Crypto wallet security as seen by security engineers

Re:Crypto wallet security as seen by security engineers by xyzzy123 on Wednesday December 15, 2021 @06:33PM (#29572909)

It's not like this stuff is hard to reverse but those skills are a bit more scarce and it requires more effort.

My opinion is that you'll get relatively more blackhat "eyes" on your code and fewer whitehat "eyes" if you go closed source.

Personally, I don't know anyone who would reverse a closed-source wallet to report bugs "out of the goodness of their hearts", but I do know a bunch of people who would report bugs in good faith to open-source projects.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by AshamedCaptain on Wednesday December 15, 2021 @06:55PM (#29573089)

Wait a second. The biggest problem here with a crypto system that is not open is not that "it may have not passed through a lot of eyes", it's that it may have not passed through EVEN A SINGLE EYE. The closed system could very well be "we xor this with ILUVPUPPIES repeated ad infinitum" and very few people would the wiser.

An open system at least means _you_ can have a quick look into it. Every other advantage is not guaranteed, but with the amount of pure snake oil out there this one guaranteed advantage is friggin important.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by fragmede on Wednesday December 15, 2021 @09:42PM (#29574202)

Hopefully (blind coders aside), the code's passed through, at the very least, one set of eyes. GPT-3's not that good at writing code yet!

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by echelon on Wednesday December 15, 2021 @06:19PM (#29572802)

> Especially in a world where the black market pays better than bug bounty programs.

In crypto/DeFi/croins/crokens/whatever, the bug bounty can be the entire holdings. And there are no legal ramifications or manners of recourse/restitution.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by lmm on Wednesday December 15, 2021 @09:28PM (#29574121)

The whole point of the game is that the tokens belong to whoever got the code to run to transfer them to them, isn't it? Complaining that someone "stole" your tokens is like complaining that someone "stole" your gold in an MMORPG.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by jjnoakes on Wednesday December 15, 2021 @06:22PM (#29572821)

> And there are no legal ramifications or manners of recourse/restitution.

I'd appreciate a source on that... Both seem unlikely to me. More difficult perhaps, but impossible you say?

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by VTimofeenko on Wednesday December 15, 2021 @06:26PM (#29572860)

Well in crypto there does seem to exist a somewhat widespread notion of "code is law". If the existing business logic is used to do something undesirable (transfer all money to another person) - in such axiom set that action would be considered in line with the " law".

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by SEJeff on Wednesday December 15, 2021 @07:37PM (#29573430)

"code is law" has yet to be tested in courts. It is highly suspect that actual humans in a jury would all agree this is the case.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by pcthrowaway on Wednesday December 15, 2021 @08:28PM (#29573759)

We'll have an answer (applicable to the U.S. at least) soon enough: https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by echelon on Wednesday December 15, 2021 @10:06PM (#29574345)

Time to write code that indebts the user to you forever, then get FAMAGMA to use it.

Code is law.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by jbkiv on Wednesday December 15, 2021 @09:53PM (#29574270)

Code law? You must be kidding. It is OK to chat about "Code Law" among like minded individuals always on the lookout to crack open the pirate's chest. It is a different story to explain to a judge: "sir, the bank had left the vault open during the fire alarm. I just helped myself with few $M. It is the bank's fault". Good luck.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by lottin on Thursday December 16, 2021 @01:40AM (#29575666)

If the smart contract is not the contract, then where is the actual contract? I imagine the judge would like to know that. If there's no contract, they'll have a hard time convincing anyone that there was a breach of contract.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by 3np on Wednesday December 15, 2021 @07:27PM (#29573343)

This notion is only used in context of smart contracts and on-chain virtual machine code.

This is in contrast to wallet implementations.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by NicoJuicy on Wednesday December 15, 2021 @08:41PM (#29573846)

Https://rekt.news - plenty of references

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by jjnoakes on Wednesday December 15, 2021 @09:48PM (#29574243)

A list of compromises or exploits isn't a source for the claim that there aren't legal repercussions or avenues of recourse that could be pursued.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by NicoJuicy on Thursday December 16, 2021 @02:28AM (#29575933)

Most hackers can't even be found, since it goes to tornado Cash and owners are clueless or it's an intern job.

So plenty of examples on that site.

What would the recourse be if none of the malicious actors can be found? ( In almost all cases).

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by iostream23 on Wednesday December 15, 2021 @10:37PM (#29574492)

Wait, are you saying that there is recourse for reversing blockchain transactions?

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by jjnoakes on Wednesday December 15, 2021 @11:05PM (#29574679)

See the DAO hack for precedent.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by NicoJuicy on Thursday December 16, 2021 @10:21AM (#29579013)

There's no result in court. So what's the recourse now at this moment ?

Additionally, they were lucky they could find the 16 yr old kid, otherwise they wouldn't known in which jurisdiction to sue :)

Welcome to the decentralized world!

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by jjnoakes on Thursday December 16, 2021 @10:44PM (#29587447)

Sorry, not following. The recourse I was referring to was a fork and modification of the transactions in question.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by NicoJuicy on Friday December 17, 2021 @08:17PM (#29600468)

Okay, part of the subject was "legal repercussions" and i thought it was related to that.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by e40 on Wednesday December 15, 2021 @06:50PM (#29573066)

There’s definitely a bit of a cult of open source. Just because I can look at your code does not inherently, magically make it more secure. Especially in a world where the black market pays better than bug bounty programs.

And open source projects likely pay nothing! I've certainly never heard of a paid bug bounty for any open source project, which doesn't mean they don't exist, it just means it's not that common.

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by SEJeff on Wednesday December 15, 2021 @07:36PM (#29573423)

There definitely are a few, kubernetes actually has a dedicated one that hacker one runs. Here are a few examples:

https://www.hackerone.com/internet-bug-bounty

https://huntr.dev/

https://securitylab.github.com/bounties/

https://www.mozilla.org/en-US/security/bug-bounty/

[ Parent | on HN ]

Re:Crypto wallet security as seen by security engineers by mikeodds on Wednesday December 15, 2021 @07:41PM (#29573462)

There are some but for of the projects I’ve looked at, you are almost certainly getting a better payout by selling the vulnerability (monetarily not karma wise) to zerodium et al.

[ Parent | on HN ]