News for hackers. Stuff that matters.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by smeej on Saturday September 14, 2024 @08:36PM (#41544199)
It's a surprisingly hard threat to model against.

For example, sure, don't store your funds on an exchange and they can't get in with a SIM swap, but when they're in your house, that doesn't help you.

You could store your funds with a multisig wallet and make sure you don't have access to enough keys at home to move the funds, but how do you make them believe you?

You can have one or more decoy wallets you can "cave" and give them access to if you think it might buy your freedom, but once you start, again, why would they believe you?

Do you just acknowledge that they won't believe you,that they are going torture you regardless? And at least make sure you or your heirs have the money if any of you survive?

There really isn't a good way out of this.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by jncfhnb on Saturday September 14, 2024 @10:19PM (#41544703)
How about a trusted third party that adds a little bit of friction for suspicious transfers of large volumes of money?
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by SV_BubbleTime on Sunday September 15, 2024 @12:23AM (#41545203)
Hmm. Maybe like the group holding your assets has a centralized check and control system? Like they could operate physical locations and have staff? A novel concept.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by xelamonster on Sunday September 15, 2024 @03:23AM (#41545848)
Great idea! Those things cost money though and users won't like paying up-front--they'll have to be sure to make up costs with obscene fees, the more obfuscated the better. To minimize pushback on the fees they should consider focusing them on the most disadvantaged users, since they're least likely to be able to do anything about it. Isn't it a great system?
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by atty on Sunday September 15, 2024 @12:45AM (#41545279)
Perhaps these groups could be regulated and insured by an even larger entity, perhaps even one with the authority to punish individuals and organizations for wrongdoing?
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by tenuousemphasis on Sunday September 15, 2024 @03:05AM (#41545790)
With Bitcoin, you could create that third party in a trust minimized way, something impossible to do with the banking system.

For instance, if the third party refuses to authorize a legitimate transaction, you have a third key you keep offline somewhere that can be used to force a transaction through.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by xelamonster on Sunday September 15, 2024 @03:14AM (#41545818)
Then your third key would be vulnerable to the same $5 wrench attack as your seed phrase is now.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by jncfhnb on Sunday September 15, 2024 @09:11AM (#41547303)
And if you lose the third key you are now beholden to the third party with no recourse
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by roenxi on Sunday September 15, 2024 @04:58AM (#41546241)
I get the joke, but you could do that without the trusted third party. It is pretty easy to imagine a system where transfers have to be signalled X blocks before the actual transaction takes place if the transaction is statistically weird. The sort of problem smart contracts are there to solve.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by nullc on Sunday September 15, 2024 @05:42AM (#41546410)
Unfortunately you can do awesome security stuff, but the threat comes from the perception of vulnerability, not the reality of it.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by throwawayffffas on Saturday September 14, 2024 @10:33PM (#41544761)
You could custom program a canary wallet. When the wallet makes a transfer it automatically calls 911 and sends the cops to your house or your phones location.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by koolba on Saturday September 14, 2024 @09:15PM (#41544395)
> There really isn't a good way out of this.

The answer is to live anonymously. Don’t flash the cash.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by flarex on Saturday September 14, 2024 @09:32PM (#41544480)
It's becoming increasingly difficult. Data leaks, address and name leaks and chain analysis have made it easier to track who owns what. If crime agencies are able to track wallets down then criminals are too.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by throwawayffffas on Saturday September 14, 2024 @10:10PM (#41544658)
Maybe if your money is not on a public blockchain you don't have to worry about chain analysis.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by CaptainOfCoit on Saturday September 14, 2024 @10:19PM (#41544702)
Only the your onramp/offramp would need to know who you are (because of KYC/AML), otherwise you can be as anonymous as you want and it really isn't hard, assuming you don't want to hide from your onramp/offramp.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by valicord on Sunday September 15, 2024 @12:56AM (#41545316)
Unless of course you want to use your hard earned crypto to buy tangible things over the Internet.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by CaptainOfCoit on Sunday September 15, 2024 @07:41AM (#41546873)
Why unless? Say you have 1 ETH in Wallet A, if you transfer it to your on/offramp (the exchange) and then do Wallet B, the only link between Wallet A and B is only known by the exchange, so you'll remain private (publicly, again assuming you don't want to hide from the exchange).
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by throwawayffffas on Sunday September 15, 2024 @10:17AM (#41547656)
You can't trust the exchange to not inadvertently leak the information. A substantial leak could include personally identifying information along with account balances and or deposit and withdrawal totals.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by CaptainOfCoit on Sunday September 15, 2024 @10:56AM (#41547856)
Somewhere along to lines, if you want USD, you need to trust someone, it's inescapable. So once you know this, you can act accordingly.

But still, the original argument was that you have to worry about chain analysis because everything is public, but obviously that isn't true, no matter if an exchange may or maybe not inadvertently leak something.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by Banou on Sunday September 15, 2024 @04:57AM (#41546239)
Onramps/offramps generally generate individual wallets per user to send/receive from, so it still goes back to you at the end of the day.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by CaptainOfCoit on Sunday September 15, 2024 @07:40AM (#41546867)
They either generate wallet address dynamically, and in those cases allow you to regenerate one at will.

Or, they have wallets that acts as combined input/output for all/groups of users.

I don't know a single big exchange that generates exactly one wallet per user and uses that one always for the same user.

When you think about it, it makes a lot of sense they do it like that.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by Banou on Sunday September 15, 2024 @09:56PM (#41552038)
First one maybe but definitely not the second one. Have you actually thought of it? How would the platform know who sent what. They can't. So it's definitely not shared on the deposit side. And I doubt they'd move the money around because of fees so I doubt it's shared on the withdrawal side too. From my experience, of course it depends on the blockchain used, but they all have static addresses per user
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by smeej on Friday September 20, 2024 @04:05PM (#41605135)
Addresses, sure, but not wallets.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by tptacek on Saturday September 14, 2024 @10:45PM (#41544810)
I mean, that, or keep your money in a bank or brokerage. But yeah, I guess if you're not going to do that, git gud at opsec.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by fakedang on Saturday September 14, 2024 @10:13PM (#41544669)
This is the way.

A friend of mine became insanely wealthy just off of Bitcoin. Immediately went off the grid a few years (back in 2017). Now owns a precious metals mining company in South America. Still holds Bitcoin, lives comfortably to a point, changed passports to evade sanctions (he was Russian), and even has a kind of his own private army, that's mostly involved in the mining business.

You wouldn't figure all of that out by simply looking at him, but strike him now and you'd have to contend against a few major governments at this point.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by gverrilla on Sunday September 15, 2024 @06:55AM (#41546678)
Yes private armies are VERY SECURE.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by fakedang on Sunday September 15, 2024 @07:15AM (#41546772)
Well it's practically a security corporation that has contracts with a major US ally. Their work is mostly for that government.

But yeah, he basically lives like a dead man.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by lmz on Saturday September 14, 2024 @09:10PM (#41544370)
Maybe if the exchanges didn't require KYC or phone, there would be no way of knowing where they live just from the exchange account.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by flarex on Saturday September 14, 2024 @09:41PM (#41544539)
The decoy method doesn't even work because a smart criminal could just check your exchange withdrawals for amounts. You'd have to hope that they were ignorant enough.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by kurthr on Saturday September 14, 2024 @10:13PM (#41544671)
Put it on a physical drive in a safe deposit box.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by the__alchemist on Saturday September 14, 2024 @10:52PM (#41544835)
Safe deposit boxes are not be as safe as you think.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by bufferoverflow on Saturday September 14, 2024 @11:40PM (#41545030)
So put in an encrypted form, the password is in your head.

Use 2 or 3 safety deposit boxes, they are very cheap.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by SV_BubbleTime on Sunday September 15, 2024 @12:25AM (#41545213)
The faintest of ink will outlast the best of memory.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by smeej on Friday September 20, 2024 @04:08PM (#41605157)
That's not remotely true. I get a receipt from a specific service provider every week that I could easily recreate from memory, but the ink fades within a month.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by bruce511 on Sunday September 15, 2024 @01:47AM (#41545493)
Not to be flippant, but your head is not terribly secure either.

Coercion is a thing, and despite what you see in the movies, you'd be surprised at how fast you offer the password.

But perhaps more certainly, you will at some point die, and it's probable you will do so lacking the capacity to pass the code on to your heirs. So if you want your wife and family to jnherit, well, you may want to rethink.

And that's before we discuss thd uselessness of crypto as currency where you have to go to your safe deposit box to spend any of it.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by bufferoverflow on Sunday September 15, 2024 @01:22PM (#41548831)
You misunderstood. Since your keys are stored encrypted in a safety deposit box, it doesn't matter if you're forced to tell your password to some random thug - they don't have access to your keys.

You can also put your password in your will, if you're afraid of not passing it to your family.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by smeej on Friday September 20, 2024 @04:07PM (#41605144)
But again, how do you make the thug believe you?
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by spencerchubb on Saturday September 14, 2024 @08:39PM (#41544210)
Multisig wallet where you and your spouse both have to sign. In case one dies, the multisig can expire after a certain amount of time and let you access with just one key

Of course this assumes you have a spouse

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by KMnO4 on Saturday September 14, 2024 @08:49PM (#41544256)
Don’t you live with your spouse?

Now the intruder has a gun pointed at both of you.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by coolspot on Sunday September 15, 2024 @04:49AM (#41546199)
You need to diversify your spouses. One lives with you, others are living away.
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by dambi0 on Saturday September 14, 2024 @10:20PM (#41544711)
Insurance?
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by justinclift on Saturday September 14, 2024 @09:22PM (#41544432)
> There really isn't a good way out of this.

Reputable private security?

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by ghaff on Saturday September 14, 2024 @09:53PM (#41544588)
Well, sure. So how much do you now spend on reputable private security and how many restrictions do you place on the movements of you and your family?
Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by justinclift on Sunday September 15, 2024 @05:21AM (#41546331)
Not really sure what the question is?

It doesn't seem to be uncommon for wealthy people to need private security. It seems like some of the crypto-types are learning why the hard way.

Is that going to cramp their style? Well sure, that's part of the consequences of their choices.

Re:Twelve Sentenced for Violent Home Invasion Robberies to S... by csomar on Sunday September 15, 2024 @09:21AM (#41547358)
You can have timed transactions with Bitcoin. That is the transaction will only be valid after xxxx date. You do, however, need to keep creating transactions to keep pushing the date further.