Hacker News Reader

Well I do agree with you that Bitcoinica was not 100% secure. This hack really has nothing to do with the app or its infrastructure.

- I didn't set the password. - I didn't have the power to change the password. - I shouldn't have access to the account.

The root cause is LastPass account being stolen.

View on HN

Agreed that you are not personally responsible for this particular attack, though I see it as the latest in a series of cascading failures, beginning with the initial attack. It's the lack of consideration of security - that can only be baked in from the outset - that's the real root cause.

If the application had been self-hosted in a physically secured location, the attack that exposed the LastPass credentials would not have happened (email reset of root passwords). It may not be cool, but the cloud/consumer-level hosting is not appropriate for applications handling large sums of money.

Agreed. But one of the team members explicitly released the source code and that caused the hacker to correctly guess LastPass account. (At least this is the most "right" version of the story I've heard.)

Reply on news.ycombinator.com