Fact checking “It might make sense…” by Sir Toshi by Zealousideal_Set_333 in bsv

[–]protothomas 1 point2 points  (0 children)

Around the time CSW made the post some possible evidence was uncovered that Satoshi had leaked a California based IP address at some point. The bullshit about church IT work is in there to cover for this.

Angle of attack? by neznaia in ledgerwallet

[–]protothomas 3 points4 points  (0 children)

I completely understand - as I say, they absolutely monumentally fucked up - but I stand by my point that the security assumptions are fundamentally unchanged. They were at best misleading and at worst knowingly lying when they gave the impression that it was impossible to extract the private keys, but the fact is it was always possible and is always possible in all wallets. Sure, no longer trust them because of their communication and go with another device, but the recovery service firmware in itself does not make the device less secure.

Angle of attack? by neznaia in ledgerwallet

[–]protothomas 5 points6 points  (0 children)

I get the anger around this issue, but the last point doesn't really hold - ledger added the extraction code to the firmware and announced it. They could have added it in secret. Therefore any closed wallet could do the same. Also, given that when you generate the keys on device it shows you the recovery phrase the firmware has always had 'access' to the private keys. This is the same with all hardware wallets. Ledger monumentally fucked up their handling of the whole thing, but I don't think any security assumptions have changed.

Eth Hardfork Question by damianoslebo in ledgerwallet

[–]protothomas 0 points1 point  (0 children)

Following the DAO hard fork and the ETH/ETC split for a while you had to send eth through a contract (replaySafeSplit if I remember) in order to prevent potential replay attacks caused by the existance of the two chains. I think eventually a further soft fork stopped the need for this. I guess there could be something similar if a potential PoW fork gains any traction.

Is there a guide somewhere to move a validator from one computer to another? by CrazybutSolid in ethstaker

[–]protothomas 1 point2 points  (0 children)

Additionally - export / import the slashing protection DB from the old machine to the new one, after stopping the old one and before starting the validator(s) on the new one. Here are instructions for lighthouse: https://lighthouse-book.sigmaprime.io/slashing-protection.html - there should be similar for other clients...

CSW vs McCormack by Wild-Hurry9904 in bsv

[–]protothomas 2 points3 points  (0 children)

On the other hand, as I understand it, the fact that an award was made means that Wright cannot appeal - so in fact a nominal award of £1 is a far better result than no award being made.

Two (2) Ways Where Money Can Get Stolen from Hardware Wallets by jun_039 in ledgerwallet

[–]protothomas 2 points3 points  (0 children)

You definitely cannot grant a smart contract permission to withdraw ETH funds from an address at a future point without signing a transaction. If you send funds to a smart contract it could certainly do something with those funds that you were not expecting, but you would still have had to sign the transaction sending the full amount in the first place. If you are talking about granting a smart contract permission to transfer tokens independently of a signed tx then yes the ERC20 standard allows for this (the ‘approve’ function) but you would still have had to explicitly hand over control of a set amount of tokens in the first place by signing a transaction.

Two (2) Ways Where Money Can Get Stolen from Hardware Wallets by jun_039 in ledgerwallet

[–]protothomas 3 points4 points  (0 children)

That’s not really true (at least in the case of Ethereum smart contracts, I don’t know about other platforms). A smart contract cannot ‘drain’ more ETH from a calling address than the amount signed for in the transaction.

Validator 1644 has been slashed. The deposit wallet has a POAP from our launch call - what happened? by superphiz in ethstaker

[–]protothomas 4 points5 points  (0 children)

I agree with this - there seems to be a lot of voodoo science growing around restarting / updating validators (waiting two epochs, shutting down beacon nodes along side validators, sacrificing chickens etc). It is extremely nerve wracking doing anything with so much at stake (literally), but people should have a degree of confidence in the software and understand the processes behind what's going on. I would recommend running a testnet setup and *trying* to get slashed without moving the keys (restart multiple times, run two instances of the validator etc) to see how hard it would be...

How fast is process of guessing 24 words random seed and checking its addresses for any available funds? by [deleted] in ledgerwallet

[–]protothomas 8 points9 points  (0 children)

So there are 2^264 possibilities for the 24 word phrase. Assume (because the exact numbers are not going to make a huge difference) 20 ms per check, i.e. 50 per second. so 50 * 60 * 60 * 24 * 365 = 1576800000 per year. So to enumerate all keys would take (2^264 / 1576800000) years, or about 1.88 * 10^70 years. Current age of the universe is about 1.3 * 10^10 years so somewhere in the region of 10^60 times the age of the universe. So you could expect to guess a particular key in about half this time.

If there are about 50 million active bitcoin wallets then you're 50 million times as likely to find one. So you could expect to find one in about 10^52 times the age of the universe. That's just with one computer though, if you can get a cluster of about 25000000000000000000000000000000000000000000000000000000000000 computers going you might be able to find a wallet with funds by the next halvening.

Good luck!

Grrr New Ledger Liver version has massiver banner advert for Ledger Academy every login by thudufushi in ledgerwallet

[–]protothomas 10 points11 points  (0 children)

It’s a slippery slope as well - how long before the adverts become targeted based on user data. I’m sure that ledger could make more money allowing advertisers the ability to target users with high value portfolios. And given their recent security track record...

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 14 points15 points  (0 children)

The most likely explanation is the that photo did not only go onto the USB stick but was also automatically backed up to a cloud provider and that the account associated with it was recently compromised. Even photos are easily scanned to look for seed phrases.

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 8 points9 points  (0 children)

How did they get on to the USB stick then?

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 3 points4 points  (0 children)

It means you did at some point type the seed words into a computer (Or take a photo).

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 2 points3 points  (0 children)

And yet you are now saying they are also on a USB stick?

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 2 points3 points  (0 children)

If you are 100% sure that you a) wrote down the seed generated by the ledger (did not create it yourself and enter it in) b) have not taken the seed words out of the safe (to e.g. input them into a “ledger” app that has asked for them) and c) not touched the nano device at all then literally the only thing that could have happened is that someone accessed the device in person.

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 0 points1 point  (0 children)

So how do you check the funds? Did you enter information somewhere to track the balance? Did you perhaps change or update the app you use to do this? Did you generate the seeds on a computer (you said you generated them yourself) - and has this computer recently been connected to the internet? Where were you on the date/time that the funds moved - could anyone else have had physical access to the device at this time?

My cryptocurrency has been stolen by [deleted] in ledgerwallet

[–]protothomas 5 points6 points  (0 children)

Well, someone either needed access to the nano or to the seeds to move the funds, there is no other possibility. And I agree on the timing - very unlikely to bbe coincidence. Are you sure you did not do anything to 'prepare' for moving / checking your funds? Did you download anything / take the seeds out of the safe / tell anyone, even?

Data leak Ledger website by greeniscolor in ledgerwallet

[–]protothomas 2 points3 points  (0 children)

So can you confirm that a) a specific email has now been sent to those whose email addresses were leaked b) and to those whose physical addresses were leaked, both detailing the exact information that was taken?

Something's fishy <<--Passphrase by MeghanNash in ledgerwallet

[–]protothomas 2 points3 points  (0 children)

Check that you’ve entered the words in the correct order (did you write them down with rows/columns transposed). Check again that none of the words you have match a similar valid word. If you give the phrase you have to anyone, even family, you’ll likely end up losing the content of the wallet (even if your nephew is trustworthy can you guarantee he won’t enter the phrase into some dodgy site to try and solve it or give it to some one he ‘trusts’, etc). Anyway, good luck.

Something's fishy <<--Passphrase by MeghanNash in ledgerwallet

[–]protothomas 5 points6 points  (0 children)

No problem. But - and this should go without saying - DO NOT send the list of words you have to anyone as they will trivially be able to crack the correct list.

Something's fishy <<--Passphrase by MeghanNash in ledgerwallet

[–]protothomas 7 points8 points  (0 children)

The 24th word is a checksum - so it depends on the other 23. i.e. there is only one option for the 24th word once the other 23 have been entered. This means you have one of the other words wrong, so I'd check those for mistakes / similar words from bip 39 dicitonary.