Hacker News Reader

Comment by gruez | Hacker News Reader

>If your use case involves being able to control user accounts centrally, why do you need blockchain for that?

AFAIK the accounts are not controlled centrally. How it works is that the project owners set up a site/webapp, which has javascript that interacts with wallet extensions installed on the user's browser. Members of the DAO uses the site to do various actions, for instance buying tokens or making votes. The site sends the request to the wallet extension to be signed, and then it gets broadcasted to the ethereum network. At the end of the day, the wallets are still controlled by the user, it's just that hijacking the site allows them to fool a massive number of users that don't pay close attention.

View on HN

if a single point of failure impacts the actions of a large number of users, that would count as central control in my book

You don't have to use the frontend they host, it's not an actual single point of failure. Their frontend could go down, and as long as someone else is hosting one (or you download the source from github and host it locally) you can still use Badger.

If the failure of this single point led to the loss of $114m, that counts as a SPoF in my book regardless of what the platonic ideal user “could” or “should” have done.

You don’t even need the front end, you can interact with the contract directly.

It’s sad what happened to these users, but they did sign the contract giving the hackers permission to access wallet funds.

This is a failure of opsec.

presumably the code being distributed to users could then be redistributed by those users, making this not a SPoF

it just happened to be an overly trusted point of failure

^ this is correct, BadgerDAO has no control over user accounts, this is purely a frontend that was manipulated. You could redploy the frontend from source somewhere else without asking Badger and it would work just as well.

> wallet extensions installed on the user's browser

Absolute security nightmare in both directions, this.

This is why anyone who is serious in this space uses a hardware wallet.

I preach this in every forum I am active in, but if you are messing with more than play money you absolutely need a hardware wallet.

Reply on news.ycombinator.com