Now these are some serious and security minded people

Houdini

member

Activity: 84

Merit: 10

Quote from: NO_SLAVE on June 19, 2011, 08:46:44 PM

Quote from: Houdini on June 19, 2011, 06:18:49 PM

It seems whatever happens (market bubble bursts, astronomic thefts, server database hacks) Bitcoin keeps rolling on like a steamroller, stopping for nothing (including the victims splattened on the way

).

Yeh right, keep on smoking it brah. Fall out is on the way.

It's almost the same value as before the Mt. Gox crash. Any fallout will be longterm, it won't be a market crash, it will be a slowed growth.

NO_SLAVE

newbie

Activity: 56

Merit: 0

Quote from: Houdini on June 19, 2011, 06:18:49 PM

It seems whatever happens (market bubble bursts, astronomic thefts, server database hacks) Bitcoin keeps rolling on like a steamroller, stopping for nothing (including the victims splattened on the way

).

Yeh right, keep on smoking it brah. Fall out is on the way.

Batouzo

member

Activity: 70

Merit: 10

Quote from: cunicula on June 19, 2011, 08:34:46 PM

Are you shitting us?

Secure == code_security AND response_teams,
not "OR".

Why do you ask "Are you shitting us?" and then repeat my statement. ADHD?

Your statement looked like if you said it otherwise.
Like if you said "... but don't worry about the bad code, the RESPONSE is what matters"

Never mind then

unk

member

Activity: 84

Merit: 10

i'm forced to concur with cunicula about negligence. these aren't novel or clever problems to be having, and not responding to them instantaneously is very shoddy security practice. savvy users should demand no less, which is one reason i never set up a mt. gox account.

i've said it many times, but the community is overall exceedingly complacent when it comes to security, which is surprising for supporters of a cryptocurrency.

various attacks on the bitcoin protocol itself are next, because they take a little more cleverness than exploiting the kind of obvious web-based vulnerabilities that plague poorly written websites. nonetheless, i'm fairly sure that most people reading my last sentence are still thinking 'there are no such attacks because bitcoin is peer-to-peer. go away, you troll'.

cunicula

legendary

Activity: 1050

Merit: 1003

Are you shitting us?

Secure == code_security AND response_teams,
not "OR".

Why do you ask "Are you shitting us?" and then repeat my statement. ADHD?

cunicula

legendary

Activity: 1050

Merit: 1003

Of course they didn't know. Point is that they shouldn't have made optimistic assumptions. I posted yesterday that it was negligent of them not to have taken the site offline when the cross-site forgery exploit was discovered. I have much less information and expertise than they do, but it still seemed negligent to me.

They should have assumed the worst when the rate of reports of hacked accounts on the forums spiked dramatically in the last few days. If you wait for proof that you've been had it is too late by definition.

Batouzo

member

Activity: 70

Merit: 10

Quote from: cunicula on June 19, 2011, 05:19:55 PM

"Last time I checked the source code of them... they didn't use parametrized queries. I hope they do now, if security is so important for them."

Security is not just in the code. Management's response to incidents is just as important

Are you shitting us?

Secure == code_security AND response_teams,
not "OR".

onesalt

hero member

Activity: 756

Merit: 500

Quote from: bcearl on June 19, 2011, 04:51:56 PM

Quote from: SgtSpike on June 19, 2011, 03:58:09 PM

Yeah, I am glad to see that at least ONE bitcoin site has security on their minds!

They work with real money - not with worthless FED bills.

which is wierd becuase I don't recall one main street bank losing all their money and customer records to a simple sql injection attack...

saqwe

sr. member

Activity: 700

Merit: 250

Quote from: unk on June 19, 2011, 07:48:35 PM

a suggestion to the kind folks at britcoin:

once you are able, announce in advance a particular time that you will restart the exchange. announce also a time, at least several hours before that opening, at which customers will be able to log in and have an opportunity to add and delete orders. then, orders on the same side of the market at the same price when the exchange goes 'live' again should compete at random, not based on the time of entry.

this will help avoid a rush, normalize the market, and satisfy a variety of disparate interests.

+1

ishav

newbie

Activity: 12

Merit: 0

Quote from: cunicula on June 19, 2011, 05:19:55 PM

"Last time I checked the source code of them... they didn't use parametrized queries. I hope they do now, if security is so important for them."

Security is not just in the code. Management's response to incidents is just as important. Mt. Gox has failed severely on this dimension.
"Really guys it's just one account, breached due to user error. All the other accounts are safe."
Rinse Repeat until the business fails.

Kudos to Britcoin.

And how do you know that they was aware of their database breach when they wrote that?.

unk

member

Activity: 84

Merit: 10

a suggestion to the kind folks at britcoin:

once you are able, announce in advance a particular time that you will restart the exchange. announce also a time, at least several hours before that opening, at which customers will be able to log in and have an opportunity to add and delete orders. then, orders on the same side of the market at the same price when the exchange goes 'live' again should compete at random, not based on the time of entry.

this will help avoid a rush, normalize the market, and satisfy a variety of disparate interests.

Houdini

member

Activity: 84

Merit: 10

Someone else takes security seriously as well :
"TradeHill has recently learned that a large number of user accounts at a competing Bitcoin exchange have been compromised. Because of the possibility that our users may have used the same password on multiple exchanges, we will be halting the ability to trade or withdraw funds for a few hours. We hope this will give all of our users time to reset their passwords if needed. You can reset your password by clicking on your username in the upper right of the website. This merely a precaution, and we do not have any evidence that our site has been compromised in any way. More info soon."
It seems whatever happens (market bubble bursts, astronomic thefts, server database hacks) Bitcoin keeps rolling on like a steamroller, stopping for nothing (including the victims splattened on the way

).

GeniuSxBoY

hero member

Activity: 616

Merit: 500

I don't buy anyone claiming security. I haven't seen lulz FAIL at anything they put their mind to.

cunicula

legendary

Activity: 1050

Merit: 1003

"Last time I checked the source code of them... they didn't use parametrized queries. I hope they do now, if security is so important for them."

Security is not just in the code. Management's response to incidents is just as important. Mt. Gox has failed severely on this dimension.
"Really guys it's just one account, breached due to user error. All the other accounts are safe."
Rinse Repeat until the business fails.

Kudos to Britcoin.

bcearl

full member

Activity: 168

Merit: 103

Quote from: SgtSpike on June 19, 2011, 03:58:09 PM

Yeah, I am glad to see that at least ONE bitcoin site has security on their minds!

They work with real money - not with worthless FED bills.

Houdini

member

Activity: 84

Merit: 10

There's one good thing to come out of this horrible mess (every cloud has a silver lining). Every other bitcoin exchange from now one will strive with all their might to secure their database, because not doing so means business failure (if Mt. Gox isn't killed by this, it will certainly have a huge decrease in revenues due to loss of customers).

BioMike

legendary

Activity: 1658

Merit: 1001

Last time I checked the source code of them... they didn't use parametrized queries. I hope they do now, if security is so important for them.

angelo95

member

Activity: 84

Merit: 10

Yes but it's easy now after the battle. They might gain a lot of bidders though now as Mtgox is dead.

myrkul

hero member

Activity: 532

Merit: 500

FIAT LIBERTAS RVAT CAELVM

Quote from: Houdini on June 19, 2011, 03:55:33 PM

Quote from https://britcoin.co.uk/ :

We will put Britcoin up again as soon as possible, but only once we are confident we have the highest level of security our users deserve.

Good on them.

SgtSpike

legendary

Activity: 1400

Merit: 1005

Yeah, I am glad to see that at least ONE bitcoin site has security on their minds!

Topic: Now these are some serious and security minded people (Read 3855 times)