Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

Another sad bitcoin story. Is it really all that surprising that if 'real' money was available to be stolen from non-bankers (who have a huge network of enforcement types at their disposal) that folks will come in and walk out with the money if they can?

I've not been following bitcoin closely, mostly just seeing the major screwups. But has anyone even started the process of a 'best practices' tutorial on keeping a bitcoin bank secure? (and these are depository banks, call them 'enthusiast websites' all you want but if they 'hold' a quantity of a good for others which has monetary value then they are a depository and should arm themselves appropriately)

View on HN

One of the major advantages bitcoin has is that it is decentralized. Placing your money in a bitcoin bank is simply unneeded.

Sure, keeping your BTC in an exchange's account may make it faster to exchange your BTC to USD, and you may see less transaction fees, but at the end of the day it means you have to trust the exchange to do the right thing.

Want to keep your coins safe? Secure your wallet.dat.

Pretty sure that if you want to trade BTC on an exchange, there's no other way but to deposit your currency in their wallet. Otherwise, how can the exchange ensure your counterparty that they'll get your money if your bids are matched? Same with real money exchanges, you have to deposit your money into their account before you can trade.

You are absolutely correct. But that doesn't really change anything.

Placing your BTC in an exchange's wallet means you are trusting that exchange. I don't really trust exchanges -- I still use them, but I never transfer extra BTC in, and I always transfer 100% of the BTC I buy into my wallet.

After the Mt. Gox hack, it came out that many people were buying BTC and leaving it in Mt. Gox' wallet. That's a colossal mistake; there is simply no reason to trust anyone else to hold your BTC.

Bitcoin exchanges will always exist and need to be secured. Bitcoin banks serve no purpose and should never exist.

Ah yes, completely agree there.

Exactly. Don't give someone 24/7 access to your bitcoins unless you are gaining enough from the situation to offset the enormous risk that your trust will be violated.

It's an interesting experiment in re-inventing currency trading. The lesson I'm taking away: if a currency can be stolen, it will. This is in contrast to the ACH transfer system, where fraud or theft can be reversed with some effort.

Perhaps there is no way to build a sufficiently secure untraceable, non-undoable cash system.

> . . . in contrast to the ACH transfer system, where fraud or theft can be reversed . . .

I am not sure, but I think Bitcoin transactions can be reversed, too, if enough nodes want to do so.

Most of the compromises of Bitcoin-related systems have been made with fairly unsophisticated attacks. It's not that there's no way to build a reliable system -- it's just that people are trusting their bitcoins to services that are not tested very thoroughly. This is expected to some extent, but as the value and popularity of btc shot up, the service providers didn't flesh out the important security bits that had been omitted previously. Interested parties proceed to execute script-kiddie level attacks and make off with a nice bounty of btc.

The moral of the story is that you need to be careful about where you place your valuables. Don't trust a service that hasn't been thoroughly tested and audited if you are going to store a large amount of money there.

That is where my thinking is as well. Basically its easy to do one of these 'look what I coded up over the weekend' kind of web sites to prove a concept, but if you're going to deal with more than a few K bitcoins then you need to plan appropriately dor folks who are going to start sniffing around when there is that sort of value sitting there.

There are various folks who provide pre-configured VM's for things (jumpbox [1] comes to mind) so presumably they could provide a site that was at least moderately safe. Of course that means money to pay for that sort of stuff.

[1] http://www.jumpbox.com/

Reply on news.ycombinator.com