I did not want to write about Bitcoin again so soon, but there
has been some feedback to my previous posts, and quite a storm of
bad news about it recently, so here we go. I almost promise to shut up
about it after that.
When I wrote last week about Bitcoin's greatest threat
being part of its user base, I was talking about anti-social tendencies and religious frenzy.
Allow me to add incompetence to the list.
One would assume Bitcoin mostly appeals to cryptography and computer nerds,
and that as a result its early adopters would be "security literate" and understand
the implications of a system that stores money in a file on a computer, and that builds upon
completely unregulated transactions among completely unregulated and largely anonymous parties. One would further
assume that this is even more the case for individuals who hold significant amounts in their
digital wallets. The events last week suggest otherwise.
First there was the
case of the man who had 500.000 $ worth of bitcoins stolen. He had been storing his wallet
file containing 25.000 bitcoins (traded at around 20 $ each at the time) in an unprotected
hard disk on a Windows computer that was connected to the Internet and that he extensively used
for other purposes as well, including (one has to presume) chatting, browsing, and gaming.
The computer was subsequently hacked and the coins transferred away.
While the Bitcoin client allows this usage (in fact, it is the default) and no measures are taken
in software or otherways (such as by means of warning messages) to protect the wallet, the blame really has to lie with
the stupidity of the user. Any significant amount of bitcoins should not be lying around in
an unencrypted file on a regular computer. It should be sitting on an encrypted memory stick
in a safe, with multiple backups, and only ever be connected to anything for the short time it takes
to initiate a transaction. What this user was doing was equivalent to placing a pile of cash
on the table in an unlocked room with the windows (pun intended) open.
And then there was the MtGox meltdown.
MtGox (which used to stand for Magic: The Gathering Online Exchange) is (or maybe was)
the largest (practically the only significant) service for exchanging bitcoins to US dollars.
It accepts (completely unregulated, unlicensed, unaudited and uninsured) deposits from traders
in bitcoin and dollars, and allows them to trade among each-other between the two currencies.
Over the last weeks there have been complaints from users about their accounts having been hacked,
the blame for which MtGox put on the users.
Last week, it has been revealed that MtGox
was vulnerable to CSRF attacks, which made it possible to initiate MtGox transactions
by having the account owner click on a seemingly unrelated link. This is of course a terrible
security hole for any website, and unforgivable for a financial site,
but on the other hand, it only works if you stay logged in to MtGox while browsing
other websites. You should have learned in Internet Banking 101 that you always log out
immediately after you have done your banking business. Using a dedicated browser for online banking
is not unheard of, either.
And then on Sunday, the bomb struck: The whole user database of MtGox had been stolen
and leaked on the Internet as a file containing all user names, email addresses and password hashes.
Most likely using this file, someone accessed an account on MtGox containing 500.000 bitcoins,
sold all of them, thereby driving the exchange rate down from 17 dollars to one cent within
ten minutes. After that MtGox shut down, and will only resume trading after the security problems
have been fixed, all users re-authenticated, all passwords changed, and all trades after the fraudulent
one rolled back.
The effect this massive trade had on the exchange rate is a topic all in itself.
I do not have a problem with it, and I do not think it is strictly necessary to prevent
massive fluctuations by shutting down the market (which is what would happen in a stock exchange
for example). The rate recovered soon afterwards.
A trade of such huge proportions will of course move the market quite a bit.
In fact, I would really like to see a legitimate sell-off from the couple of people
that hoard the thousands of bitcoins back from the early days. Otherwise all the
talk about Bitcoin being one big Ponzi scheme is not without base. If Bitcoin is supposed
to grow, there needs to be more liquidity and the coins need to be in the hands of people
who want to transact with them (as opposed to speculators). The "founding miners" should
cash out now (and if that brings the price down to 10 cents again, so be it).
To get back to the security topic: In no way can the incompetence of MtGox be excused here.
But how can there be an account with 500.000 bitcoins? That is almost eight percent of
all coins in existence! Unless you really wanted to trade all
of them very soon (and that does not make sense, because MtGox only allows withdrawals
of up to 1000$ a day), they should be sitting on the encrypted memory stick in your safe.
And why would you trust MtGox enough to deposit such a huge amount of money with them?
Again, they are a non-audited, non-insured, non-regulated very small shop unlicensed as a depository institution,
running their trading system on software put together for swapping fantasy trading cards.
What if one of their employees (if they even have one...) decides to run with it?
And looking at the leaked password file, what is up with all those people that use their username
as their password, or even just the word "password"? It takes mere seconds to expose those passwords,
and they are known all over the Internet now (or at least with people that collect other people's
passwords). My name is on that list too (I checked), but
my password can probably not be decrypted easily, because I use a password generator program
that makes passwords very hard to guess. And even if my password gets disclosed, that would only
have affected my MtGox account (where I do not keep more than I am comfortable with losing),
because the password generator also makes sure I have a different password for every site.
A lot of people with weak passwords probably use the same password for their email account
(conveniently listed in the same file) and other online services.
We only learned about this because of the big brouhaha at MtGox. There are many more
such password lists being passed around in criminal circles that the account owners (and service providers)
never hear about. Think about that next time you set up a password for some forum site or greeting card
service.
![[FSF Associate Member]](http://image.thilosophy.com/fsfMember.png){kind=small}
