20 ms·

Funds of every Trust Wallet browser extension could have been stolen

158 points by whenlambo 3y ago

asplake 3y ago
> That probably means this vulnerability exists in some other wallet implementations which is concerning…
- sjsdaiuasgdia 3y ago
  This song is almost as old as Bitcoin itself. 2013: https://bitcoin.org/en/alert/2013-08-11-android https://bitcoin.org/en/alert/2013-08-11-android All that trust I have to put in the non-crypto financial system doesn't seem too bad when you realize that the trust picture isn't all that different in the crypto world. Do you trust that the exchange won't steal your money? Do you trust that the software developers haven't intentionally or accidentally left any holes in the software you use to manage your money, or the smart contracts you interact with? Do you trust the vendor you're buying from to not steal your money? If you're thinking "escrow services", do you trust the escrow service to not steal your money? Do you trust in all that, and more, sufficiently to operate in a system where there is no way to undo erroneous or malicious transactions? Except for like when ETH rolled back the chain after the DAO incident...you know, going contrary to the immutable ledger concept this whole mess is built on...what you might even say is the most essential trust in crypto.
  - DennisP 3y ago
    I'm just going to cherrypick one point here: the crypto version of escrow services can't steal your funds. The idea is to use 2-of-3 signatures, in some kind of smart contract (even a really basic one that Bitcoin can support). If buyer and seller sign the transaction, the escrow service never sees it. If buyer and seller disagree, then the escrow service decides whether buyer or seller gets the money. The escrow service never holds the money, the contract does that.
_trampeltier 3y ago
Why is in something so new (WASM), a such bad random generator?
- deleted 3y ago
  [deleted]
- 4gotunameagain 3y ago
  Because if you read the article, you would have been informed that through WASM they did not have access to existing PRNG (e.g. /dev/urandom), and had to roll a mersenne twister. Which should not be used. It is about implementation, not about WASM
  - nailer 3y ago
    That sounds incorrect, though WASM you have access to webcrypto getrandombytes which is native OS randomness.
    - lxgr 3y ago
      Yes, but that wasn't even the problem. Trust Wallet needlessly wrapped `std::random_device` (which might or might not be cryptographically secure by itself, depending on how it's implemented in whatever WASM-generating stack they use) in an instance of `std::mt19937` (which is definitely insecure, whether seeded cryptographically or not, due to being seeded with only 32 bits of entropy in their implementation; but even seeded properly, a Mersenne Twister would eventually leak internal state).
  - _trampeltier 3y ago
    Yes, that's my point. WASM is new. So why does it not just have strong cryptographic functions from the very beginning? Strong random generators are super important today. Why don't they just demand strong crypto functions in every implementation? I mean, this calls just for endless troubles, if you don't can trust a random generator in WASM (depending on the implementation).
bsenftner 3y ago
Yeah, trust web 3.0...
fallingknife 3y ago
This is the fundamental issue with the supposed "trustlessness" of crypto. Unless you are interacting directly with the protocol layer (which is like 0.0001% of users), you actually have to trust a lot of people and software. And the whole system has been built on anonymity because it is "trustless," so it can never work in its present form. Sure, there is someone, or multiple people, at Wells Fargo who can move your money. But they will never be anonymous, and all of their actions are logged and tracked, and we have laws on the books requiring banks to be liable for such fraud and return the money to the customer. And failing that, if the whole bank goes down from the fraud, your money is FDIC insured, and the government will make you whole. Whereas in crypto, if someone gets your private key, you are instantly and irrevocably fucked. Crypto can never be anything more than a gambling tool unless it drops this "trustless" myth.
- wslh 3y ago
  First, the trustlessness in crypto, it is just a nice keyword. You trust the protocol and the protocol trust depends on specific nodes (e.g. miners). Would you trust more these actors that hundreds of well known companies using a BFT protocol? Or a mix of both groups? Second, key(s) custody is paramount beyond the blockchain technology used. And... this was very basic: "Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds."
- Al-Khwarizmi 3y ago
  Yeah, in fact for me the trust in a banking system (or anything else that keeps my money) is not in being in control, but in knowing that if things go wrong (regardless of whether it's someone else's fault or my own) I can complain and have a more or less realistic expectation to get my money back. For example, my main credit card was used fraudulently a couple of times, through no fault of my own (AFAIK), but the bank rolled back the charges, cancelled the card and issued a new one. This makes me trust using the card. In the last few years, at least in my country, many banks seem to be transitioning from "patchy security, but take responsibility" to "better security, but blame the client". I.e., they add lots of mandatory over-the-top 2FA, etc. but if a client complains of a transfer they didn't make, surely it's the client's fault, because security is really good. This makes me trust such banks much less. Firstly, because even being a tech-savvy user that doesn't typically fall for scams, etc., nobody is perfect and I don't think anyone is 100% free of making a security blunder in a moment of being sleep deprived, ill, drunk, etc. And secondly, because what if they get hacked somehow and they make me responsible? No, I very much prefer worse security but listening to clients. Similarly, in crypto, "your keys, your coins" doesn't give me trust. What if I lose my keys somehow? In the bank, they know who I am, as long as I have a means of ID I can get my money. And as you mention, even if the bank fails, the government has my back. For all these reasons, while I do hold some crypto, I'd never keep a significant portion of my assets in that form.
louison11 3y ago
Why anyone would hold any significant amount in a chrome extension is beyond my understanding. Even if you’re using Metamask, use it in hybrid mode with a Ledger.
- sjsdaiuasgdia 3y ago
  There is absolutely nothing preventing a developer using a crap RNG in some other wallet...and indeed it's happened several times over the years on various platforms. It does sound like wasm makes the misstep somewhat easier in that it doesn't try to provide an RNG sufficient for cryptographic usage, but that also applies to quite a few other development platforms.
- rchaud 3y ago
  Because it is used by people, not cybersecurity experts. From the vendor's website[0]: > Our position is simple: Your wallet. Your keys. Your crypto. Built-in private key encryption and a password-protected login means you’re always in complete control. An average person that reads this wouldn't think about needing to add more protections. [0]: https://trustwallet.com/browser-extension/ https://trustwallet.com/browser-extension/
  - deleted 3y ago
    [deleted]
  - ravenstine 3y ago
    Still, it's disappointing how (understandably) inept the average person is at reasoning where they should and shouldn't be placing trust in tech. It's also disappointing to be involved worth the tech industry, broadly speaking, and frequently witness shit shows of security incompetence and outright charlatanism. We can all do better, right? How we do that is definitely a question.
    - yamazakiwi 3y ago
      The base level of knowledge for computing is poor because computing is new in history. How do I know what you personally trust is trustworthy? Some people use Protonmail trying to avoid lawful prosecution, thinking they're protected, and they will tell you they know what they're doing. A lot of the time there is too much noise for the common human to make an informed decision.
pontifier 3y ago
At some point there won't be any more suckers left. That's when crypto will really collapse.
- tyingq 3y ago
  I don't know...multi-level marketing still seems alive and kicking.
  - sjsdaiuasgdia 3y ago
    https://xkcd.com/1053/ https://xkcd.com/1053/ but instead it's the unlucky 10k per day learning about a scam the hard way
  - orangepurple 3y ago
    Even MMM Global seems to be operating still http://www.mmmglobal.in/ http://www.mmmglobal.in/
  - api 3y ago
    ... as are casinos. I don't think it will collapse. It has found product-market fit: mostly gambling, some money laundering and crime, and some legitimate use for international wires and payments under oppressive political conditions (this last part is the smallest amount by volume). There will occasionally be attempts to pump some new use case (e.g. NFTs), but these are just casino advertising. They'll draw in some new suckers/players and the cycle will repeat. The maximalist cult will continue to exist as well, patiently awaiting the coming of the space brothers in the form of a massive economic collapse causing Bitcoin to "moon" and become the new global reserve currency. This is identical to the goldbug cult of previous generations and involves many of the same types of people. Apocalyptic cults can exist for a long, long time and failed prophecies do not deter true believers.
    - deleted 3y ago
      [deleted]
- InCityDreams 3y ago
deleted 3y ago
[deleted]
mike_hearn 3y ago
I was writing about this exact problem of bad RNGs in web cryptocurrency wallets a ~decade ago. It is profoundly depressing that so little has changed: https://medium.com/mike-hearn/type-safety-and-rngs-40e3ec71ab3a https://medium.com/mike-hearn/type-safety-and-rngs-40e3ec71a... Browsers have a number of problems that make it difficult to build wallets, but I’m not going to try and convince you to stop making them here. Suffice it to say there are alternatives for writing cross platform wallets you could consider. Browsers just aren't intended for doing things that require the generation and safe storage of private keys. The developers don't care about these use cases. Like with so many others, if you want to do it properly you have to go outside the browser. Back when I was involved with the cryptocurrency world (pre-2016) I kept hitting this general reluctance to just write normal desktop apps, and whenever I advised people to do it for security or stability reasons they'd insist on writing something browser/JS based instead. I did write desktop based wallets, but was considered old fashioned for doing so (at the ripe age of 35). Way too frequently people would end up losing all their money to dumb and entirely predictable hacks as a consequence of using a web-based wallet, or even just lose because of sites going offline. Browsers improved a bit since but as this episode shows, they still aren't intended for it. Part of why people wanted to write js was that it is easy to distribute the results. They optimized for developer convenience over security. Chrome offers a portability layer and keeps extensions up to date for you. Years passed and I saw the same problem crop up in other contexts too: the right approach was to write a desktop app, people tried to hack Chrome into compliance instead so they could let it handle distribution, it didn't work, and that sometimes led to disaster for their users. These days I have a company that tries to solve this problem. We make Conveyor [1], which has the goal of making desktop app distribution as easy as for a web app. And it mostly succeeds: it can cross-build/package apps for every platform, and on Win/macOS it can provide update-on-start so you can iterate as quickly as with a web app. You pick your preferred portability layer (flutter, jvm, electron, something rusty etc) and can choose between more battle tested frameworks or more experimental frameworks depending on your appetite for risk. Whatever you pick, the distribution experience is the same. You don't have to compromise on UX either. Frameworks like Compose for Desktop, Flutter, heck even JavaFX give you nice solid 60fps animations and can be made to look good easily. You can store private keys in the user's secure keystores. If your site goes down it's not an emergency, your app still works, only updates stop until you're back online. Even if your certificates expire your app will still work! I hope that people will take this stuff more seriously in future. It's got a lot easier to distribute apps without relying on browsers or stores over time. Browser developers do a good job but are ultimately constrained by the web's origins. It's not just cryptocurrency wallets that can benefit from escaping the browser either! Quite a lot of security bugs can be eliminated when you leave the browser. For example you can write apps that are immune by design to XSS, XSRF, SQL injection, phishing and other common bug classes. At some point I should probably write these thoughts down in a more modern blog post. [1] https://hydraulic.software/ https://hydraulic.software/
nailer 3y ago
Hah this happened to Debian a few years ago. Someone fixed a compiler warning and limited the entropy range for secret keys.
- cma 3y ago
  AMD also had a pretty bad bug: https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd...
krono 3y ago
> Creating good randomness is a daunting task - Ledger devices rely on dedicated silicon logic in our certified smartcard chips that have been the gold standard of secure industries for the past 40 years to guarantee high quality randomness and tamper resistance. Which is worthless and entirely irrelevant when they keep leaking their customers' personal and purchase data (which they claimed not to collect or keep, and even failed to delete after the first leak) time and again. https://web.archive.org/web/20221030030843/https://cointelegraph.com/news/ledger-data-leak-a-simple-mistake-exposed-270k-crypto-wallet-buyers https://web.archive.org/web/20221030030843/https://cointeleg... https://web.archive.org/web/20220901153130/https://www.coindesk.com/business/2020/12/23/from-sim-swaps-to-home-invasion-threats-ledger-leak-has-cascading-consequences/ https://web.archive.org/web/20220901153130/https://www.coind... https://old.reddit.com/r/ledgerwalletleak/comments/ki1nsz/received_phone_call_threatening_kidnapping_and/ https://old.reddit.com/r/ledgerwalletleak/comments/ki1nsz/re... https://old.reddit.com/r/CryptoCurrency/comments/rts1w2/got_compromised_and_lost_over_120k_in_crypto_ama/ https://old.reddit.com/r/CryptoCurrency/comments/rts1w2/got_... https://twitter.com/yeolddoc/status/1353139243548364805 https://twitter.com/yeolddoc/status/1353139243548364805
- nintendo1889 3y ago
  Which is why we transfer small amounts to the wasabi hot-wallet, coinjoin, and then spend. Each spend is then joined with another spend to obfuscate every purchase. It requires careful budgeting for future purchases (as the coin-join takes time). Trezor now has experimental support for directly coin-joining bitcoin that is stored on the cold-wallet, but I don't think anyone should trust it.
  - justinator 3y ago
    Not to be snarky, but this sounds real convenient. Why don’t we just admit these tools are just fundamentally broken?
    - SkyMarshal 3y ago
      They’re broken b/c they’re having difficulty doing something no other electronic payment even attempts to do?
TechBro8615 3y ago
Imagine using a browser extension other than uBlock Origin. Now imagine using one as a crypto wallet. That's the height of stupidity.
BonoboIO 3y ago
Is it stealing, when „code is law“?
- noveltyaccount 3y ago
  Depends on who you ask. This debate is why Ethereum (ETH) and Ethereum Classic (ETC) split. The hack against the DAO was either illegal or legal.
sjducb 3y ago
I always change a few words in the seed phase manually. To protect against this exact type of attack.
Eumenes 3y ago
imagine using a chrome browser extension to do anything involving money/finances
- evilspammer 3y ago
  not strictly any worse than e-banking or storing your bank details in 1password (with the exception of deposit insurance)
  - lxgr 3y ago
    Not really, because bank transfers are often revocable, and hopefully also use more than just one authentication factor.
corndoge 3y ago
Thank god, now the scam emails i've been getting about this exact scenario every day for months are finally true!
footlose_3815 3y ago
The Sales Pitch: "Crypto is going to take over everything, it's so secure." The implementation: "Whoops there's something we did wrong on the way."
- deleted 3y ago
  [deleted]
Spoom 3y ago
More than anything else, this is why I stay out of crypto: It shifts your trust from public institutions and the rule of law, to your own understanding of the security of the algorithms that implement the system (since there is often no public backup). And I don't trust myself to be able to identify such deep vulnerabilities.
kristianc 3y ago
I’m not sure why there is such fascination with this tech when it’s complex to understand and implement, prone to break in a thousand different ways, and has an ecosystem which is absolutely crammed with bad actors. This requires a deep understanding of cryptography to even understand if you’re safe. Why do people take the risk? Is it because they like to feel smart?
- Analemma_ 3y ago
  Crypto has a one-two punch that causes it to really stick tight in some minds: it's a get-rich-quick scheme (and those have a long history of bypassing the rational parts of the brain), together with ideological appeal: it feels like you're striking a blow against the Man (even though in practice all crypto goes through a small number of centralized actors that the Man can shut down any time he likes).
- latchkey 3y ago
  Do you have a deep understanding of how the stock market works?
  - kristianc 3y ago
    I understand that anything I buy is backed by ownership in an institution, that there are onerous regulatory and reporting requirements, centralized institutions managing it, ample liquidity if I want to get out at any point at that people get sent to prison if they try to manipulate it…
    - latchkey 3y ago
      Is that a no?
      - itsoktocry 3y ago
        You are asking the wrong question. "Do you have a sufficient understanding of stock markets?" For most people that's a "yes". They know what stocks are, what they represent, who the big players are to buy stocks on your behalf, and can be assured that the money is going to get to the right place. This is just not the case for crypto (yet), not remotely. Tons of tech people hardly know how these things work.
tony04larry 3y ago
[dead]

158 points by whenlambo 3y ago

asplake 3y ago

> That probably means this vulnerability exists in some other wallet implementations which is concerning…

sjsdaiuasgdia 3y ago
This song is almost as old as Bitcoin itself. 2013: https://bitcoin.org/en/alert/2013-08-11-android https://bitcoin.org/en/alert/2013-08-11-android All that trust I have to put in the non-crypto financial system doesn't seem too bad when you realize that the trust picture isn't all that different in the crypto world. Do you trust that the exchange won't steal your money? Do you trust that the software developers haven't intentionally or accidentally left any holes in the software you use to manage your money, or the smart contracts you interact with? Do you trust the vendor you're buying from to not steal your money? If you're thinking "escrow services", do you trust the escrow service to not steal your money? Do you trust in all that, and more, sufficiently to operate in a system where there is no way to undo erroneous or malicious transactions? Except for like when ETH rolled back the chain after the DAO incident...you know, going contrary to the immutable ledger concept this whole mess is built on...what you might even say is the most essential trust in crypto.
- DennisP 3y ago
  I'm just going to cherrypick one point here: the crypto version of escrow services can't steal your funds. The idea is to use 2-of-3 signatures, in some kind of smart contract (even a really basic one that Bitcoin can support). If buyer and seller sign the transaction, the escrow service never sees it. If buyer and seller disagree, then the escrow service decides whether buyer or seller gets the money. The escrow service never holds the money, the contract does that.

_trampeltier 3y ago

Why is in something so new (WASM), a such bad random generator?

deleted 3y ago
[deleted]
4gotunameagain 3y ago
Because if you read the article, you would have been informed that through WASM they did not have access to existing PRNG (e.g. /dev/urandom), and had to roll a mersenne twister. Which should not be used. It is about implementation, not about WASM
- nailer 3y ago
  That sounds incorrect, though WASM you have access to webcrypto getrandombytes which is native OS randomness.
  - lxgr 3y ago
    Yes, but that wasn't even the problem. Trust Wallet needlessly wrapped `std::random_device` (which might or might not be cryptographically secure by itself, depending on how it's implemented in whatever WASM-generating stack they use) in an instance of `std::mt19937` (which is definitely insecure, whether seeded cryptographically or not, due to being seeded with only 32 bits of entropy in their implementation; but even seeded properly, a Mersenne Twister would eventually leak internal state).
- _trampeltier 3y ago
  Yes, that's my point. WASM is new. So why does it not just have strong cryptographic functions from the very beginning? Strong random generators are super important today. Why don't they just demand strong crypto functions in every implementation? I mean, this calls just for endless troubles, if you don't can trust a random generator in WASM (depending on the implementation).

bsenftner 3y ago

Yeah, trust web 3.0...

fallingknife 3y ago

This is the fundamental issue with the supposed "trustlessness" of crypto. Unless you are interacting directly with the protocol layer (which is like 0.0001% of users), you actually have to trust a lot of people and software. And the whole system has been built on anonymity because it is "trustless," so it can never work in its present form. Sure, there is someone, or multiple people, at Wells Fargo who can move your money. But they will never be anonymous, and all of their actions are logged and tracked, and we have laws on the books requiring banks to be liable for such fraud and return the money to the customer. And failing that, if the whole bank goes down from the fraud, your money is FDIC insured, and the government will make you whole. Whereas in crypto, if someone gets your private key, you are instantly and irrevocably fucked. Crypto can never be anything more than a gambling tool unless it drops this "trustless" myth.

wslh 3y ago
First, the trustlessness in crypto, it is just a nice keyword. You trust the protocol and the protocol trust depends on specific nodes (e.g. miners). Would you trust more these actors that hundreds of well known companies using a BFT protocol? Or a mix of both groups? Second, key(s) custody is paramount beyond the blockchain technology used. And... this was very basic: "Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds."
Al-Khwarizmi 3y ago
Yeah, in fact for me the trust in a banking system (or anything else that keeps my money) is not in being in control, but in knowing that if things go wrong (regardless of whether it's someone else's fault or my own) I can complain and have a more or less realistic expectation to get my money back. For example, my main credit card was used fraudulently a couple of times, through no fault of my own (AFAIK), but the bank rolled back the charges, cancelled the card and issued a new one. This makes me trust using the card. In the last few years, at least in my country, many banks seem to be transitioning from "patchy security, but take responsibility" to "better security, but blame the client". I.e., they add lots of mandatory over-the-top 2FA, etc. but if a client complains of a transfer they didn't make, surely it's the client's fault, because security is really good. This makes me trust such banks much less. Firstly, because even being a tech-savvy user that doesn't typically fall for scams, etc., nobody is perfect and I don't think anyone is 100% free of making a security blunder in a moment of being sleep deprived, ill, drunk, etc. And secondly, because what if they get hacked somehow and they make me responsible? No, I very much prefer worse security but listening to clients. Similarly, in crypto, "your keys, your coins" doesn't give me trust. What if I lose my keys somehow? In the bank, they know who I am, as long as I have a means of ID I can get my money. And as you mention, even if the bank fails, the government has my back. For all these reasons, while I do hold some crypto, I'd never keep a significant portion of my assets in that form.

louison11 3y ago

Why anyone would hold any significant amount in a chrome extension is beyond my understanding. Even if you’re using Metamask, use it in hybrid mode with a Ledger.

sjsdaiuasgdia 3y ago
There is absolutely nothing preventing a developer using a crap RNG in some other wallet...and indeed it's happened several times over the years on various platforms. It does sound like wasm makes the misstep somewhat easier in that it doesn't try to provide an RNG sufficient for cryptographic usage, but that also applies to quite a few other development platforms.
rchaud 3y ago
Because it is used by people, not cybersecurity experts. From the vendor's website[0]: > Our position is simple: Your wallet. Your keys. Your crypto. Built-in private key encryption and a password-protected login means you’re always in complete control. An average person that reads this wouldn't think about needing to add more protections. [0]: https://trustwallet.com/browser-extension/ https://trustwallet.com/browser-extension/
- deleted 3y ago
  [deleted]
- ravenstine 3y ago
  Still, it's disappointing how (understandably) inept the average person is at reasoning where they should and shouldn't be placing trust in tech. It's also disappointing to be involved worth the tech industry, broadly speaking, and frequently witness shit shows of security incompetence and outright charlatanism. We can all do better, right? How we do that is definitely a question.
  - yamazakiwi 3y ago
    The base level of knowledge for computing is poor because computing is new in history. How do I know what you personally trust is trustworthy? Some people use Protonmail trying to avoid lawful prosecution, thinking they're protected, and they will tell you they know what they're doing. A lot of the time there is too much noise for the common human to make an informed decision.

pontifier 3y ago

At some point there won't be any more suckers left. That's when crypto will really collapse.

tyingq 3y ago
I don't know...multi-level marketing still seems alive and kicking.
- sjsdaiuasgdia 3y ago
  https://xkcd.com/1053/ https://xkcd.com/1053/ but instead it's the unlucky 10k per day learning about a scam the hard way
- orangepurple 3y ago
  Even MMM Global seems to be operating still http://www.mmmglobal.in/ http://www.mmmglobal.in/
- api 3y ago
  ... as are casinos. I don't think it will collapse. It has found product-market fit: mostly gambling, some money laundering and crime, and some legitimate use for international wires and payments under oppressive political conditions (this last part is the smallest amount by volume). There will occasionally be attempts to pump some new use case (e.g. NFTs), but these are just casino advertising. They'll draw in some new suckers/players and the cycle will repeat. The maximalist cult will continue to exist as well, patiently awaiting the coming of the space brothers in the form of a massive economic collapse causing Bitcoin to "moon" and become the new global reserve currency. This is identical to the goldbug cult of previous generations and involves many of the same types of people. Apocalyptic cults can exist for a long, long time and failed prophecies do not deter true believers.
  - deleted 3y ago
    [deleted]
InCityDreams 3y ago

deleted 3y ago

[deleted]

mike_hearn 3y ago

I was writing about this exact problem of bad RNGs in web cryptocurrency wallets a ~decade ago. It is profoundly depressing that so little has changed: https://medium.com/mike-hearn/type-safety-and-rngs-40e3ec71ab3a https://medium.com/mike-hearn/type-safety-and-rngs-40e3ec71a... Browsers have a number of problems that make it difficult to build wallets, but I’m not going to try and convince you to stop making them here. Suffice it to say there are alternatives for writing cross platform wallets you could consider. Browsers just aren't intended for doing things that require the generation and safe storage of private keys. The developers don't care about these use cases. Like with so many others, if you want to do it properly you have to go outside the browser. Back when I was involved with the cryptocurrency world (pre-2016) I kept hitting this general reluctance to just write normal desktop apps, and whenever I advised people to do it for security or stability reasons they'd insist on writing something browser/JS based instead. I did write desktop based wallets, but was considered old fashioned for doing so (at the ripe age of 35). Way too frequently people would end up losing all their money to dumb and entirely predictable hacks as a consequence of using a web-based wallet, or even just lose because of sites going offline. Browsers improved a bit since but as this episode shows, they still aren't intended for it. Part of why people wanted to write js was that it is easy to distribute the results. They optimized for developer convenience over security. Chrome offers a portability layer and keeps extensions up to date for you. Years passed and I saw the same problem crop up in other contexts too: the right approach was to write a desktop app, people tried to hack Chrome into compliance instead so they could let it handle distribution, it didn't work, and that sometimes led to disaster for their users. These days I have a company that tries to solve this problem. We make Conveyor [1], which has the goal of making desktop app distribution as easy as for a web app. And it mostly succeeds: it can cross-build/package apps for every platform, and on Win/macOS it can provide update-on-start so you can iterate as quickly as with a web app. You pick your preferred portability layer (flutter, jvm, electron, something rusty etc) and can choose between more battle tested frameworks or more experimental frameworks depending on your appetite for risk. Whatever you pick, the distribution experience is the same. You don't have to compromise on UX either. Frameworks like Compose for Desktop, Flutter, heck even JavaFX give you nice solid 60fps animations and can be made to look good easily. You can store private keys in the user's secure keystores. If your site goes down it's not an emergency, your app still works, only updates stop until you're back online. Even if your certificates expire your app will still work! I hope that people will take this stuff more seriously in future. It's got a lot easier to distribute apps without relying on browsers or stores over time. Browser developers do a good job but are ultimately constrained by the web's origins. It's not just cryptocurrency wallets that can benefit from escaping the browser either! Quite a lot of security bugs can be eliminated when you leave the browser. For example you can write apps that are immune by design to XSS, XSRF, SQL injection, phishing and other common bug classes. At some point I should probably write these thoughts down in a more modern blog post. [1] https://hydraulic.software/ https://hydraulic.software/

nailer 3y ago

Hah this happened to Debian a few years ago. Someone fixed a compiler warning and limited the entropy range for secret keys.

cma 3y ago
AMD also had a pretty bad bug: https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd...

krono 3y ago

> Creating good randomness is a daunting task - Ledger devices rely on dedicated silicon logic in our certified smartcard chips that have been the gold standard of secure industries for the past 40 years to guarantee high quality randomness and tamper resistance. Which is worthless and entirely irrelevant when they keep leaking their customers' personal and purchase data (which they claimed not to collect or keep, and even failed to delete after the first leak) time and again. https://web.archive.org/web/20221030030843/https://cointelegraph.com/news/ledger-data-leak-a-simple-mistake-exposed-270k-crypto-wallet-buyers https://web.archive.org/web/20221030030843/https://cointeleg... https://web.archive.org/web/20220901153130/https://www.coindesk.com/business/2020/12/23/from-sim-swaps-to-home-invasion-threats-ledger-leak-has-cascading-consequences/ https://web.archive.org/web/20220901153130/https://www.coind... https://old.reddit.com/r/ledgerwalletleak/comments/ki1nsz/received_phone_call_threatening_kidnapping_and/ https://old.reddit.com/r/ledgerwalletleak/comments/ki1nsz/re... https://old.reddit.com/r/CryptoCurrency/comments/rts1w2/got_compromised_and_lost_over_120k_in_crypto_ama/ https://old.reddit.com/r/CryptoCurrency/comments/rts1w2/got_... https://twitter.com/yeolddoc/status/1353139243548364805 https://twitter.com/yeolddoc/status/1353139243548364805

nintendo1889 3y ago
Which is why we transfer small amounts to the wasabi hot-wallet, coinjoin, and then spend. Each spend is then joined with another spend to obfuscate every purchase. It requires careful budgeting for future purchases (as the coin-join takes time). Trezor now has experimental support for directly coin-joining bitcoin that is stored on the cold-wallet, but I don't think anyone should trust it.
- justinator 3y ago
  Not to be snarky, but this sounds real convenient. Why don’t we just admit these tools are just fundamentally broken?
  - SkyMarshal 3y ago
    They’re broken b/c they’re having difficulty doing something no other electronic payment even attempts to do?

TechBro8615 3y ago

Imagine using a browser extension other than uBlock Origin. Now imagine using one as a crypto wallet. That's the height of stupidity.

BonoboIO 3y ago

Is it stealing, when „code is law“?

noveltyaccount 3y ago
Depends on who you ask. This debate is why Ethereum (ETH) and Ethereum Classic (ETC) split. The hack against the DAO was either illegal or legal.

sjducb 3y ago

I always change a few words in the seed phase manually. To protect against this exact type of attack.

Eumenes 3y ago

imagine using a chrome browser extension to do anything involving money/finances

evilspammer 3y ago
not strictly any worse than e-banking or storing your bank details in 1password (with the exception of deposit insurance)
- lxgr 3y ago
  Not really, because bank transfers are often revocable, and hopefully also use more than just one authentication factor.

corndoge 3y ago

Thank god, now the scam emails i've been getting about this exact scenario every day for months are finally true!

footlose_3815 3y ago

The Sales Pitch: "Crypto is going to take over everything, it's so secure." The implementation: "Whoops there's something we did wrong on the way."

deleted 3y ago
[deleted]

Spoom 3y ago

More than anything else, this is why I stay out of crypto: It shifts your trust from public institutions and the rule of law, to your own understanding of the security of the algorithms that implement the system (since there is often no public backup). And I don't trust myself to be able to identify such deep vulnerabilities.

kristianc 3y ago

I’m not sure why there is such fascination with this tech when it’s complex to understand and implement, prone to break in a thousand different ways, and has an ecosystem which is absolutely crammed with bad actors. This requires a deep understanding of cryptography to even understand if you’re safe. Why do people take the risk? Is it because they like to feel smart?

Analemma_ 3y ago
Crypto has a one-two punch that causes it to really stick tight in some minds: it's a get-rich-quick scheme (and those have a long history of bypassing the rational parts of the brain), together with ideological appeal: it feels like you're striking a blow against the Man (even though in practice all crypto goes through a small number of centralized actors that the Man can shut down any time he likes).
latchkey 3y ago
Do you have a deep understanding of how the stock market works?
- kristianc 3y ago
  I understand that anything I buy is backed by ownership in an institution, that there are onerous regulatory and reporting requirements, centralized institutions managing it, ample liquidity if I want to get out at any point at that people get sent to prison if they try to manipulate it…
  - latchkey 3y ago
    Is that a no?
    - itsoktocry 3y ago
      You are asking the wrong question. "Do you have a sufficient understanding of stock markets?" For most people that's a "yes". They know what stocks are, what they represent, who the big players are to buy stocks on your behalf, and can be assured that the money is going to get to the right place. This is just not the case for crypto (yet), not remotely. Tons of tech people hardly know how these things work.

tony04larry 3y ago

[dead]