6 ms·

We have detected a security breach. Services are temporarily suspended

70 points by primaryobjects 13y ago

jstanley 13y ago
If this is an April Fool's joke, it is likely to backfire significantly!
- minimaxir 13y ago
  There needs to be a protocol for "this is definitely 100% not an April Fool's joke."
  - larrybolt 13y ago
    Any financial sites should not participate in April Fool's jokes if you ask me, or just as google add a notice it's for just a joke. https://www.google.com/intl/en/landing/nose/help.html https://www.google.com/intl/en/landing/nose/help.html
    - loceng 13y ago
      You mean they're not shutting down YouTube after the contest is over?
larrybolt 13y ago
Though I like seeing sites pulling an April Fool's joke, I do think any money-related sites (so bitcoin sites as well) have to say no to pulling pranks on their users.
doktrin 13y ago
The server appears to no longer be responding. That would appear to indicate a non-April fools joke (coupled with the fact that they shouldn't really be pulling pranks in the first place). edit : back online
ryusage 13y ago
...I can't imagine a financial company would ever actually take down their main site and claim to have been compromised just as a joke. For one thing, it's not even funny, so where's the joke? And second, it's obviously really bad for business. I think it's safe to assume this is real.
phasevar 13y ago
If it is an April fools joke, it's a terrible one. They should have been more creative. As it is, they're just destroying the trust in their brand. Nothing funny about it.
unimpressive 13y ago
I'm pretty certain it's not a joke. If it is, it's obvious that the instawallet guys have no business handling your money.
- rdl 13y ago
  Whereas, if they were just hacked, that's a great sign for handling your money?
  - unimpressive 13y ago
    Either way it's a bad sign. At least with disaster response they show they're taking things seriously.
ashergm 13y ago
Interesting that instawallet goes down on the day the BTC:USD hits 106 on Mt. Gox
- digitalsushi 13y ago
  I am not a financial guy - just a web programmer - why is this interesting, please?
  - wmf 13y ago
    If Bitcoins are worth more, criminals are probably willing to work harder to steal them.
  - aneth4 13y ago
    It's interesting in the way the weather is interesting.
jimrandomh 13y ago
"Online wallet services" are an invitation to theft and fraud. Do not use them. I've been saying that since July 2011 (https://bitcointalk.org/index.php?topic=26260.0 https://bitcointalk.org/index.php?topic=26260.0), before MyBitcoin ran off with everyone's money, and it's just as true today as it was then. If you lost money today I feel for you, but seriously, it's your own damn fault. A Bitcoin is only yours if it was last sent to an address that is yours, and an address is only yours if no one else knows what it is - in other words, you have to have generated it anew on a secure, malware-free computer, and avoided ever putting the wallet file on any computer that has malware or that is not yours. Seriously, stop it, you fools.
- M4v3R 13y ago
  While this is true, it's extremely hard to keep your computer free of any kind of malware. There are many trojans that go undetected for enough time to do serious damage. I personally know a guy that, even with having anti virus installed, had 2500 BTC stolen from his personal computer. So really, so far the most secure way to store Bitcoin is either to encrypt private key and only then store it somewhere, or print it out, store it in a safe and remove all traces from the computer. Better yet - use a locally hosted javascript app to generate the pair and never write it to disk, from where it could be recovered even after deletion. I'm now working on developing a Bitcoin platform that will enable you to do exactly this - your private keys will be generated on your computer, encrypted with PBKDF2-derived passphrase from your password and only then stored on our servers. This way no one except you can ever touch the coins.
  - gnarbarian 13y ago
    if I had a stash of bitcoins I'd probably use some hardened Linux variant or OpenBSD to store them and perform transactions.
- aquayellow 13y ago
  Yes, I learned it the hard way when I had around 200 BTC stolen from the online service I was using. I kept blaming the service but the fact is it's stupid to think of bitcoins = hard currencies and online wallet services = bank.
dobbsbob 13y ago
Instawallet has always only been meant to keep spare change for quick transactions. For the longest time you could type into google site:instawallet.org/w and get a list of URLs with money in them, it's not secure. Neither is Strongcoin who had all their wallet labels leaked recently, some of which users had decided to type in the hints for their key passwords. If I remember correctly Instawallet is a ruby/rails app run by the same people who do Bitcoin-Central.net. If you look at their other app Instawire you see lot's of ruby gems used, in a financial application, not good. EDIT.. bitcoin-central.net is also down
- benmmurphy 13y ago
  it looks like they fixed the /w issue with google but it stil shows up in other search engines.
thechut 13y ago
There is this from a few days ago: https://bitcointalk.org/index.php?topic=159673.0 https://bitcointalk.org/index.php?topic=159673.0 The founder said it was fixed but who knows
aneth4 13y ago
I'm a big believer in the future of bitcoin and hold a significant amount. However I find holding bitcoin terrifying. There is just so much that can go wrong - from data loss, to personal tragedy, to hackers, to algorithmic weaknesses. Ultimately we probably need insured, trusted third parties to hold keys, such that even if there is a breach, someone financially viable is on the line to reimburse. Individuals holding their own keys may be a nice dream, but its highly impractical for most people if they have a significant portion of their wealth in bitcoin. Certainly there will be very high net worth people and security maniacs who want to hold their own keys, but I believe most people will want a third party to guarantee them.
- markkat 13y ago
  This is true. Until BTC can be insured, and thus, easy for most people to feel secure having, bitcoin is going to have a serious drag on widespread adoption.
- dobbsbob 13y ago
  If you hold a lot of coins you simply print out the keys and keep them in a safety deposit box in a bank. Problem solved Or use the Armory offline wallet to store them on an encrypted non-networked storage, print the keys, do the above.
  - smackfu 13y ago
    Don't you also need to destroy all other records of those keys?
    - dobbsbob 13y ago
      Only if you don't trust the encryption on your cold wallet backup where you generated the keys. Personally I'd keep both, encrypted drive and printed keys then if say the bank is robbed or burns to the ground you can still transfer the coins. You'd want to also make sure the printer isn't storing memory of those keys that were printed. Some weird startup out of Europe is splitting up $2mil worth of coins on 3 USB encrypted sticks, using Shamir's secret sharing as the master key to decrypt (this according to Bitcoin magazine). Sounds like a bad idea I don't trust wear leveling drives that could fail taking all your coins with them
gesman 13y ago
Bitcoin rules: 1. Keep your own self-generated, backupable and recoverable wallet without dependency on any third party babysitting services that are being consistently broken into (and your money is lost). Electrum wallet is recommended as it also allows you to export "master public key" using which you may launch your own online store business and accept bitcoins as a payment without risk of losing money if someone hacks your online store. 2. Use third party service only for buying and selling bitcoins. As soon as transaction is complete - transfer bitcoins back to your own wallet. 3. Have a will so your loved one could get a hold of coins. Just in case.
- dobbsbob 13y ago
  Yes Electrum is good but remember you're relying on somebody else's blockchain instead of your own. Though I generally trust the Electrum blockchain servers you never know. Your online store key, you should be using some sort of script to generate receive payment addresses offline and stick those in a db. The payments should go to a cold wallet you can either with a serial cable send a txn or manually enter the signed transactions, but that's just my paranoid security
  - gesman 13y ago
    The beauty of electrum master public key is that it can be used to generate unlimited number of "receive only" bitcoin addresses. Server script could do it for each sale. If someone hacks into server - he can't steal anything, because Electrum's master private key (to send money) never stored in server.
teraflop 13y ago
Someone on bitcointalk.org [1] noticed that approximately 42,000 BTC (currently worth about US$4.3 million) was just transferred out of one of Instawallet's accounts [2]. No idea whether the transaction was Instawallet's doing, or the attacker's. [1] https://bitcointalk.org/index.php?topic=164143.msg1716794#msg1716794 https://bitcointalk.org/index.php?topic=164143.msg1716794#ms... [2] http://blockchain.info/address/1LrPYjto3hsLzWJNstghuwdrQXB96KbrCy http://blockchain.info/address/1LrPYjto3hsLzWJNstghuwdrQXB96...
- dobbsbob 13y ago
  UH OH Says it was sent FROM cold storage that's not a good sign.
  - deleted 13y ago
    [deleted]
  - beala 13y ago
    If it's actual cold storage, then it's probably just them taking precautions. The whole point of cold storage is to make the wallet immune to a server breach. But who knows? It sounds like their security was sloppy.
    - dobbsbob 13y ago
      Edit.. [Apr-1 10:30 CET] Bitcoin-Central and Paytunia update: Our customer's bitcoins and euros are safe and will not be affected by the security breach. We have taken the websites off-line for proper investigation. The address 1LrPYjto3hsLzWJNstghuwdrQXB96KbrCy is under our exclusive control. from https://bitcoin-central.net/ https://bitcoin-central.net/ All is fine then I guess
- M4v3R 13y ago
  It's worth noting that the transfer took place two hours before the site was taken down. That's a really bad sign.
- beala 13y ago
deleted 13y ago
[deleted]

If this is an April Fool's joke, it is likely to backfire significantly!

minimaxir 13y ago
There needs to be a protocol for "this is definitely 100% not an April Fool's joke."
- larrybolt 13y ago
  Any financial sites should not participate in April Fool's jokes if you ask me, or just as google add a notice it's for just a joke. https://www.google.com/intl/en/landing/nose/help.html https://www.google.com/intl/en/landing/nose/help.html
  - loceng 13y ago
    You mean they're not shutting down YouTube after the contest is over?

Though I like seeing sites pulling an April Fool's joke, I do think any money-related sites (so bitcoin sites as well) have to say no to pulling pranks on their users.

doktrin 13y ago

The server appears to no longer be responding. That would appear to indicate a non-April fools joke (coupled with the fact that they shouldn't really be pulling pranks in the first place). edit : back online

ryusage 13y ago

...I can't imagine a financial company would ever actually take down their main site and claim to have been compromised just as a joke. For one thing, it's not even funny, so where's the joke? And second, it's obviously really bad for business. I think it's safe to assume this is real.

phasevar 13y ago

If it is an April fools joke, it's a terrible one. They should have been more creative. As it is, they're just destroying the trust in their brand. Nothing funny about it.

unimpressive 13y ago

I'm pretty certain it's not a joke. If it is, it's obvious that the instawallet guys have no business handling your money.

rdl 13y ago
Whereas, if they were just hacked, that's a great sign for handling your money?
- unimpressive 13y ago
  Either way it's a bad sign. At least with disaster response they show they're taking things seriously.

ashergm 13y ago

Interesting that instawallet goes down on the day the BTC:USD hits 106 on Mt. Gox

digitalsushi 13y ago
I am not a financial guy - just a web programmer - why is this interesting, please?
- wmf 13y ago
  If Bitcoins are worth more, criminals are probably willing to work harder to steal them.
- aneth4 13y ago
  It's interesting in the way the weather is interesting.

jimrandomh 13y ago

"Online wallet services" are an invitation to theft and fraud. Do not use them. I've been saying that since July 2011 (https://bitcointalk.org/index.php?topic=26260.0 https://bitcointalk.org/index.php?topic=26260.0), before MyBitcoin ran off with everyone's money, and it's just as true today as it was then. If you lost money today I feel for you, but seriously, it's your own damn fault. A Bitcoin is only yours if it was last sent to an address that is yours, and an address is only yours if no one else knows what it is - in other words, you have to have generated it anew on a secure, malware-free computer, and avoided ever putting the wallet file on any computer that has malware or that is not yours. Seriously, stop it, you fools.

M4v3R 13y ago
While this is true, it's extremely hard to keep your computer free of any kind of malware. There are many trojans that go undetected for enough time to do serious damage. I personally know a guy that, even with having anti virus installed, had 2500 BTC stolen from his personal computer. So really, so far the most secure way to store Bitcoin is either to encrypt private key and only then store it somewhere, or print it out, store it in a safe and remove all traces from the computer. Better yet - use a locally hosted javascript app to generate the pair and never write it to disk, from where it could be recovered even after deletion. I'm now working on developing a Bitcoin platform that will enable you to do exactly this - your private keys will be generated on your computer, encrypted with PBKDF2-derived passphrase from your password and only then stored on our servers. This way no one except you can ever touch the coins.
- gnarbarian 13y ago
  if I had a stash of bitcoins I'd probably use some hardened Linux variant or OpenBSD to store them and perform transactions.
aquayellow 13y ago
Yes, I learned it the hard way when I had around 200 BTC stolen from the online service I was using. I kept blaming the service but the fact is it's stupid to think of bitcoins = hard currencies and online wallet services = bank.

dobbsbob 13y ago

Instawallet has always only been meant to keep spare change for quick transactions. For the longest time you could type into google site:instawallet.org/w and get a list of URLs with money in them, it's not secure. Neither is Strongcoin who had all their wallet labels leaked recently, some of which users had decided to type in the hints for their key passwords. If I remember correctly Instawallet is a ruby/rails app run by the same people who do Bitcoin-Central.net. If you look at their other app Instawire you see lot's of ruby gems used, in a financial application, not good. EDIT.. bitcoin-central.net is also down

benmmurphy 13y ago
it looks like they fixed the /w issue with google but it stil shows up in other search engines.

thechut 13y ago

There is this from a few days ago: https://bitcointalk.org/index.php?topic=159673.0 https://bitcointalk.org/index.php?topic=159673.0 The founder said it was fixed but who knows

aneth4 13y ago

I'm a big believer in the future of bitcoin and hold a significant amount. However I find holding bitcoin terrifying. There is just so much that can go wrong - from data loss, to personal tragedy, to hackers, to algorithmic weaknesses. Ultimately we probably need insured, trusted third parties to hold keys, such that even if there is a breach, someone financially viable is on the line to reimburse. Individuals holding their own keys may be a nice dream, but its highly impractical for most people if they have a significant portion of their wealth in bitcoin. Certainly there will be very high net worth people and security maniacs who want to hold their own keys, but I believe most people will want a third party to guarantee them.

markkat 13y ago
This is true. Until BTC can be insured, and thus, easy for most people to feel secure having, bitcoin is going to have a serious drag on widespread adoption.
dobbsbob 13y ago
If you hold a lot of coins you simply print out the keys and keep them in a safety deposit box in a bank. Problem solved Or use the Armory offline wallet to store them on an encrypted non-networked storage, print the keys, do the above.
- smackfu 13y ago
  Don't you also need to destroy all other records of those keys?
  - dobbsbob 13y ago
    Only if you don't trust the encryption on your cold wallet backup where you generated the keys. Personally I'd keep both, encrypted drive and printed keys then if say the bank is robbed or burns to the ground you can still transfer the coins. You'd want to also make sure the printer isn't storing memory of those keys that were printed. Some weird startup out of Europe is splitting up $2mil worth of coins on 3 USB encrypted sticks, using Shamir's secret sharing as the master key to decrypt (this according to Bitcoin magazine). Sounds like a bad idea I don't trust wear leveling drives that could fail taking all your coins with them

gesman 13y ago

Bitcoin rules: 1. Keep your own self-generated, backupable and recoverable wallet without dependency on any third party babysitting services that are being consistently broken into (and your money is lost). Electrum wallet is recommended as it also allows you to export "master public key" using which you may launch your own online store business and accept bitcoins as a payment without risk of losing money if someone hacks your online store. 2. Use third party service only for buying and selling bitcoins. As soon as transaction is complete - transfer bitcoins back to your own wallet. 3. Have a will so your loved one could get a hold of coins. Just in case.

dobbsbob 13y ago
Yes Electrum is good but remember you're relying on somebody else's blockchain instead of your own. Though I generally trust the Electrum blockchain servers you never know. Your online store key, you should be using some sort of script to generate receive payment addresses offline and stick those in a db. The payments should go to a cold wallet you can either with a serial cable send a txn or manually enter the signed transactions, but that's just my paranoid security
- gesman 13y ago
  The beauty of electrum master public key is that it can be used to generate unlimited number of "receive only" bitcoin addresses. Server script could do it for each sale. If someone hacks into server - he can't steal anything, because Electrum's master private key (to send money) never stored in server.

teraflop 13y ago

Someone on bitcointalk.org [1] noticed that approximately 42,000 BTC (currently worth about US$4.3 million) was just transferred out of one of Instawallet's accounts [2]. No idea whether the transaction was Instawallet's doing, or the attacker's. [1] https://bitcointalk.org/index.php?topic=164143.msg1716794#msg1716794 https://bitcointalk.org/index.php?topic=164143.msg1716794#ms... [2] http://blockchain.info/address/1LrPYjto3hsLzWJNstghuwdrQXB96KbrCy http://blockchain.info/address/1LrPYjto3hsLzWJNstghuwdrQXB96...

dobbsbob 13y ago
UH OH Says it was sent FROM cold storage that's not a good sign.
- deleted 13y ago
  [deleted]
- beala 13y ago
  If it's actual cold storage, then it's probably just them taking precautions. The whole point of cold storage is to make the wallet immune to a server breach. But who knows? It sounds like their security was sloppy.
  - dobbsbob 13y ago
    Edit.. [Apr-1 10:30 CET] Bitcoin-Central and Paytunia update: Our customer's bitcoins and euros are safe and will not be affected by the security breach. We have taken the websites off-line for proper investigation. The address 1LrPYjto3hsLzWJNstghuwdrQXB96KbrCy is under our exclusive control. from https://bitcoin-central.net/ https://bitcoin-central.net/ All is fine then I guess
M4v3R 13y ago
It's worth noting that the transfer took place two hours before the site was taken down. That's a really bad sign.
beala 13y ago

deleted 13y ago

[deleted]