News for hackers. Stuff that matters.

A comment on “Crypto drainer” template facilitates theft. Parent comment

Re:“Crypto drainer” template facilitates theft by AgentME on Wednesday June 15, 2022 @06:58PM (#31760517)
I think that explanation was just a little too jargony.

If you have the Metamask browser extension (or another compatible web3 extension) and press its browser button to enable it while on a webpage, then the webpage can see your wallet address and suggest transactions for you to make. When that happens, the browser extension then shows a window under its own control explaining the transaction and allows you to choose to sign or reject the transaction.

The webpage never sees anything about your wallet if you don't activate the extension on the page specifically, it never sees your private keys, and it can never silently sign a transaction from you.

[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by patch_cable on Wednesday June 15, 2022 @07:19PM (#31760681)
The UX is similar to buying something with Apple Pay from a website in my experience.
[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by Phlarp on Wednesday June 15, 2022 @11:58PM (#31762326)
Apple Pay doesn't run as a browser extension with a nasty habit of granting bad actors full access to drain your funds in a totally irreversible way.

Does any of that fall under "user experience" for you?

[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by patch_cable on Thursday June 16, 2022 @12:13AM (#31762381)
The distinction between “browser extension” and “baked into Safari” didn’t seem like an important distinction for this discussion.

The similarities are that in both use cases the user is presented with a request to approve or deny.

[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by Thorrez on Thursday June 16, 2022 @01:35AM (#31762740)
Yeah, I think the main differences are:

* Phished Apple Pay transactions can be reversed. Crypto transactions can't be reversed.

* Actors who phish Apple Pay transactions will be banned. Crypto bad actors generally can't be banned.

[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by tatertots1234 on Thursday June 16, 2022 @03:11AM (#31763298)
Banned from what?

If somebody sets up a phishing website in the US with intent to steal funds, they are equally as liable whether their target is a crypto wallet or Apple Pay.

[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by lupire on Thursday June 16, 2022 @08:26AM (#31765229)
Banned from the banking network. You can't receive credit card payments directly.
[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by nieve on Thursday June 16, 2022 @04:41AM (#31763755)
Has there ever been a prosecution for theft of crypto via phishing/draining?
[ Parent | on HN ]
Re:“Crypto drainer” template facilitates theft by tatertots1234 on Thursday June 16, 2022 @05:15AM (#31763963)
Plenty of charges have been laid over the years related to crypto phishing and fraud.
[ Parent | on HN ]