexa.com/siteinfo/bitcoin.org http://www.alexa.com/siteinfo/bitcoin.org Faking a high alexa ranking may be possible, but faking a low alexa ranking is not. You can't fake the fact that next to nobody went to instawallet.
- itsprofitbaron 14y agoI'm talking about the sites with a lower alexa ranking who potentially are gaming the results. For instance, I have a "junk" site (its kindof lame) which took about ~30 minutes of my time to make in 2007 and I haven't touched it since and this site is by far the largest in its niche. I know it’s the largest in the niche because, I know some of the other webmasters in this niche & we’ve shared traffic info. Anyway my “junk” site has a significantly higher alexa ranking than its competitors - for instance they are nearly in the top 100k (they get ~60-70% of the traffic) and this site is nowhere near that.
- X-Istence 14y agoHow does Alexa get the information to rank websites? From a toolbar a user has to install ... maybe the people using some place like instawallet wouldn't be too keen on sharing data with a 3rd party.
- illuminate 14y ago"Faking a high alexa ranking may be possible, but faking a low alexa ranking is not." You need to be the sort of idiot who runs feature-free bloatware before you can contribute to their ranking system.
- scottrblock 14y agoAlso troubling is their logo links to localhost:3000. Why would you hard link that in the first place?
- joecurry 14y ago>> If several claims have been filed for the same url, we will process those claims on a case by case basis, under the presumption that the claim we received first belongs to the legitimate balance holder. Is this a joke? They can't be serious.
- GigabyteCoin 14y agoAnd when all of their wallet URLs were indexed in Google, I am pretty sure they're saying that nobody is getting a refund here.
- vshastry 14y agoThis type of incident is a key reason the US Treasury's Financial Crimes Enforcement Network ("FinCEN") issued sensible guidance requiring those who offer wallet (bitcoin transfers between persons and/or merchants) and currency conversion services to be regulated as money transmitters. While money transmitter regulation isn't perfect and is expensive for providers, it can provide some consumer protections in these scenarios. Edit: Forgot to link to their guidance http://fincen.gov/statutes_regs/guidance/html/FIN-2013-G001.html http://fincen.gov/statutes_regs/guidance/html/FIN-2013-G001....
- justplay 14y agoshit
- ChuckMcM 14y agoThis [https://news.ycombinator.com/item?id=5475389 https://news.ycombinator.com/item?id=5475389] conversation suggests that there might have been a very large withdrawal of funds just prior to the system shutdown. It points out again how careful you have to be when suddenly there is "real money" on the line. I've yet to see the "exit strategy" where an enterprising crook sets up an exchange and then loots it once its net value is high enough. But I would not be surprised to see that happen. It has happened in the brick and mortar world with banks, no reason it shouldn't be any different in the digital world.
- gesman 14y agoSo everyone knows the destination address of fraudulent transfer. I wonder if it would make sense to mark it as "dirty" and mark as "dirty" every other address where the funds will be transferred from this address. And then every legitimate merchant, after receiving bitcoin payment would validate incoming address against "dirty" list to allow tracking of thief? This of course works only if every merchant and service in bitcoin world would do that. Just an idea ...
- zorpner 14y agoThe counterattack to this is to transfer small amounts of the "tainted" btc to the addresses of the people who are leading the effort (or to outgoing addresses for large exchanges, faucets, and so on). This is effectively the same as laundering through dice/the late instawallet/et cetera
- erikpukinskis 14y agoI doubt the miners would accept this idea. It goes against a key principle of Bitcoin: that transactions are irreversible and no authority can appropriate your coins. Even the 0.8->0.7 reversal was hard for some miners to swallow. And in that case it was only accepted because only doubly-spent transactions would be reversed. Singly-spend transactions would just transfer over to the new chain. I don't expect to ever see a Bitcoin fork where a cryptographically valid, singly-spent, included-in-a-block transaction is reversed.
- bencevans 14y agoClicking the logo directs the user to http://localhost:3000 http://localhost:3000. On a side note... New Business plan: 1. Setup an online Bitcoin wallet service 2. Wait a while till people actually trust/use it 3. "We got hacked"
- jcoder 14y ago>On a side note... New Business plan: > >1. Setup an online Bitcoin wallet service 2. Wait a while till people actually trust/use it 3. "We got hacked" Something tells me you're not the first to come up with this.
- TillE 14y agoVery high risk for moderate reward, assuming you're based in a country with functioning law enforcement.
- gcb0 14y agonot suggesting this is what happened as it's the first time i even hear about them. but i've seen people do worse illegal risk/reward decisions before. much worse.
- iaw 14y agoDepends on the countries laws. What makes you think anyone attorney is going to prosecute the theft of a "digital currency." At this time in the world most people when informed of bitcoin think it's a toy currency.
- makomk 14y agoLaw enforcement aren't necessarily terribly keen on pursuing difficult crimes, especially when the victims are as uncooperative with the investigation as Bitcoin users have historically been
- jerguismi 14y agoIt is impossible to prove either way.
- drivebyacct2 14y agostop. storing. your. wallet. online. (I wanted to write this in caps, but I resisted) I'll add this to my list of things that people know they should do but are too lazy to take a few minutes and setup: don't repeat passwords, use a password manager, make regular backups, don't use GoDaddy. Stop thinking you're the exception dammit, these things don't take that much effort to do properly.
- tensafefrogs 14y agoTo me, this signals a strong need for more secure bitcoin storage options, and since this is hacker news, perhaps some of us should get started on that :)
- drivebyacct2 14y agoPaper wallets are easy to make and relatively easy to use. Slightly harder to spend money with. I suppose someone could customize a small Linux live CD to boot, not touch the hard drives, load an encrypted wallet off a secure jump drive and encourage backups. It's fairly straightforward if you use a dm-crypted jumpdrive and, say for example, Tails.
- danielweber 14y agoI think I could do a pretty good job keeping wallets secure. But it would need to be a full-time job, not a side project, and it would need a big budget. You don't bootstrap a bank. (Plus I did some basics with Bitcoin a few years ago and got pissed off at the protocol and moved onto less annoying things.)
- M4v3R 14y agoI don't like to spam with links, but http://www.bitalo.com http://www.bitalo.com aims to be the service you described, and will be launched soon. "Most secure" really means that no one, even the site admins/hosting platform can never touch your coins. This will be enforced by the technology used, not just some internal policies. And also, the site will be backed by a german AG company, which is basically a type of "Public limited company" backed by minimum of 50,000 EUR.
- Ixiaus 14y agoIn an authority-less and irreversible transaction currency it still surprises me when I hear about someone losing money to a service such as this - without an authority the burden of security truly is on the user themselves and they are at the mercy of the (supposed) security of whatever exchange or service they are attempting to use. In this case, having someone manage your wallet for you. I personally keep my bitcoin wallet encrypted with GPG, I manually (like a safe) decrypt it when I want to make a bitcoin transaction and encrypt it when I'm done.
- jellicle 14y ago> Instawallet hacked Another alternative is that the Instawallet people just decided to keep the "money" you had stored there, and retire to a small Caribbean island. You'll never know.
- marshallford 14y agoI use coinbase. How long until they are hacked? Who can I trust! This is the one con to bitcoin.
- SkyMarshal 14y agoWow, could become a clusterfuck of epic proportions: 1. It takes three months to get you BTC back, and only up to a max of 50. If you have more, it will take longer. 2. If the hackers can figure out your url and key, they can dispute your claim. If they actually get their claim in before your legit claim, their claim is favored. Yikes. I would not want to be either an Instawallet employee having to sort that mess, or a client with their BTC frozen for months and potentially at risk of being stolen. "Important information on claims submission: For the first 90 days we will accept claims for individual Instawallets. Your wallet's URL and key will be used to pre-populate a form to file the claim. After 90 days, if no other claim has been received for the same url, your Instawallet balance under 50 BTC will be refunded. If several claims have been filed for the same url, we will process those claims on a case by case basis, under the presumption that the claim we received first belongs to the legitimate balance holder. Claims for wallets that hold a balance greater than 50 BTC will be processed on a case by case and best efforts basis."
- shabble 14y agoIf this is what it sounds like, and the "exploit" was google indexing a bunch of URLs which allowed direct access to the funds they referenced, how did google discover them in the first place? There was mention of a missing/broken robots.txt which allowed GoogleBot to index them, but what I'm stuck on is how it learned about them in the first place; where they actually doing something utterly insane like autopublishing a sitemap, or was there some bug allowing g'bot to sniff/guess the URLs? I've seen odd behaviour in my logs from google crawls in the past, like g'bot traffic within minutes of adding a new DNS entry/vhost to a domain, with absolutely assuredly no mention of it publicly available. I suppose it's possible they're watching DNS zone changes and scheduling a tentative probe, but it's a bit creepy (especially if you're disorganised and haven't got the robots.txt set up right away)