5 ms·

Before people start commenting on how bitcoin needs this or that or predict the doom of bitcoin, read the article: this has nothing to do with bitcoin's securit

by jordigh 13y ago

Before people start commenting on how bitcoin needs this or that or predict the doom of bitcoin, read the article: this has nothing to do with bitcoin's security. The attack was perpetrated in the most inane social engineering way, and actually, the bitcoin exchange was smart enough to not put all of its bitcoins in the same basket, so 100,000 CAD worth of bitcoin is not a death blow to this exchange.

sharpneli 13y ago
Most of real world fraud is exactly this kind of stuff. Bitcoin solves a problem which is not actually a problem in real world. And leaves the problems which actually are problems unsolved. Don't get me wrong. The proof of work ledger is a cool idea. However using it as a currency in this kind of implementation with complete disregard to anything else doesn't work in the long term.
- jordigh 13y ago
  The decentralised check against double-spending is bitcoin's only solution. And it's quite a genius solution, in a way. Bitcoin is not the first cryptocurrency, but it's the first decentralised one. Other than that, bitcoin behaves more like cash than like banks or credit cards. You can build banks and credit cards around bitcoin, and you should, but bitcoin itself is just like cash, and that's all it should be. It doesn't need to solve other problems that as you say have already been solved by systems like two-factor authentication and the like. This particular attack is more like thieves walking into a bank and claiming to be a person and then being able to get cash from the bank's safe (an analogy that also fits nicely with the relatively small amount of money they were able to steal). It is not like being able to rack up fraudulent charges on a credit card.
- wyager 13y ago
  >Bitcoin solves a problem which is not actually a problem in real world. Well, it solves more than one problem, and a few of them are certainly real-world. >However using it as a currency in this kind of implementation with complete disregard to anything else doesn't work in the long term. Would you care to expand on what you mean by "complete disregard to anything else"? I mean, clearly this is hyperbole, but I'm curious what you are referencing specifically.
  - sharpneli 13y ago
    I simply meant that the bitcoin as a protocol and the standard client implementation right now pretty much ignores everything else. Some can be fixed on the client but it is not there yet. As an example the wallet is unencrypted by default. In addition one of the biggest problems with bitcoin stems from the problem it solves. Transactions cannot be reversed, thus making thefts extremely lucrative. Normal banks simply reverse transactions if they are fraudulent. As an example someone hacked Nordea (Bank operating in Nordic countries) last spring and got away with 600 000 euros. All of the transactions except one were reverted and the missing one was compensated by the bank.
    - lhgaghl 13y ago
      > Normal banks simply reverse transactions if they are fraudulent. That's not a feature.
      - svenkatesh 13y ago
        Right, fraudsters should be allowed to keep their ill-gotten gains.
        lhgaghl 13y ago
        Rephrased: it is a feature, but it implies a tradeoff: people who are considered more important than you control your money. One which I don't consider worth it. I've never had a problem with stolen assets of any kind other than in the physical world, and I consider my physical assets that were stolen fair, I would not want a God government who can see every single thing that happens in any place and any time so they can recover my physical assets.
- wlphoenix 13y ago
  I only have a vague memory/understanding the subject, but I believe the Bitcoin protocol supports the concept of multi-signature contracts. That could be used to create decentralized escrow/trading/exchanges, which means that you would never have to let a single entity control your private keys. (https://en.bitcoin.it/wiki/Contracts https://en.bitcoin.it/wiki/Contracts) I don't think there is a working implementation of the multisig contracts in the wild yet, but the protocol does support a way to solve these problems.
  - gnaritas 13y ago
    That won't work for traders, transactions on the blockchain are too slow to do what exchanges really do. Traders would not use such an exchange, it'd be too slow.
- lhgaghl 13y ago
  > Most of real world fraud is exactly this kind of stuff. So what? Banks have the same problem. If I call up my bank and ask them to do something, they'll ask for a bunch of random information I didn't know I'm supposed to keep secret. > Bitcoin solves a problem which is not actually a problem in real world. What? It solves the problem where some incompetent fucks are in charge of your money and screw you over, which is exactly what happened to this company (except they trusted them with hosting instead of money)
jzwinck 13y ago
This has everything to do with Bitcoin. Yes, the attack vector is old and boring, but it's a proven one that has been used more or less the same way to hack multiple Bitcoin exchanges. Bitcoin transactions are irreversible, so there is no way to get back stolen coins. And there is insufficient consensus to block them from being spent in future. These, combined with the magical pure-virtual, ethereal nature of Bitcoin, makes it an unprecedented target for thieves. Maybe Bitcoin can yet be extricated from these issues, but the basic system Nakamoto gave us does not address the needs we so clearly have. Given the track record of so many exchanges and other services, we have a long, long way to go.
- jordigh 13y ago
  > Bitcoin transactions are irreversible So are cash transactions. People need to think of bitcoins more like cash than like credit cards.
  - danielsamuels 13y ago
    But if I get robbed, I can contact the police and there are consequences if the thieves are caught. If my car gets stolen I have insurance I can claim off. There's no such thing with Bitcoin.
    - mikeash 13y ago
      Why not? As far as I know, the law will treat your bitcoins like any other property you own. It's not legal to steal them just because they're "bitcoins", nor are they inherently uninsurable. Now, whether that's an effective deterrent and whether there's a realistic chance of catching the thieves is a big question, but there's nothing inherently different. It's not that hard to rob your house of cash and not get caught either. The main reason it doesn't happen is because the criminals who are good enough to do it have bigger fish to fry. If they found out that you had $100,000 under your mattress then there would be trouble.
    - jordigh 13y ago
      Neither of those things are impossible to build around bitcoins. If you catch the thieves, you can probably get the bitcoins back. The currency used has nothing to do with whether it's possible to build insurance around it.
mikeash 13y ago
Surely the fact that the attack was so inane does comment on bitcoin's security. OK, not the inherent security of the basic protocol, but the actual real-world security of real-world implementations. You'd never store $100,000 actual dollars in a place where the employees let anyone walk in and take it if they just claim to be you. Bitcoins are equivalent to cash but they are not being stored anything like how cash is stored. It's a fundamentally difficult problem that bitcoin requires you to solve, so I think this really is highly related to bitcoin's security.
- jordigh 13y ago
  Although bitcoins are more like cash than like credit cards, their ethereal nature allows you to lock them up in ways that cash that cannot be: encrypt them (i.e. you encrypt the files that contain the private keys). This is not a solution that bitcoin itself needs to build into the protocol. It's just something that we already have that should be used when using bitcoin. People are taking a while to get used to the idea of securing a decentralised currency.
  - sp332 13y ago
    Encrypted wallet are already supported in most bitcoin client implementations.
- dobbsbob 13y ago
  They could have kept the hot wallet req multisig to move coins, then backed it up somewhere else so even deletion wouldn't be a problem. It's all the low hanging fruit getting fleeced Bitcoin protocol offers plenty of safeguards if you use it
whyme 13y ago
Do we really need comments telling people to read the article before commenting?
- jordigh 13y ago
  Or at least to read it carefully. I see the occasional commenting on HN that seems to neglect certain things mentioned in the article.

by jordigh 13y ago

sharpneli 13y ago

Most of real world fraud is exactly this kind of stuff. Bitcoin solves a problem which is not actually a problem in real world. And leaves the problems which actually are problems unsolved. Don't get me wrong. The proof of work ledger is a cool idea. However using it as a currency in this kind of implementation with complete disregard to anything else doesn't work in the long term.

jordigh 13y ago
The decentralised check against double-spending is bitcoin's only solution. And it's quite a genius solution, in a way. Bitcoin is not the first cryptocurrency, but it's the first decentralised one. Other than that, bitcoin behaves more like cash than like banks or credit cards. You can build banks and credit cards around bitcoin, and you should, but bitcoin itself is just like cash, and that's all it should be. It doesn't need to solve other problems that as you say have already been solved by systems like two-factor authentication and the like. This particular attack is more like thieves walking into a bank and claiming to be a person and then being able to get cash from the bank's safe (an analogy that also fits nicely with the relatively small amount of money they were able to steal). It is not like being able to rack up fraudulent charges on a credit card.
wyager 13y ago
>Bitcoin solves a problem which is not actually a problem in real world. Well, it solves more than one problem, and a few of them are certainly real-world. >However using it as a currency in this kind of implementation with complete disregard to anything else doesn't work in the long term. Would you care to expand on what you mean by "complete disregard to anything else"? I mean, clearly this is hyperbole, but I'm curious what you are referencing specifically.
- sharpneli 13y ago
  I simply meant that the bitcoin as a protocol and the standard client implementation right now pretty much ignores everything else. Some can be fixed on the client but it is not there yet. As an example the wallet is unencrypted by default. In addition one of the biggest problems with bitcoin stems from the problem it solves. Transactions cannot be reversed, thus making thefts extremely lucrative. Normal banks simply reverse transactions if they are fraudulent. As an example someone hacked Nordea (Bank operating in Nordic countries) last spring and got away with 600 000 euros. All of the transactions except one were reverted and the missing one was compensated by the bank.
  - lhgaghl 13y ago
    > Normal banks simply reverse transactions if they are fraudulent. That's not a feature.
    - svenkatesh 13y ago
      Right, fraudsters should be allowed to keep their ill-gotten gains.
      - lhgaghl 13y ago
        Rephrased: it is a feature, but it implies a tradeoff: people who are considered more important than you control your money. One which I don't consider worth it. I've never had a problem with stolen assets of any kind other than in the physical world, and I consider my physical assets that were stolen fair, I would not want a God government who can see every single thing that happens in any place and any time so they can recover my physical assets.
wlphoenix 13y ago
I only have a vague memory/understanding the subject, but I believe the Bitcoin protocol supports the concept of multi-signature contracts. That could be used to create decentralized escrow/trading/exchanges, which means that you would never have to let a single entity control your private keys. (https://en.bitcoin.it/wiki/Contracts https://en.bitcoin.it/wiki/Contracts) I don't think there is a working implementation of the multisig contracts in the wild yet, but the protocol does support a way to solve these problems.
- gnaritas 13y ago
  That won't work for traders, transactions on the blockchain are too slow to do what exchanges really do. Traders would not use such an exchange, it'd be too slow.
lhgaghl 13y ago
> Most of real world fraud is exactly this kind of stuff. So what? Banks have the same problem. If I call up my bank and ask them to do something, they'll ask for a bunch of random information I didn't know I'm supposed to keep secret. > Bitcoin solves a problem which is not actually a problem in real world. What? It solves the problem where some incompetent fucks are in charge of your money and screw you over, which is exactly what happened to this company (except they trusted them with hosting instead of money)

jzwinck 13y ago

This has everything to do with Bitcoin. Yes, the attack vector is old and boring, but it's a proven one that has been used more or less the same way to hack multiple Bitcoin exchanges. Bitcoin transactions are irreversible, so there is no way to get back stolen coins. And there is insufficient consensus to block them from being spent in future. These, combined with the magical pure-virtual, ethereal nature of Bitcoin, makes it an unprecedented target for thieves. Maybe Bitcoin can yet be extricated from these issues, but the basic system Nakamoto gave us does not address the needs we so clearly have. Given the track record of so many exchanges and other services, we have a long, long way to go.

jordigh 13y ago
> Bitcoin transactions are irreversible So are cash transactions. People need to think of bitcoins more like cash than like credit cards.
- danielsamuels 13y ago
  But if I get robbed, I can contact the police and there are consequences if the thieves are caught. If my car gets stolen I have insurance I can claim off. There's no such thing with Bitcoin.
  - mikeash 13y ago
    Why not? As far as I know, the law will treat your bitcoins like any other property you own. It's not legal to steal them just because they're "bitcoins", nor are they inherently uninsurable. Now, whether that's an effective deterrent and whether there's a realistic chance of catching the thieves is a big question, but there's nothing inherently different. It's not that hard to rob your house of cash and not get caught either. The main reason it doesn't happen is because the criminals who are good enough to do it have bigger fish to fry. If they found out that you had $100,000 under your mattress then there would be trouble.
  - jordigh 13y ago
    Neither of those things are impossible to build around bitcoins. If you catch the thieves, you can probably get the bitcoins back. The currency used has nothing to do with whether it's possible to build insurance around it.

mikeash 13y ago

Surely the fact that the attack was so inane does comment on bitcoin's security. OK, not the inherent security of the basic protocol, but the actual real-world security of real-world implementations. You'd never store $100,000 actual dollars in a place where the employees let anyone walk in and take it if they just claim to be you. Bitcoins are equivalent to cash but they are not being stored anything like how cash is stored. It's a fundamentally difficult problem that bitcoin requires you to solve, so I think this really is highly related to bitcoin's security.

jordigh 13y ago
Although bitcoins are more like cash than like credit cards, their ethereal nature allows you to lock them up in ways that cash that cannot be: encrypt them (i.e. you encrypt the files that contain the private keys). This is not a solution that bitcoin itself needs to build into the protocol. It's just something that we already have that should be used when using bitcoin. People are taking a while to get used to the idea of securing a decentralised currency.
- sp332 13y ago
  Encrypted wallet are already supported in most bitcoin client implementations.
dobbsbob 13y ago
They could have kept the hot wallet req multisig to move coins, then backed it up somewhere else so even deletion wouldn't be a problem. It's all the low hanging fruit getting fleeced Bitcoin protocol offers plenty of safeguards if you use it

whyme 13y ago

Do we really need comments telling people to read the article before commenting?

jordigh 13y ago
Or at least to read it carefully. I see the occasional commenting on HN that seems to neglect certain things mentioned in the article.