6 ms·
> 0.5 BTC That's one expensive alert.
by sprawl_ 3y ago
> 0.5 BTC
That's one expensive alert.
- AustinDev 3y agoThe passwords in my manager could potentially cause more financial harm than 0.5 BTC going missing. Everyone has their own price for security. I've also not moved those BTC since 2014 so the price has appreciated considerably.
- Johnny555 3y agoIt sounds like you should be using 2FA with a hardware security token rather than setting up a honey pot that may or may not be triggered.
- jtriangle 3y agoThe point is that there are far cheaper canaries to keep in your coalmine.
- blantonl 3y agoMore succinctly, this is plain dumb. And especially to tell people about it in public.
- gerdesj 3y agoNo it really isn't dumb at all. Its the basis of a "honeypot". Museums and galleries etc put their wares on show in public - can you be sure that what is shown is what you think it is or secured as you think it is? Please don't describe anyone as dumb - its as much demeaning to you as it is anyone else.
- ziddoap 3y agoHigh value passwords doesn't mean you need a 0.5 BTC alerting method, though? You just went from "significant financial harm" to "significant financial harm, and 0.5 BTC".
- AustinDev 3y agoThe idea is anyone who compromised my password manager would likely go for the wallet first since it's as good as cold hard cash. Using the private keys and other secrets stored in my manager would take much more time for an attacker to exact meaningful value. I would expect the BTC to be moved first and foremost which would hopefully give me enough time to mitigate any other damage that could be caused by the content of my password manager being exposed.
- ziddoap 3y agoI think they would be more likely to copy all of the data first, in an effort to avoid detection methods like this, then make their move compromising everything in near parallel. At least that is how I would do it.
- ethbr1 3y agoWould the average attacker, though? It's a question about not touching an easy $15k, in exchange for a chance at a bigger score. I'd assume most attackers wouldn't be able to resist securing the low hanging fruit first. And even if there's a parallel move, it's even less likely they would leverage everything but the $15k, so OP would still receive a realtime indicator of compromise. From a game theory perspective, it's a pretty compelling trap for OP to get what they want.
- drusepth 3y agoSpeaking of game theory, there is probably a much lower number that achieves the same goal, though. Your average attacker might be equally motivated to go for $20k, or $10k, or $5k. $1k, maybe not. $100, probably not. $1, almost certainly not. There's an interesting game to play in minimizing the cost at no hit to efficiency.
- AustinDev 3y agoI don't play the minimization game. In 2014 when I started this strategy 0.5 BTC was like 100 bucks. Now that it's 15,000 bucks doesn't make a damn bit of difference. If they spent the time to figure out what the rest of the credentials were worth and exploited them to the maximum extent, they'd be walk away a multi-millionaire. However.... 15k in a plaintext wallet is an easy score and I argue that the vast majority of people who could compromise my password manager would take that in a heartbeat.
- pwillia7 3y agoI don't think it needs to be 15k in value to entice someone to steal it. You could also get compromised by someone who doesn't know anything about btc or misses that note and you would not know.
- andrewedstrom 3y agoYou could get the exact same alerting benefit with 1/10 the Bitcoin, or less. There is no tax penalty for moving bitcoin. You should definitely move most of this elsewhere.