Hacker News Reader

Comment by DennisP | Hacker News Reader

The bitcoins were stored on a centralized exchange using a phone number as 2FA. Banks and brokerage accounts can be hacked the same way, though at least they'll make you whole if you catch it soon enough.

To really secure bitcoins, a hardware wallet or a passphrase in a safe deposit box are both pretty simple options that nontechnical people use all the time. Neither is expensive and both are widely known.

View on HN

Holding the coins is one thing, transferring is another. I just transferred my bitcoin out of my paper wallets. I can promise you there is absolutely no way for a non-technical person to do this safely. What are they going to do? Visit some random website to sweep their wallets and hope their private keys are not stolen (which they will be)?

I haven't used a hardware wallet - I suspect they solve the transferring problem. But what's the risk my hardware wallet still works a year from now? 10 years from now?

I decided trusting Coinbase in 2021 is the most reasonable option for the amount I have. (Different calculus back in 2016). I admit I don't know what I'd do with 8-figure balances though.

Hardware wallets do solve that problem. Keep your 24-word passphrase somewhere safe, and you can use that to restore your keys into any hardware wallet, without plugging it in to a computer. The passphrase algorithm is a public standard, so if your hardware breaks, you can restore onto another one.

After that, plug the hardware wallet into a computer and you can transfer without the computer ever seeing your private key. The hardware wallet displays the destination address, which you should check.

I do agree that Coinbase is reasonably safe, as long as you use a strong password and 2FA, and don't give them your phone number.

> a passphrase in a safe deposit box are both pretty simple options

_If_ you can get a safe deposit box in your bank, that is. My local bank (Chase) is always sold out of boxes. Sure, you'll next say: change your bank. But the other one (BoA) is also out.

My point is, it's not such an easy option as you're making it out to be.

Funnily enough my bank very recently made me sign an agreement which precluded me from subleasing my safe deposit box. Maybe this is the next arbitrage opportunity.

Maybe stop going to big corporate banks?

I got one last week without any issue.

When I shopped for a local bank branch that had safe deposit boxes (maybe decade ago), one of the bankers told me a lot of banks and branches were trying to get rid of their boxes, and not wanting to include boxes in new branches.

I managed to get a box in the basement of the BofA in Harvard Square back then, and kinda wish I'd kept it, since I doubt I could get one today.

Yeah I remember trying to open one in the bay area a while back. My local bank had a wait time of more than three years for a box.

So back to shoving cash under the bed, essentially.

> Neither is expensive and both are widely known.

I'd say that ~97%-99% of the people in the US and Europe have no idea how to use a hardware wallet. The vast majority have no idea what a hardware wallet is. You're very far off the mark in your estimate.

Bitcoin is at the adoption stage where the general public is only beginning to use services like Coinbase. They do not know how to use a hardware wallet, most of them do not know that such a thing exists.

The vast majority of people in crypto know what a hardware wallet is

Not really sure how this is relevant, seeing how the original comment said

> what hope is that for regular folks could make safe use of said value store

I just googled "how to safely store bitcoin" and a bunch of articles with good, simple advice came up.

But is it foolproof?

"Why Johnny Can't Encrypt" was published decades ago. With this stuff you cannot make any mistake. PGP advice appeared to be good and simple, yet people made errors all the time. I wouldn't expect this to be different.

Hardware wallets are considerably simpler than PGP. I can only think of two ways to screw up:

1) Lose the passphrase. The device does quiz the user on words of the passphrase upon setup, to be sure the user at least wrote it down. Hopefully this reinforces its importance. Ledger provides a card to write the words, with prominent instructions to save it somewhere safe.

2) When sending, don't verify on the device's display that you're sending the money where you think. But the display is right there on the device, and displays the destination address while waiting for you to push a button right next to it.

For smart contracts it helps to get a larger device that shows all the contract parameters, but for simple sends that's all there is to it.

> Bitcoin is at the adoption stage where the general public is only beginning to use services like Coinbase. They do not know how to use a hardware wallet, most of them do not know that such a thing exists.

You are creating a persona tailored to back up your argument. It is not that strange that a good chunk of "common people" buying right now bitcoins know what an hardware wallet is, at least as a concept (not the tech implementation obviously).

I think you should increase that by an order of magnitude. I'd be very surprised if more than 1/1000 could describe how to safely use a hardware wallet properly.

This shows a fundamental misunderstanding of how cryptocurrency works. Bitcoins aren't stored anywhere. You don't need to get hacked; to have your bitcoins stolen.

If you want to be pedantic about it, you have to store your private key securely.

The difference is that often the institutions (i.e. banks and brokerage firms) are often repay lost funds or can reverse the transactions where as here it is a lot harder.

This explanation doesnt make total sense to me, so 2FA, by definition is two-factor. This explains how one factor was compromised. How was the other factor compromised?

Probably password reuse, then leaked. Like you'd see on https://haveibeenpwned.com/

You may be right. A lot of orgs will happily let you use SMS for 2FA at login, but let you recover your account with that same SMS, making it 1FA x 2 (or 0FA, to line up with RAID 0)

Reply on news.ycombinator.com