Pages:
Author

Topic: Bitcoinica MtGox account compromised - page 28. (Read 156012 times)

legendary
Activity: 2198
Merit: 1311
July 13, 2012, 01:59:12 PM
As a Bitconica customer:

  • I had no positions, no leverage, and was using it as an interest bearing savings account.

And now *THIS* happens?

When will you people learn that there is ONLY ONE VIABLE TYPE OF BTC SAVING ACCOUNT --> heavily encrypted and backed up bitcoin wallet/brainwallet/paperwallet in a secure place ?




That's exactly what I took away from this when it started several months ago, and I haven't looked back.  I control the vast majority of my bitcoins now, nobody else - paper wallets and brain wallets.  People need to internalize this.
donator
Activity: 452
Merit: 252
July 13, 2012, 01:56:50 PM
As a Bitconica customer:

  • I had no positions, no leverage, and was using it as an interest bearing savings account.

And now *THIS* happens?

When will you people learn that there is ONLY ONE VIABLE TYPE OF BTC SAVING ACCOUNT --> heavily encrypted and backed up bitcoin wallet/brainwallet/paperwallet in a secure place ?




thats where I store my coins, besides in starfish BCB and hashking.
hero member
Activity: 812
Merit: 1001
-
July 13, 2012, 01:56:05 PM
something tells me that you guys should add videos to accompany these kinds of announcements. people need to be able to see into your eyes and see your sorrow and regret, to know that you're telling the truth.

we'd not have so much of this finger-pointing if that were the case, i'll bet.

Yep, one hour long Bruce Wagner "I'm sorry I pushed ya to put all your money in mybitcoin" style video would do wonders.  Wink
hero member
Activity: 812
Merit: 1001
-
July 13, 2012, 01:54:33 PM
As a Bitconica customer:

  • I had no positions, no leverage, and was using it as an interest bearing savings account.

And now *THIS* happens?

When will you people learn that there is ONLY ONE VIABLE TYPE OF BTC SAVING ACCOUNT --> heavily encrypted and backed up bitcoin wallet/brainwallet/paperwallet in a secure place ?


sr. member
Activity: 420
Merit: 250
July 13, 2012, 01:53:44 PM
something tells me that you guys should add videos to accompany these kinds of announcements. people need to be able to see into your eyes and see your sorrow and regret, to know that you're telling the truth.

we'd not have so much of this finger-pointing if that were the case, i'll bet.
hero member
Activity: 661
Merit: 500
July 13, 2012, 01:52:25 PM
And Zhou sold that trust to the highest bidder. At least his mortgage is paid off!

He did the right thing, walk away from a business that become to big to manage.


I agree.  Good for him.  Unfortunately, we are in a shit position, but I am not entirely sure if this could have been avoided anyhow.  Perhaps not to this extent.  I feel confident still that things will be resolved in the end by Zhou T.  He seems like one of the few very stand-up people around here. 
hero member
Activity: 743
Merit: 500
July 13, 2012, 01:48:41 PM
what's going on behind the scenes Tihan,  Zhou,  Patrick, Donald, Amir, or anyone else with access to Bitcoinica money HuhHuh??
pls write the truth
sr. member
Activity: 420
Merit: 250
July 13, 2012, 01:46:23 PM
Why was the bitcoin stored on MtGox anyway? Why not secure in their own wallet.
This reliance on third parties where the Bitcoinica credentials can be spoofed seems to be at the root of all the hacks.

I'm sorry for all involved. I have to say that bitcoin really is the most amazing geek soap opera. If the bitcoin value was backed by drama it would be stratospheric.

i was wondering this too. some technical reason?
k
sr. member
Activity: 451
Merit: 250
July 13, 2012, 01:44:24 PM
Why was the bitcoin stored on MtGox anyway? Why not secure in their own wallet.
This reliance on third parties where the Bitcoinica credentials can be spoofed seems to be at the root of all the hacks.

I'm sorry for all involved. I have to say that bitcoin really is the most amazing geek soap opera. If the bitcoin value was backed by drama it would be stratospheric.
hero member
Activity: 761
Merit: 500
Mine Silent, Mine Deep
July 13, 2012, 01:43:23 PM
Maybe we should ask why all those people had that much funds there...?

Bitcoinica was the first fully licenced financial service provider that provided decent interest of 6% on both BTC and USD currency accounts. The interest on my USD account alone provided me with ~0.5 BTC per day, so I simply used it as a BTC savings account, while leaving speculation to the other customers.

This is the post (from Donald) that won me over: http://bitcoinmedia.com/first-licensed-advanced-trading-platform-for-bitcoin/

Quote
While Bitcoinica had some previous security concerns, namely where the attack on the Linode cloud hosting provider generated them a loss of 40k BTC, Bitcoinica has fully recovered from the loss and no longer depends so heavily on 3rd party platforms. The Bitcoinica reigns have been taken up by the recognized development group called the Bitcoin Consultancy which have a record of solid security in the tumultuous world of Bitcoin.

On a personal level:

I did not commit any sizeable deposits until Bitcoinica got their new ToS, status as registered FSP in NZ and contracted the Bitcoin Consultancy, who at the time were regarded as some of the best and reputable in the business.

I found Zhou to be responsive, honest and helpful in his communication with customers and the bitcoin community. The fact that he was able to deal with the first hack to the complete satisfaction of the entire customerbase only bolstered my confidence that this was not a scam operation and assumed he learned a costly lesson in security that would not be repeated.

I was impressed by Bitcoinica as a service, it worked very well for my needs. I secured my account with a strong unique password + Google 2-factor authentication and Bitcoinica stated they did not keep deposits on site but at MtGox. Little did I know that while providing strong user facing security features they did not have adequate security measures internally (No offsite backups, cheap VPN, no OTP on their MtGox, root password reset broadcast to a mailinglist, etc.)

I realized this was one of my riskier investments since the legal status of Bitcoin is uncertain and Bitcoinica was still a largely unproven business. I did my due diligence to the best of my ability. I did my risk assessment. I decided the risk/reward was worth it.

I was wrong. Mea Culpa. http://youtu.be/NmFo-LKHGY0

So far this has been an painful and protracted lesson in counterparty risk. Now I see no option left apart from considering joining possible legal action and feeding the lawyercats. I admit I don't like it one bit, but the alternative is to sit around like a fool and I tried that strategy for the last 2 months without much success.
aq
full member
Activity: 238
Merit: 100
July 13, 2012, 01:39:52 PM
That's what paper wallets and bank safety deposit boxes are for.
Paper wallets and bank safety deposit boxes? We store everything at pirate these days Tongue
aq
full member
Activity: 238
Merit: 100
July 13, 2012, 01:38:17 PM
what is the difference between mtgox and bitcoinica, from your point of view?

MtGox has a 1:1 relation of input and output. A coin or USD can only come of of MtGox after it did come in.

Bitcoinica had leverage. So you could "earn" more coins/USD depending on the MtGox rate than there actually where in Bitcoinica. So Bitcoinica had to "play" against you by selling and buying coins on MtGox.
legendary
Activity: 1596
Merit: 1100
July 13, 2012, 01:34:57 PM

Some of the reasons why I avoided bitcoinica with a ten foot pole, which were obvious right from the start:

  • The big one -- Zero hard evidence they actually had all the funds claimed, or could produce funds if outsized events (big selloff, big withdrawal, etc.) occur
  • Opaque ownership structure
  • Zero independent source code auditing or visibility
  • Zero proof of any experience at securing wealth from virtual and physical threats
  • Zero appearance of adhering to any regulatory structure

Can't you apply most or all of these items to pretty much every bitcoin business available?
AFAIK, none of the exchanges had their source code audited, for ex.

The difference is in degrees.  Each is not a binary choice.  MtGox, for example, has been forced by circumstance (trial by fire?) to develop good legal and technical defenses.

Even so, I never trusted any exchange and unknown website -- MtGox included -- to store any significant wealth for any period of time.

That's what paper wallets and bank safety deposit boxes are for.

hero member
Activity: 812
Merit: 1001
-
July 13, 2012, 01:34:34 PM

Some of the reasons why I avoided bitcoinica with a ten foot pole, which were obvious right from the start:

  • The big one -- Zero hard evidence they actually had all the funds claimed, or could produce funds if outsized events (big selloff, big withdrawal, etc.) occur
  • Opaque ownership structure
  • Zero independent source code auditing or visibility
  • Zero proof of any experience at securing wealth from virtual and physical threats
  • Zero appearance of adhering to any regulatory structure

Therefore I was not surprised when bucket shops were mentioned.

Yep, Jeff, you can say it again. Though, while it was just Zhou it was kind of ok (easier to secure with everything concentrated in one place and having only one principal). As soon as BC bunch got in, it quickly turned into horrendous clusterfuck.

I must admit that, my "resignation" from honorary post of Bitcoinica's "Information Security Advisor" way back in Sep 2011, was probably the smartest move of my "Bitcoin career", in hindsight.

Anyway, I am off to enforcing 2 factor auth for Bitcoin Magazine and others, for everything I can enforce it on (naturally it is on for anything that touches money already).

I hope nobody is going to challenge me now when I repeat again:
Quote
1 BTC worth 100$US on entertainment value alone.
legendary
Activity: 980
Merit: 1020
July 13, 2012, 01:32:06 PM
Does anybody if MtGox employs pentesters?
donator
Activity: 452
Merit: 252
July 13, 2012, 01:31:02 PM
Difference Gox<->Bitcoinica?

MTBH.

(Mean Time Between Hacks)

-MarkM- (Not to mention minor details such as yubikeys etc etc etc, which might contribute to MTBH.)



gox had yubi keys, bitcoinica had google auth keys, from a laymans point of view both seem identical (I assumed their use functioned in the same way from a security point of view, looks like I was wrong)
legendary
Activity: 2940
Merit: 1090
July 13, 2012, 01:29:48 PM
Difference Gox<->Bitcoinica?

MTBH.

(Mean Time Between Hacks)

-MarkM- (Not to mention minor details such as yubikeys etc etc etc, which might contribute to MTBH.)

legendary
Activity: 1596
Merit: 1100
July 13, 2012, 01:29:13 PM

Some of the reasons why I avoided bitcoinica with a ten foot pole, which were obvious right from the start:

  • The big one -- Zero hard evidence they actually had all the funds claimed, or could produce funds if outsized events (big selloff, big withdrawal, etc.) occur
  • Opaque ownership structure
  • Zero independent source code auditing or visibility
  • Zero proof of any experience at securing wealth from virtual and physical threats
  • Zero appearance of adhering to any regulatory structure

Therefore I was not surprised when bucket shops were mentioned.



what is the difference between mtgox and bitcoinica, from your point of view?

Everything except source code visibility is different.

legendary
Activity: 1106
Merit: 1004
July 13, 2012, 01:28:32 PM

Some of the reasons why I avoided bitcoinica with a ten foot pole, which were obvious right from the start:

  • The big one -- Zero hard evidence they actually had all the funds claimed, or could produce funds if outsized events (big selloff, big withdrawal, etc.) occur
  • Opaque ownership structure
  • Zero independent source code auditing or visibility
  • Zero proof of any experience at securing wealth from virtual and physical threats
  • Zero appearance of adhering to any regulatory structure

Can't you apply most or all of these items to pretty much every bitcoin business available?
AFAIK, none of the exchanges had their source code audited, for ex.
donator
Activity: 452
Merit: 252
July 13, 2012, 01:27:11 PM

Some of the reasons why I avoided bitcoinica with a ten foot pole, which were obvious right from the start:

  • The big one -- Zero hard evidence they actually had all the funds claimed, or could produce funds if outsized events (big selloff, big withdrawal, etc.) occur
  • Opaque ownership structure
  • Zero independent source code auditing or visibility
  • Zero proof of any experience at securing wealth from virtual and physical threats
  • Zero appearance of adhering to any regulatory structure

Therefore I was not surprised when bucket shops were mentioned.



what is the difference between mtgox and bitcoinica, from your point of view?
Pages:
Jump to: