Re:Matrix.org hacked
by ipoopatwork on Friday April 12, 2019 @10:16AM
(#19644973)
Unless I'm missing the joke, this is a bug bounty with extra steps.
My idea was to not require any explanations, so that blackhat could grab that wallet too. It's just about being able to say "this server is $1k secure". I think it's fantastic that we have a technology to do that.
You still need some trust that private keys to given wallet are on the server, but apart from that, when you know there's $10,000 dollars on the server for anybody who can access it, it says something about how secure this machine is.
Plus you get instant notification when the server is compromised. Not every hacker is kind enough to let you know.
Re:Matrix.org hacked
by ipoopatwork on Monday April 15, 2019 @11:08AM
(#19665873)
How would a blackhat grab the wallet if it's GPG encrypted and needs the passphrase from the dev?
Therefore, the wallets should be stored GPG encrypted in some published location. After the hacker has successfully penetrated and retrieved the file, they need to publish a "how I did it" document along with the hash of the GPG encrypted wallet.
Once devs have confirmed the vulnerabilities exist, they respond with the passphrase to decrypt the wallet.