Bitcoin trojan caught in the wild
symantec.com
symantec.com
Knowing how little "regular" people protect their devices, this scares me.
Edit: I'm not defending PayPal, I'm saying Bitcoin and PayPal are two different systems.
Uh... it means there's minimal risk that users will lose their money if PayPal gets compromised. That's pretty significant.
- Add encryption of the wallet and a password to the Bitcoin client and daemon. This is already being worked on and there is working prototype. It should be in the mainstream client very soon. Wallet Private Key Encryption: http://forum.bitcoin.org/index.php?topic=8728.0
- Start trusted centralized institutions that hold your Bitcoins and protect them (maybe even give you a bit of interest growth). There are already numerous online eWallets that you can use—if you choose to keep your cash on your person then it's your decision and you should acknowledge the risks. List of eWallets: https://en.bitcoin.it/wiki/Category:EWallets
What about your passwords to your real-life bank accounts? Or logins to confidential company data? Or emails?
If you're the paranoid type and have two-factor auth for all these things, why not Bitcoin?
If I get hacked, I loose all my BitCoins.
If my bank gets hacked, sucks for them.
Who do you thinks ends up paying for it? The cost will certainly be passed on to the banks customers.
With a bank I'm insured against theft. With bitcoin I am not.
Your bank has ways to make that more secure. If someone logs into your account from a strange IP (e.g. different country from the bank and customer), if someone tries to transfer money online, you might need to enter another password (which they might not have), or it might be based on a fob that generates a code. If you do manage to transfer money to your account, they can now follow the money to find out where you are and arrest you.
BitCoin stealing doesn't have any of these drawbacks, so is probably a much more tempting target.
I had someone make a fake debit card matching my account number. It didn't have my PIN, the number on the back, or my name on it, but it had my 16 digit number. That is something you can just create randomly, from the perspective of the customer there is absolutely nothing you can do to protect yourself from that. I guess they generate a bunch and test them somehow, but since the thief had a card that matched an account, he went out and tried about 9 stores in an hour. He was able to buy about $1200 in merchandise from 2 stores, the rest either rejected him or by that point the bank had declined my account.
The bank called me and told me all of this within 20 minutes of it happening. I saw the money debited from my account, my bank balance was lower, etc. They sent me 2 forms to sign saying it wasn't me, and within 24 hours the money was back in my account. Since then the bank has dealt with the merchants who took the fake card, filed a fraud report, etc. I spent less than 20 minutes dealing with this overall, it was not a big deal for me.
Contrast that with someone stealing $1200 from my safe or $1200 of my bitcoins. I'm just screwed then. I have no recourse, no one dealing with this stuff for me, etc.
While keeping your login information secure is a good thing, ultimately the banks are the ones keeping things secure. They have plenty of intelligent systems that know your typical buying habits, and you are quickly red flagged when some unusual purchases happen.
I know that transferring money out of my bank accounts over the internet at my bank REQUIRES a phone call and a piece of paper the first time. After that, sure, you can transfer instantly. But if someone installs a keylogger on my machine and transfer all the money from my checking account to my savings account or my investments, I don't really care. I'll just transfer it back. He will not be able to transfer it to his own bank account very easily, not unless he breaks the banks system. And as shown by the debit card incidident, when the bank's security fails the customer is not liable.
Banks are powerful. They can do things that you and I can't. If a bank transfers money as part of a fraudulent transfer, it can reverse that transfer electronically. This reversal traverses the banking system all the way back to the entity that accepted the payment.
This system diffuses the impact of fraudulent transfers and places the ultimate responsibility on those accepting payment, rather than those holding currency. I know that sounds harsh, but the person accepting the payment probably has the best chance of detecting a fraud. Without this check & balance, there's very little incentive for merchants to verify the validity of the funds being used.
An insecure computer means an insecure life.
Not so (by design) with a compromised bitcoin wallet.
That's not clear:
Same can be said about bank accounts, unless you're using 2-factor auth with a dongle.
You can't really do interest with BitCoins, since it's a fixed amount. Deflation is built in, so in way just holding the BTC will make them 'grow' in value.
But if you have banks that store Bitcoins for you, then you're trusting their security processes, not your own. We don't have Bitcoin banks yet. For BC users, maybe that's worth looking into.
- I don't have to worry about 6,500,000,000 people having access to my house. At most, there is a market of around a million or so who would live in close enough proximately to me.
- I don't have thousands of people across the world tapping on my windows to find out how easy they are to break into.
- I'd trust the chances of a local thief being caught more than a hacker across the globe stealing BitCoins being caught.
I could go on and on.
Right now, the BitCoin landscape is like the Wild West, probably even worse. Systems simply aren't in place to really protect people, and you have the potential to steal from anyone in the entire world.
In real currencies, we have systems in place to protect holders. In the U.S. we have the FDIC, which insures bank accounts up to a certain amount. This insurance incentives people to keep their money in banks instead of the house because it's safe (both physically safe from theft and safe from bank failure). My understanding is that there are BitCoin "banks" but there is nothing guaranteeing these deposits. There are also established systems in place to help prevent theft. Police departments, close physical proximity to others (neighbors being able to see odd activities), etc. to prevent thefts.
My conclusion - we will see a lot of startups solving this problem.
The only mistake was to believe Bitcoin was 100% safe. The technology will mature.
More seriously, it's interesting that the people who have been robbed from could observe in detail exactly where their stolen money is flowing to. So close, yet so far away.
http://forum.bitcoin.org/index.php?topic=18141.0
tl;dr: Create a bitcoin address, backup wallet.dat, delete wallet.dat from your HD, and send your bitcoins to that address.
And this guy was trying to implement this 'offline savings' strategy, but didn't completely understand the privacy lifecycle and transaction details — and thus last the keys to a $180K balance:
http://forum.bitcoin.org/index.php?topic=11104.0;all
Vanished in a poof of pure logic!
I don't use Windows but there's probably something similar for it.
It's possible to protect your bitcoin keys from an arbitrarily-later malware incursion... but very hard, in ways even most power-users don't consider.
I like bitcoin. The current sharp edges and tragic mishaps are useful, for now, for learning about a new medium of exchange, which operates on a logic different from almost anything that we could easily analogize to.
If bitcoin or a successor takes off, I suspect carrying large balances will require specially hardened devices – secure VMs inside handhelds, perhaps?
And, a general desire for some recourse against instant irreversible fraudulent transfers might make the 'finalization' of certain transactions dependent on a remote secondary key approving (or failing to cancel) a payment, within a timeframe sufficient to deliver second-channel notification/confirmation.
http://stackoverflow.com/questions/3956478/understanding-ran...
In short: doing things like this actually reduces the randomness of the end result.
char * appdata = getenv("APPDATA");
char * truepath = strcat(appdata, "\\Bitcoin\\wallet.dat");Craziness. They could just send the coins to a Bitcoin address, and it wouldn't identify them at all.
A safe online currency can be done, but if you champion this, the United States government are going to find you, and squish you like the insignificant bug you are. You would be circumventing the primary income stream of the united states with a global standardized currency.
There is an optimization for some clients to to pare down that history, but, in general, when you start up a bitcoin node, you have the history of every bitcoin ever created and all of it's transactions that occurred after it.
This history, in fact, is how you can be confident that the bitcoin is authentic - unless you have greater than 50% of the computing power of the network, you can't substitute an alternative history which would result in the coin landing in your hands.