Hacker News Reader

Comment by Aqueous | Hacker News Reader

I'd be hoping for the safety of a prison cell if I were Karpeles. I'd imagine the security situation is very bad for them right now. It seems like the BTC are there, though, especially if Gox was following even rudimentary security procedures...

BitCoin just got very serious and much less fun. I guess that's what happens when it suddenly accounts for real, actual money and real actual livelihoods. I sincerely hope everyone gets through safely.

I use CoinBase which (seems like it) is slightly more reputable.

Edit: Madoff was much more. Still, this would be significant.

View on HN

If those BTC are gone, this is either the largest-scale loss of money in history or the largest scale theft of money, dwarfing even Madoff.

12,437,700 bitcoins have been mined, with a market cap today of around $7.4B [1]. Madoff scammed investors to the tune of around $50B [2], so even if MtGox owned every bitcoin ever mined, they would have a bit of catching up to do.

[1] http://bitcoinwatch.com/

[2] http://www.forbes.com/2008/12/12/madoff-ponzi-hedge-pf-ii-in...

That's fiat money tho.

The final tally of Madoff's scam was $57 billion, but that number is based off the fictional account balances, including both fictional profits and reinvestments of fictional profits.

Apparently about $36 billion was paid in, and $18 billion paid out, and about $10 billion recovered, leaving about $8 billion(!) "missing". All the numbers are still bigger than both BTC and Gox, though.

Although, didn't the US literally lose something like $10 billion in cash in Iraq/Afghanistan?

>My BTC are in CoinBase

Why? There is basically no discernible benefit to keeping your money in an exchange, but there are huge risks associated.

Assuming i take proper security precautions like 2 factor auth I don't see why it's any more risky than any other cloud service I use. CoinBase is at least backed by people who have a record of knowing what they are doing...

That's the point, don't store your BTC in the cloud.

It's a horrible idea to keep unencrypted copies of a wallet on any remote server. Or encrypted copies that anyone other than yourself is capable of accessing. It is idiotic to keep coins in a wallet that has been created or been under the control of someone other than yourself. And 2FA is meaningless to any attacker with an exploit.

Basically the entire concept of a Bitcoin wallet is fundamentally flawed from a security perspective. You're one compromised secret away from losing it.

Theoretically a 'good' Bitcoin exchange would have insurance and multi-factor auth, and some complicated internal crypto scheme to minimize the scope of breaches. I can't imagine any of the current exchanges are that advanced yet.

"some complicated internal crypto scheme to minimize the scope of breaches"

Any half-decent online wallet or exchange keeps the vast majority (typically ~95%) of their funds in "cold storage", usually with an n-of-m encryption scheme, which will minimize the scope of breaches, with an occasional inconvenience when withdrawals exceed projections before they can pull funds from cold storage.

Even given the malleability bug (which actually isn't the real problem: http://blog.tlrobinson.net/bitcoin-transaction-malleability-...) if Mt Gox managed to lose more than say 10% of customer funds they were doing something seriously wrong.

My main problem is that I don't see a satisfactory way for me as an individual to safeguard a wallet.

Cold storage is an interesting concept for an exchange, but it still seems fundamentally inferior to normal banking's procedures for undoing fraudulent transactions. N-of-m encryption schemes are nice, but they only really make sense if you have each of the keys in a different hardware crypto device. Even then, in practice I suspect all of the exchanges are set up such that 95% of their cold storage is accessible via machines that are connected to the public Internet. (I'd be interested in independent audits that show otherwise.)

CoinBase bills itself as a digital wallet before it bills itself as an an exchange. They are at least domestically based which gives me some legal recourse in the event that they do lose my coins.

1) Does CoinBase have an interest in keeping my BitCoin's safe? They do.

2) Is it competent to keep my BitCoins safe? They seem about 100% more competent than Mt. Gox, which isn't saying much, but unlike Gox I actually believe CoinBase has had its cold storage audited, especially by its rather well-known backers who almost certainly do not want to lose prestige to a massive BitCoin heist/loss...

3) If I keep my BitCoins on my home machine will they will be a) harder to access from anywhere I wish to access them and b) equally susceptible to being lost?

Yes, and yes.

I've seen too many nightmares of people losing their private keys to believe that I'm fundmentally more capable at keeping my BitCoins safe than CoinBase is.

Do you really need to access all your coins instantly from multiple places?

The worst thing about this is that you are probably recommending this scheme to everyone else.

It's not a scheme. And I would advise anyone who asked to make up their own mind about where to store it. If they feel confident that they can 100% keep their wallets safe better than CoinBase can, then absolutely, yes, they should keep it on their home machine.

The promise of BitCoin is that it functions like cash, with all the advantages of electronic payments. If I can't bring my cash with me everywhere, then yes, it does fundamentally limit its utility to me.

BitCoin is just like any other money: the base system is based on distrust but for it to be mainstream an ecosystem of trust must be built around it. If we can't sort out the difference between competent BitCoin institutions and incompetent ones then we are in a world of trouble.

"BitCoin is just like any other money: the base system is based on distrust but for it to be mainstream an ecosystem of trust must be built around it."

Speaking of ecosystem, I noticed that FDIC insurance suspiciously missing.

It's only a matter of time. If BitCoin makes the legal transition from commodity to currency then FDIC regulations will apply.

CoinBase is at least backed by people who have a record of knowing what they are doing...

Wasn't there a Reddit thread about how Coinbase is using Mongo as a transaction backend?

But you don't need to keep it in a cloud provider, you can keep it on your computer.

If you store your bitcoins in random website created by rails/mongo hipsters, you are doing it wrong. Use cold storage, for Satoshi's sake.

> I sincerely hope everyone gets through safely.

... The natural corollary to the Kim Stanley Robinson-ian "That's libertarians for you -- anarchists who call the police to get their Bitcoins back."

I hope they get through safely, if they had the foresight to hire a private security firm to protect them?

Even a cursory glance at the Libertarianism page on Wikipedia would've shown you that not all libertarians are anti-State police. But I disagree about your criticism even against those that are.

Playing Devil's advocate, if the Mafia took control of your city, and forced you to pay 20% of everything you made (or be taken from your home and family), but offered to "take care" of any other criminals that might bother you, would it be hypocritical of you to not want to get robbed twice, and therefore use the services that you already had been forced to pay for?

When you live in a system that is forced upon you, it's not hypocritical to use the benefits of that system, since you're forced to withstand its drawbacks.

Another example would be people calling Ayn Rand a hypocrite for accepting social security. Where do they think that money originally came from?

Most libertarians are pro-police and pro-state. For a lot of them, the police and the courts are the only government bodies they support

The argument being that the state's only function is to enforce property rights (and needs physical force to do so).

I hope when you said your BTC are in CoinBase you do not mean you're using an exchange as a wallet.

There are worse pseudo wallets, like dice sites and mining pools, but it is still a bad idea.

Coinbase is not actually an exchange, and in fact markets themselves as a wallet:

"Coinbase is an international digital wallet that allows you to securely buy, use, and accept bitcoin currency"

It really comes down to whether you trust Coinbase (equivalent of a bank, albeit a startup bank) or yourself (equivalent of putting cash in your mattress) to securely store your money.

It's not really anything like putting cash in your mattress. With Bitcoin, you can even store it in your brain, not to mention any place where you can store a piece of paper or a string of digits.

You can even trust a regular bank, by putting the key in their safe. And if it's encrypted, you don't even need to trust them to not abuse it.

And using something like ssss[1], you could also store it in a lot of places at once, without any single one having enough info to use your coins.

[1] http://point-at-infinity.org/ssss/

Ok, it's like keeping cash in your mattress, safe, safety deposit box, wallet, personal vault, whatever.

The point is it's your responsibility to secure it, and if you think you can do that properly then great. I can do it, but I don't think it's easy enough that most "normal" people can do it properly yet.

You being responsible for the security of your assets is the price you pay for having total control and ownership, just like with everything else. Putting money in the bank or PayPal reduces the risk of theft but increases the risk of bail-ins and account freeze. There is always a tradeoff.

Bitcoin offers a lot of security mechanism that are not available with traditional asserts, like m-of-n-keys etc. Insured online wallets will become available as well.

I agree with everything you said.

I've had friends lose Bitcoins both stored themselves and in exchanges/online wallets.

In any case you should think carefully about your choice.

Madoff was at least $10 billion. Gox never had that much of anything.

It's way safer to rob Jewish charities and retirees (mainly) vs. drug dealers and libertarians.

Maybe the coins were there before, but I expect once the news broke out most people did the reasonable thing and bought bitcoins for all the cash that was stuck in mtgox after a day or two. The price was guaranteed to go down in the short term and I woundn't be surprised if mtgox needed 2-3 times more funds now then before closing.

Reply on news.ycombinator.com