News for hackers. Stuff that matters.
Re:Bitcoin trojan caught in the wild by shazow on Thursday June 16, 2011 @10:16PM (#2664069)
Here's some ways to fix this and why it won't be a problem:

- Add encryption of the wallet and a password to the Bitcoin client and daemon. This is already being worked on and there is working prototype. It should be in the mainstream client very soon. Wallet Private Key Encryption: http://forum.bitcoin.org/index.php?topic=8728.0

- Start trusted centralized institutions that hold your Bitcoins and protect them (maybe even give you a bit of interest growth). There are already numerous online eWallets that you can use—if you choose to keep your cash on your person then it's your decision and you should acknowledge the risks. List of eWallets: https://en.bitcoin.it/wiki/Category:EWallets

Re:Bitcoin trojan caught in the wild by gojomo on Thursday June 16, 2011 @10:30PM (#2664098)
Wallet encryption isn't any help against keyloggers and other local malware that can observe your use of the wallet. And wallet encryption simple enough for average folks — a short passphrase of their own choosing - is easy for digital pickpockets to crack.
Re:Bitcoin trojan caught in the wild by wmf on Thursday June 16, 2011 @10:39PM (#2664120)
Since Bitcoin miners have awesome GPUs, malware could use the victim's own GPU to crack their wallet. (And then go back to mining... for the malware owner.)
Re:Bitcoin trojan caught in the wild by a3_nm on Thursday June 16, 2011 @10:45PM (#2664137)
Bitcoin GPU miners are a quite small subset of Bitcoin users, and they're probably not the least knowledgeable.
Re:Bitcoin trojan caught in the wild by jcoder on Friday June 17, 2011 @12:32AM (#2664328)
Maybe. Wasn't the victim of the recent 25k heist a miner?
Re:Bitcoin trojan caught in the wild by DavidSJ on Friday June 17, 2011 @03:29AM (#2664697)
Yeah, but from early 2010 when most miners were still using CPUs.
Re:Bitcoin trojan caught in the wild by shazow on Thursday June 16, 2011 @10:44PM (#2664130)
If there's a malicious keylogger on your computer, your Bitcoin wallet is probably the last of your worries.
Re:Bitcoin trojan caught in the wild by cageface on Thursday June 16, 2011 @10:47PM (#2664140)
Actually, if I have tens of thousands of dollars or more in Bitcoins it's likely to be the very first of my worries.
Re:Bitcoin trojan caught in the wild by stuhood on Friday June 17, 2011 @12:45AM (#2664351)
This would already be a problem for you if you have an online bank account.

An insecure computer means an insecure life.

Re:Bitcoin trojan caught in the wild by brigade on Friday June 17, 2011 @01:54AM (#2664500)
You're rather likely to get your money back from a compromised bank account.

Not so (by design) with a compromised bitcoin wallet.

Re:Bitcoin trojan caught in the wild by ScottBurson on Friday June 17, 2011 @02:33AM (#2664588)
> You're rather likely to get your money back from a compromised bank account.

That's not clear:

http://news.ycombinator.com/item?id=2633280

Re:Bitcoin trojan caught in the wild by cageface on Friday June 17, 2011 @01:51AM (#2664493)
I have to imagine it's a lot easier to write a program that looks for a wallet.dat on my machine and mails it somewhere than it is to follow my steps into my bank account and transfer money.
Re:Bitcoin trojan caught in the wild by dagw on Friday June 17, 2011 @04:26AM (#2664815)
Do US banks really let you do arbitrary online transactions with only a single password?
Re:Bitcoin trojan caught in the wild by shazow on Thursday June 16, 2011 @11:29PM (#2664221)
I suppose if I had tens of thousands of dollars or more in Linden Dollars, my Second Life password would be the first of my worries.

What about your passwords to your real-life bank accounts? Or logins to confidential company data? Or emails?

If you're the paranoid type and have two-factor auth for all these things, why not Bitcoin?

Re:Bitcoin trojan caught in the wild by krschultz on Friday June 17, 2011 @08:42AM (#2665273)
It's the difference between having cash stolen from under your mattress and someone stealing your credit card.

I had someone make a fake debit card matching my account number. It didn't have my PIN, the number on the back, or my name on it, but it had my 16 digit number. That is something you can just create randomly, from the perspective of the customer there is absolutely nothing you can do to protect yourself from that. I guess they generate a bunch and test them somehow, but since the thief had a card that matched an account, he went out and tried about 9 stores in an hour. He was able to buy about $1200 in merchandise from 2 stores, the rest either rejected him or by that point the bank had declined my account.

The bank called me and told me all of this within 20 minutes of it happening. I saw the money debited from my account, my bank balance was lower, etc. They sent me 2 forms to sign saying it wasn't me, and within 24 hours the money was back in my account. Since then the bank has dealt with the merchants who took the fake card, filed a fraud report, etc. I spent less than 20 minutes dealing with this overall, it was not a big deal for me.

Contrast that with someone stealing $1200 from my safe or $1200 of my bitcoins. I'm just screwed then. I have no recourse, no one dealing with this stuff for me, etc.

While keeping your login information secure is a good thing, ultimately the banks are the ones keeping things secure. They have plenty of intelligent systems that know your typical buying habits, and you are quickly red flagged when some unusual purchases happen.

I know that transferring money out of my bank accounts over the internet at my bank REQUIRES a phone call and a piece of paper the first time. After that, sure, you can transfer instantly. But if someone installs a keylogger on my machine and transfer all the money from my checking account to my savings account or my investments, I don't really care. I'll just transfer it back. He will not be able to transfer it to his own bank account very easily, not unless he breaks the banks system. And as shown by the debit card incidident, when the bank's security fails the customer is not liable.

Re:Bitcoin trojan caught in the wild by bradleyland on Friday June 17, 2011 @09:42AM (#2665452)
Well said! The ability to handle fraud in this manner has a big picture effect as well.

Banks are powerful. They can do things that you and I can't. If a bank transfers money as part of a fraudulent transfer, it can reverse that transfer electronically. This reversal traverses the banking system all the way back to the entity that accepted the payment.

This system diffuses the impact of fraudulent transfers and places the ultimate responsibility on those accepting payment, rather than those holding currency. I know that sounds harsh, but the person accepting the payment probably has the best chance of detecting a fraud. Without this check & balance, there's very little incentive for merchants to verify the validity of the funds being used.

Re:Bitcoin trojan caught in the wild by shazow on Friday June 17, 2011 @05:20PM (#2667125)
Are you saying that banks which provide the same security and insurance for Bitcoin are not possible? Why not?
Re:Bitcoin trojan caught in the wild by rmc on Friday June 17, 2011 @04:53AM (#2664876)
What about your passwords to your real-life bank accounts?

Your bank has ways to make that more secure. If someone logs into your account from a strange IP (e.g. different country from the bank and customer), if someone tries to transfer money online, you might need to enter another password (which they might not have), or it might be based on a fob that generates a code. If you do manage to transfer money to your account, they can now follow the money to find out where you are and arrest you.

BitCoin stealing doesn't have any of these drawbacks, so is probably a much more tempting target.

Re:Bitcoin trojan caught in the wild by furyg3 on Friday June 17, 2011 @04:42AM (#2664853)
There's a key difference here:

If I get hacked, I loose all my BitCoins.

If my bank gets hacked, sucks for them.

Re:Bitcoin trojan caught in the wild by shpxnvz on Friday June 17, 2011 @09:45AM (#2665462)
If my bank gets hacked, sucks for them.

Who do you thinks ends up paying for it? The cost will certainly be passed on to the banks customers.

Re:Bitcoin trojan caught in the wild by furyg3 on Friday June 17, 2011 @10:39AM (#2665652)
Exactly my point.

With a bank I'm insured against theft. With bitcoin I am not.

Re:Bitcoin trojan caught in the wild by drivebyacct2 on Thursday June 16, 2011 @11:54PM (#2664258)
If I might ask, and I'd be happy to take this discussion elsewhere... but why? For that much money and the risk associated, surely as an investment vehicle?
Re:Bitcoin trojan caught in the wild by pavel_lishin on Friday June 17, 2011 @12:18PM (#2666069)
> Wallet encryption isn't any help against keyloggers

Same can be said about bank accounts, unless you're using 2-factor auth with a dongle.

Re:Bitcoin trojan caught in the wild by gojomo on Friday June 17, 2011 @12:56PM (#2666212)
Bank accounts usually limit online transfer destinations and amounts. So password secrecy is not the sole defense, and even total ownership of an accountholder's computer is not quite 'game over' for their balances, as it is with a bitcoin wallet.
Re:Bitcoin trojan caught in the wild by rmc on Friday June 17, 2011 @05:16AM (#2664919)
(maybe even give you a bit of interest growth)

You can't really do interest with BitCoins, since it's a fixed amount. Deflation is built in, so in way just holding the BTC will make them 'grow' in value.