Hacker News Reader

Comment by modarts | Hacker News Reader

"the attacker gained accesses to an unencrypted backup of the wallet keys"

What is with these bitcoin exchanges and their pathetic records on security? How is the currency ever supposed to go mainstream with these continual security lapses?

View on HN

It's hacker attitude. Build what seems like it will work, and launch.

The true flaw of hacker attitude is underestimation of the job by focusing on the part that looks straightforward, namely the part in code.

A bitcoin bank is the application. The bit that's written in code is just a part of it. The actual spec is: under all circumstances, this will either work as a bitcoin bank, or fail safe, or in the worst possible case fail with data loss. That spec requires you to examine the behaviors of the system as a system - you may be sure your opponents see it as such.

Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure and STILL have the occasional lapse in security; how do you think a couple of guys in their spare time will fare?

A bank's software infrastructure and "attack surface" dwarfs these tiny bit coin exchanges. Banks also have byzantine processes and guidelines that encumber their technical teams so building their software is inherently costly regardless of security.

Meanwhile unregulated, nimble BitCoin exchanges struggle with the OWASP top 10.

I'm not quite sure I buy that. Obviously banks are more complicated. But because of the regulatory environment what they are not is "just servers on the internet". You can break into a bitcoin exchange and steal BTC by copying data. You can't do that with a bank -- banks can only transfer electronically to other banks, and "being a bank" is a tightly regulated state.

So while the complexity is there, it's not clear to me that it correlates to an "attack surface" in the sense network security people use the term.

> Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure

Those banks are often guarding a considerably larger amount of money, which is something to take into consideration. I think your point still stands though.

I work for a finance related technology provider and as a consequence get to see the technology practices of many brokers and other market makers. Often times their security is just as bad. The key difference is that trade settlement (a.k.a clearing) is a separate process (usually also separate company from exchange). This adds a layer of security because compromising the exchange doesn't always get you access to the clearing details. Clearing details are usually things like "Depoist X million dollars in bank account A, I will deposit x million euros in your bank account B." With Bitcoin quoting, trading, and clearing are all rolled into one.

Hey man, they're just doing lean MVPs.

I guess they just tend to use a somewhat different value for viable than I might.

Moreover, how is it going to go mainstream without mainstream exchanges? If these bitcoin thefts continue putting exchanges out of business, the thieves will wind up with a big pile of currency nobody is willing to convert back into dollars.

The quote makes sense if you want some plausible deniability for an inside job.

Reply on news.ycombinator.com