Hacker News Reader

Comment by KingMachiavelli | Hacker News Reader

Wow. The desktop application allowed random nodes to trigger popup alerts that could just say anything they wanted. It sounds like that was a super old version? It's a bit unclear which version of Electrum was the last to have that issue.

It's pretty crazy the number of people who bought Bitcoin/crypto at such an early stage (e.g spending >$1000 on something nearly worthless and very obscure) yet are very bad at the security of this. You would think the first step to recovering >$10M plus would involve a Google search or two.

View on HN

Yeah I'm glad I'm not the only one who finds this a bit shocking, and their initial response doesn't really impress me that much. I don't expect a desktop app to be displaying random unverified messages to me in the same way my email or phone might, and especially so if it's not made that clear where the message is from. It's certainly true that this guy shouldn't have made this mistake anyway, but there are plenty of steps Electrum could do to make it clear whether a message should be trusted or not, and to their credit it does at least sound like they did make changes in this area in later versions. Of course, to clarify I have not actually tried this thing, I'm just basing that on their description of changes they made such as no longer displaying RTF and/or arbitrary messages.

What can they do about old versions? Yes clearly it is an exploit but patching only fixes it in new versions. If someone insists on using an old version with that bug, they are on their own.

I agree with that, I was just objecting a bit to the tone of the original comment. IMO it's a bit of a hard sell to me to say "we're sorry, there's nothing we can do" after listing a bunch of things they did to fix this in later versions. Rather than going on and on about how it's an unfixable problem, they could have just said they have made steps to address the issue in later versions but there isn't a way to fix existing versions.

> It's pretty crazy the number of people who bought Bitcoin/crypto at such an early stage (e.g spending >$1000 on something nearly worthless and very obscure) yet are very bad at the security of this. You would think the first step to recovering >$10M plus would involve a Google search or two.

Though $1000 is a money typical let's say IT employee can easily spend and lose without having major issues. The issue with some early BTC adopters is that it was like buying a lottery ticket, most probably assumed that they would be likely losing the money, therefore they didn't invest in security and careful planning. Many people working for FAANG for example don't have to work that long to make $1000, so it is quite natural not to spend several hours of r&d on $1000 investment.

The lack of security at the time of purchase isn't really the issue... it's the lack of security & best practices at the time of recovery that is the issue. Anyone getting >=10,000x returns on crypto basically had to have either forgotten or temporarily lost their crypto because 99.99% of people would sell after getting 1000x gains.

I think the main issue in this vulnerability was only fixed in early 2019 so it is super recent compared to the value & state of cryptocurrenty. Even I would expect any crypt wallet software from 2018 to be secure because crypto was no longer a niche interest at that point. Sure regular security & bug fixes are a norm for modern software but having such an egregious issue as recent as late 2018 is unacceptable.

https://electrum.org/ says:

> Warning: Electrum versions older than 3.3.4 are susceptible to phishing (links to [0])

3.3.4 was released 2019-02-13 [1]

[0] https://github.com/spesmilo/electrum/issues/4968

[1] https://github.com/spesmilo/electrum/releases?after=3.3.6

It would be interesting to interview people like this and publish their stories. What happens to someone in between spending $1000 USD on something nearly worthless and very obscure and having a wallet worth $10M USD?

i.e. perhaps a trend is people are so terrified of anyone finding out about it that they avoid Google etc and do everything in secret.

There have been plenty of news articles about these people. For example in Scandinavia top tax payers are published yearly, there have been some crypto investors who have made it to the top of the list, and have given out interviews.

Reading some of these it is not that much different to someone winning in the lottery or getting some making million-level exit from IT business.

Ah lottery ticket makes sense, so it's kind of boring then. Lost tickets, stolen tickets, wasted money, etc.

You can overdo the security too though. I'd have a house right now if I had kept my wallet passphrase on a computer instead of in a notebook that I lost.

Reply on news.ycombinator.com