Hacker News Reader

Comment by Veen | Hacker News Reader

Right. The "thief" would have to be extremely lucky to have been intercepting the right data, recognized what the key was, and used it. As mentioned in the story, I suspect this chap found the vulnerability and is hoping to parlay it into a payout.

View on HN

No, more than that: assuming the connection to the spell checker uses TLS, the thief would have to be Google.

I'd be surprised if it doesn't use TLS?

The thief in that case would likely be a browser extension

It's a desktop app.

There was another instance of a massive coin theft a year or so ago and the weak link again was the recovery seed being sent to a Google server. The guy described his operational security and it seemed like he did everything right. The only slip up he could point to was that he had mistakenly pasted his seed into his Chrome address bar (which then performs an automatic lookup). It was shortly after that when his funds were drained.

I'm certainly not saying it was someone at Google, but it would be a mistake to not consider them an adversary in the battle to secure your funds.

A ton of people use GMail for their crypto accounts.

Claiming that someone at Google stole the funds is quite an extraordinary claim. You should have more proof than just the seed being sent to their spellchecker.

I'm not sure what the volume of gmail accounts is supposed to demonstrate. But gmail is known to be high value, and so it stands to reason that internal safeguards around access to gmail accounts would be much greater than data from a spellcheck API or search autocomplete.

It certainly is an extraordinary claim, but there does come a point where the totality of evidence points to the likelihood of it. I'm not saying we're at that point, but in my mind we've reached the point of reasonably possible.

Spellcheck API or autocomplete is also expected to end up with a ton of sensitive information sent to it. I would expect them to either not keep logs of the actual query strings to begin with, or heavily restrict access to them.

That's the weak link they knew about. It is very unlikely to be the actual weak link.

So, I'm not super familiar with crypto/blockchain beyond reading a couple academic papers but... how can you use it "offline"?

I saw someone in the parent comments mention that using your phrase on a machine connected to the internet can be risky... how can you make use of those coins then? Do you download some onto a usb to manually transfer over?

You identify yourself to the network as the legitimate owner of an address by signing a transaction with a private key for that address. So using your coins offline involves signing your transaction using a computer that is air-gapped and then manually transferring the signed transaction to the online computer to be pushed to the network. There are user friendly ways of doing this using QR codes and similar things.

Thanks for the explanation.

or wait for google to "anonymize" the data and release it internally for their researchers.

Reply on news.ycombinator.com