Hacker News Reader

Comment by m3kw9 | Hacker News Reader

Anyone know the implications to the security of the crypto currencies? Are they highly prone to theft now?

I can't think of any cryptocurrency-specific attack vectors off the top of my head. But if malicious Javascript code can use Spectre to escape the browser sandbox, then wallet private keys are potentially vulnerable, just like everything else on the machine.

My guess is at least one exchanger will run away with coins and blame it on the CPU vulnerability being exploited.

If your crypto coin lives on a box connected to the internet you're living dangerously. That said, I live dangerously too.

Not if you use a hardware wallet (Ledger or TREZOR). If you're using a web (Coinbase) or desktop wallet, you might be at risk. In reality, it's pretty unlikely to be exploited.

Someone could steal your login credentials for any web service, but the risk is mitigated if you use 2FA, or some sort of IP whitelisting.

What happens when you use that wallet by plugging it into the computer, or by entering its information on a computer to perform a transaction?

People say "Hardware wallet" like it's a magic incantation.

If you use a hardware wallet, the private keys only exist on the device, and therefore cannot be stolen using this attack vector. The Ledger uses a secure element, which is an entirely separate MCU, and (as far as we know) can't be 'hacked' by any script kiddies.

However, if you for some reason decided to store the wallet seed on your computer, it's no longer secure.

An attacker can still use the hardware wallet to transfer money as long as it's plugged in. To prevent this you need external hardware with a display and external input (that cannot be reflashed through usb (!)).

Wrong. The hardware wallet requires physical access to sign transactions with the private key (you have to press the button to acknowledge the transaction).

Peer comment has hit the nail on the head: what you're describing is the functionality provided by hardware wallets -- external physical input/display.

Might have implications for some of the CPU only mined altcoins if they're slowed down.

Reply on news.ycombinator.com