5 ms·
If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now. When you give them your bitcoins, you are t
by Xk 15y ago
If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now. When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for two reasons: (1) they have a large safe and have practice keeping people out, but more importantly, (2) if someone were to break in and take some of the bank's money, I would know that I could still withdraw my money because they have enough cash on hand for me to do so.
Mtgox has neither of those assurances.
They have absolutely no credibility on the security front. They were using MD5 with no salts at one point in time. They then moved to MD5 with salts. Now they are at "SHA-512 multi-iteration, triple salted." That seems more like they're trying to say "Oooohh! Look at us! See?! We're being secure!" Triple salted means what, exactly? (Other than the fact that it makes it clear these are people who read about salting online and then though "more is better.")
Next: "we have actively been patching holes." Oh no. You mean, you're just going through the code and looking for bugs and hoping you get them all? That might work for normal programs just fine, but even ONE vulnerability is enough to take an entire database. A database hosting just passwords may not be all that bad (it usually is, but it doesn't have to be). A database which hosts thousands and thousands of dollars? Now that is something to worry about. It truly does look like they got lucky on this attack.
As for the guarantee that banks give -- that if they get broken in to, I will still have my money -- there is no way mtgox provides this. Anyone who still has money on mtgox is asking for trouble.
- latch 15y agodon't disagree with most of what you said, but...you sure about this part? I would know that I could still withdraw my money because they have enough cash on hand for me to do so. http://en.wikipedia.org/wiki/Fractional-reserve_banking http://en.wikipedia.org/wiki/Fractional-reserve_banking Or if you want a more practical example, keep watching Greece (or look at what happened to Argentina 10 years ago).
- Xk 15y ago> don't disagree with most of what you said, but...you sure about this part? Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there would be other serious problems. > Or if you want a more practical example, keep watching Greece If I was in Greece, I would not have my money in one of their banks.
- latch 15y agoI thought we were talking within the context of "serious problems". As for greece, well..it happened to Washington Mutual in 2008 - the largest savings in loan institution in the US. Of course, this is only one of many US banks which were not able to produce money when it was wanted in 2008. There's a reason banks have a legal right to refuse a withdrawal, specifically because they may not have enough funds. That reason is: because it has and will happen.
- tedunangst 15y agoI had my "life savings" in WaMu. Now it's in Chase. I didn't lose a penny. At no point was I unable to withdraw my money. What happened with Washington Mutual is not what's going to happen if there's a run on Mt Gox.
- latch 15y agoThere are stories (see consumerist.com) of cash withdrawals not being possible. I admit I got a little off track though. My parent specifically stated withdraw money when he wants. There's plenty of evidence that at the peak of the crisis, some people had problems. But I agree, it seemed to have been few, and in the context of Mt Gox, it isn't really relevant.
- harshpotatoes 15y agoI don't know of a single person unable to withdraw their money from WaMu as it went under. All of WaMu's accounts were then passed on to chase, and chase honord them. If WaMu went under, the savings accounts would have been FDIC insured. None of that will happen if Mt Gox is compromised in some catastrophic way.
- white_devil 15y ago> Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there would be other serious problems. Last year, a branch office of a large bank in Finland was barely able to produce 10 000 euros in cash when I wanted to withdraw it. The clerk just didn't realize he shouldn't mention it. Don't be so sure.
- tedunangst 15y agomtgox accounts are not FDIC insured.
- latch 15y agoI understand that. I am curious how effective insurance deposite works in the face of a country-wide breakdown. I know Greece has a deposit fund, I'm curious to see how effective it'll be (does it actually cover 100% of the deposited money (up to the maxium per account)?)
- drivebyacct2 15y agoIt doesn't. The FDIC doesn't have a fraction of the money needed to insure a fraction of the money that is supposedly FDIC-insured. More over, the United States likely lacks the gold to back our current currency, let alone the currency needed to prop up those who lose money in the situation of the decreasing number of banks failing.
- georgemcbay 15y agoUS currency hasn't even pretended to be backed by gold since the early 1970s.
- drivebyacct2 15y agoI was more referring to the fact that we fail to produce proof of the limited amount of gold that we claim to have and every attempt to audit it is rebuked magically. In terms of the question, how would it be handled from an FDIC perspective if it came to a worst case scenario... it'd be a shit-show.
- Locke1689 15y agoI was more referring to the fact that we fail to produce proof of the limited amount of gold that we claim to have and every attempt to audit it is rebuked magically. I think you're just rambling. Our currency isn't gold backed -- who cares how much the US govt. has in gold repositories and why does it need to be checked?
- ignifero 15y agoOK we are taking about vastly different scales here, but there is no absolutely trusted scheme in the world. The US has been printing money since 2008 to cover the losses of the Crisis, so the real world has an advantage here.
- clistctrl 15y agoThe US government guarantees my bank account up to (i think 200k) There is no Internet Government that guarantees my bit coins.
- zachanker 15y agoIt was crypt-MD5, the fact that they call it MD5 with salt is generous at best. They seem to have made the decision to move to crypt-MD5. I don't really have any faith in their ability to secure the servers.
- walkon 15y agoTrue, but I think this has been fixed, assuming their new site is live: "The new Mt. Gox site features SHA-512 multi-iteration, triple salted hashing and soon will have an option for users to enable a withdraw password that will be separate from their login passwords."
- Locke1689 15y agoWhich means that they're not using bcrypt, which means they still have no idea what they're talking about and are probably insecure.
- tedunangst 15y agoThey could be using PBKDF2, but if they were, they probably should have said the magic words. Also, the iteration count is kind of important. If it's triple-iterated, that won't do much good.
- zachanker 15y agoEven with the iteration count, SHA512 is not exactly meant to be slow. They're taking the long way around to try and get the security of bcrypt... without just using bcrypt.
- davidhollander 15y ago> Even with the iteration count, SHA512 is not exactly meant to be slow. Increasing iteration count is synonymous with intending something to be slow. BCrypt itself uses a default of 2^10 iterations in most bindings. PBKDF2 + and an NIST studied hashing algo like SHA512 is a perfectly valid method.
- Andys 15y agoThe reason Mt Gox needs to obsess over password database is because they don't seem experienced enough to secure the rest of their site. When it comes down to it, they are still a "PHP+mysql" site like all the others on the Internet. Would you store your funds at the Bank of Wordpress?
- illicium 15y agoFacebook is a "PHP+mysql" site.
- dkersten 15y agoI wouldn't store my money on facebook either.
- danssig 15y agoI wouldn't either but that's because I can imagine Facebook just straight-up stealing it. Nothing about security.
- hackinthebochs 15y agoTotally off-topic, but I find this attitude curious. What makes you think facebook would do something of that sort? What possible evidence do you have for the potential of this sort of outright criminal behavior? It seems to me your loathing of facebook is completely irrational. Unfortunately its this irrationality that drives most discussions regarding facebook in tech circles.
- danssig 15y agoIf someone is a known thief, it stands to reason that they will probably steal again if the price is right. Zuckerberg showed, unambiguously, that he will not only steal ideas but sabotage the people he's stealing from. I would say very little is beneath such a person.
- 15y ago
- lutorm 15y agoTo be fair, you need to put your real money somewhere like a bank. You don't need to put your Bitcoin anywhere except your wallet, so there is no reason to keep your Bitcoin in Mtgox unless you are trading it. Keeping all your Btc in Mtgox is more like keeping all your money in your Paypal account, and who in their right mind would do that?