MyBitCoin Team Responded to Hacker Attack by Getting Shitfaced | Hacker News Reader

MyBitCoin Team Responded to Hacker Attack by Getting Shitfaced

betabeat.com

54 pointsspiffae27 comments

It's also interesting to see how, despite one of the initial design objectives of bitcoin being a currency beyond the reach of government intervention, users now want the police to investigate bitcoin related mishaps.

As Kim Stanley Robinson might have put it: "That's libertarians for you — anarchists who call the police to get their bitcoins back."

You're creating a false dichotomy. You seem to be suggesting that people either want no government whatsoever, or they want the government to run everything, and that there is no rational middle ground.

It's perfectly reasonable for someone to want a privately run transaction system like bitcoin, with rules governed by global consensus rather than national legislative action, and ALSO want local, federal, and international police forces whose job it is to investigate theft.

There is not logical inconsistency there.

It doesn't help that America has bastardized the meaning of Libertarian to mean pro-Capitalist neo-liberal whilst the original meaning (and today's meaning in the rest of the world) is equivalent to anarchism or Libertarian Socialism.

'When I use a word,' Humpty Dumpty said, in rather a scornful tone, 'it means just what I choose it to mean — neither more nor less.'

Can we please take the rhetoric back to reddit.

> 'When I use a word,' Humpty Dumpty said, in rather a scornful tone, 'it means just what I choose it to mean — neither more nor less.'

Not the OP and I may be misunderstanding the point of this. But don't we need some common definitions/clarification on usage in order to discuss things?

Having built quite some ecommerce and online ventures as webdeveloper I can say one thing for sure: it takes a lot more then an OpenSource webshop-application or a bunch of PHP scripts to run a multimillion commerce.

It takes time above all. Time to get legal issues sorted out. To have the administration and legislation sorted out properly. To have your insurances set up. To have proper help and support in place. And to have your entire venture -including the software- thourougly benchmarked and security-tested.

The BTC-economy is very young. Most of the ventures you see there now, never set up a proper and professional venture; one that can deal with multimillion of dollars. They are of the order of a few quickly hacked up scripts. Perfect for selling a few socks per week. But not for value-storage worth millions.

We must be patient: the ventures who have stuff properly in place will appear, but later; after they have everything in place and secured to really run such ventures.

People have referred to Bitcoin as a "Wild West". You think people in the Wild West didn't get shot?

If you want stability, wait a hundred years, earn your money the traditional way, and then buy a condo in BitPaloAlto.

If anyone has been looking to get into bitcoin, the spot price is a lot lower at the moment than it was a few weeks ago when all the media was focussed on it. (I increased my position over last few days at slightly lower prices.)

Wow, you ain't kidding.

http://bitcoincharts.com/charts/

There was a three-day spike above thirty dollars in early June and it's been sliding slowly ever since (with a recent small panic in line with the stockmarket). Currently slightly under ten bucks.

Yeah, but doesn't it take a few days to get your money to one of the exchanges? (Like mtgox?)

I've been using britcoin and find the guy pretty responsive. Last payment was received and handled within 24 hours.

Another sad bitcoin story. Is it really all that surprising that if 'real' money was available to be stolen from non-bankers (who have a huge network of enforcement types at their disposal) that folks will come in and walk out with the money if they can?

I've not been following bitcoin closely, mostly just seeing the major screwups. But has anyone even started the process of a 'best practices' tutorial on keeping a bitcoin bank secure? (and these are depository banks, call them 'enthusiast websites' all you want but if they 'hold' a quantity of a good for others which has monetary value then they are a depository and should arm themselves appropriately)

It's an interesting experiment in re-inventing currency trading. The lesson I'm taking away: if a currency can be stolen, it will. This is in contrast to the ACH transfer system, where fraud or theft can be reversed with some effort.

Perhaps there is no way to build a sufficiently secure untraceable, non-undoable cash system.

> . . . in contrast to the ACH transfer system, where fraud or theft can be reversed . . .

I am not sure, but I think Bitcoin transactions can be reversed, too, if enough nodes want to do so.

Most of the compromises of Bitcoin-related systems have been made with fairly unsophisticated attacks. It's not that there's no way to build a reliable system -- it's just that people are trusting their bitcoins to services that are not tested very thoroughly. This is expected to some extent, but as the value and popularity of btc shot up, the service providers didn't flesh out the important security bits that had been omitted previously. Interested parties proceed to execute script-kiddie level attacks and make off with a nice bounty of btc.

The moral of the story is that you need to be careful about where you place your valuables. Don't trust a service that hasn't been thoroughly tested and audited if you are going to store a large amount of money there.

That is where my thinking is as well. Basically its easy to do one of these 'look what I coded up over the weekend' kind of web sites to prove a concept, but if you're going to deal with more than a few K bitcoins then you need to plan appropriately dor folks who are going to start sniffing around when there is that sort of value sitting there.

There are various folks who provide pre-configured VM's for things (jumpbox [1] comes to mind) so presumably they could provide a site that was at least moderately safe. Of course that means money to pay for that sort of stuff.

[1] http://www.jumpbox.com/

One of the major advantages bitcoin has is that it is decentralized. Placing your money in a bitcoin bank is simply unneeded.

Sure, keeping your BTC in an exchange's account may make it faster to exchange your BTC to USD, and you may see less transaction fees, but at the end of the day it means you have to trust the exchange to do the right thing.

Want to keep your coins safe? Secure your wallet.dat.

Pretty sure that if you want to trade BTC on an exchange, there's no other way but to deposit your currency in their wallet. Otherwise, how can the exchange ensure your counterparty that they'll get your money if your bids are matched? Same with real money exchanges, you have to deposit your money into their account before you can trade.

You are absolutely correct. But that doesn't really change anything.

Placing your BTC in an exchange's wallet means you are trusting that exchange. I don't really trust exchanges -- I still use them, but I never transfer extra BTC in, and I always transfer 100% of the BTC I buy into my wallet.

After the Mt. Gox hack, it came out that many people were buying BTC and leaving it in Mt. Gox' wallet. That's a colossal mistake; there is simply no reason to trust anyone else to hold your BTC.

Bitcoin exchanges will always exist and need to be secured. Bitcoin banks serve no purpose and should never exist.

Ah yes, completely agree there.

Exactly. Don't give someone 24/7 access to your bitcoins unless you are gaining enough from the situation to offset the enormous risk that your trust will be violated.

Isn't this the equivalent of calling the FBI on someone raiding the guild bank?

It's not real currency, in the government-backed sense. The FBI might go after someone for the hacking, but I fail to see how they could prosecute anyone for theft.

No - If someone steals your Word document from your computer, then that is data theft - it doesn't matter if it contained your grocery list or a business plan that was sure to net you millions. It is just data but the value is there to you, even if someone else thinks that business plan is worthless, so someone taking that away from you is still some form of theft.

But on the other hand, if I write a piece of text and upload it to, say, Google Docs, I can't sue them for theft if they lose that data.

When you use Google Docs you are agreeing to their terms and conditions which include limitations of liability for loss of data, loss of business and loss of profit[1]. If you were using a service that promised you that your data was safe and secure, and placed no such limitations because you were paying an arm and a leg for that peace of mind, well then you could sue them if the data were lost.

[1] http://www.google.com/accounts/TOS (see 15.1 A and B3)

This is awesome.

The site looked like it was put together by a novice and didn't even have a reset password system.

If someone set up a bank with no banking and no ownership identify on the internet, would you send them an envelope full of cash?

If the creator of this site made off with the money, good for him. It was the perfect con.

The parts of this story that are more interesting that the 'shitfaced' line are:

• the progress of participants in a #bitcoin-police IRC channel in tracing some of the possibilities and connections behind MyBitcoin and the compromise

• the risk of vigilantism as people act on hints and theories that might be casting suspicion on only tangentially-related people – someone who denies any direct involvement reports receiving threats

Those two points show both the potential and risks of a distributed, community-based enforcement system.

Reply on news.ycombinator.com