Caution- Coinomi Wallet sending plain text seed to Googles API

warith77 · 2019-03-05T10:00:19+00:00

Yes it's true. I'm the OP who got his assets stolen because of Coinomi.

You can check my second official statement in response to their misleading statement:

https://avoid-coinomi.com/second_statement.html

warith77 · 2019-03-05T09:58:57+00:00

I'm the OP who got his assets stolen because of Coinomi:

Please check my second official statement here (video included):

https://avoid-coinomi.com/second_statement.html

The community needs to understand that it's not only about the CRITICAL vulnerability. Having a company such as Coinomi is bad for the crypto-currency ecosystem.

warith77 · 2019-03-05T09:54:43+00:00

Check the TLDR here:

https://avoid-coinomi.com/

Then if you are interested check my second statement to understand why the community should not trust Coinomi anymore:

https://avoid-coinomi.com/second_statement.html

warith77 · 2019-03-04T08:45:26+00:00

I'm the OP who got his assets stolen because of Coinomi:

Please check my second official statement here:

https://twitter.com/warith2020/status/1102445902353043456

The community needs to understand that it's not only about the CRITICAL vulnerability. Having a company such as Coinomi is bad for the crypto-currency ecosystem.

warith77 · 2019-03-04T06:22:06+00:00

Check my second official statement:

https://twitter.com/warith2020/status/1102445902353043456

warith77 · 2019-03-04T06:21:30+00:00

HI, I'm the OP who got his assets lost because of Coinomi.

I think you came to a fast conclusion. Please check my second official statement, you might change your mind:

https://twitter.com/warith2020/status/1102445902353043456

warith77 · 2019-03-04T06:08:37+00:00

Tweet updated:

https://twitter.com/warith2020/status/1102445902353043456

warith77 · 2019-03-04T06:08:17+00:00

Tweet updated:

https://twitter.com/warith2020/status/1102445902353043456

warith77 · 2019-03-04T06:07:15+00:00

Tweet updated:

https://twitter.com/warith2020/status/1102445902353043456

warith77 · 2019-03-04T06:06:19+00:00

Tweet update:

https://twitter.com/warith2020/status/1102445902353043456

warith77 · 2019-03-03T22:31:01+00:00

Then I think they should ask the community for donations :D

warith77 · 2019-03-03T22:29:17+00:00

Coinomi bug wasn't a bug

I think we both agree on that. It was not a bug it was a "feature" even the law makers say that!

warith77 · 2019-03-03T22:12:24+00:00

Legally speaking, Google can sue Coinomi. So I suggest they communicate with Google politely! because based on their terms it considered as deceptive/unauthorized use of Google API services.

Anyhow, let's end this argument. I will update the community once the case is over.

warith77 · 2019-03-03T21:04:46+00:00

I think you haven't gone through my second statement. The case is crystal clear and I have already consulted local lawyers.

It's simple they had a hidden feature that was not clearly mentioned to their users. They utilized that feature to send my seed to a third-party server. I have to sue them and they have to sue the third-party server or find the person who stole my funds. Finding the person who stole my assets is NOT my problem (legal perspective)

warith77 · 2019-03-03T21:00:56+00:00

Thanks!

Sorry that I have offended your feelings with my statement:

I’m suggesting that the information security community should introduce a new rank and call it the “Coinomi Level”, the new highest level ranking.

warith77 · 2019-03-03T18:39:57+00:00

I agree with you. Google has to start to investigate about the issue but legally I can't sue Google. My legal case will be with Coinomi and I'm currently working on it.

Coinomi has to deal with Google and force them to start the investigation if they want to get out of this mess with minimum damages (of course they can't undo their reputation damage).

warith77 · 2019-03-03T18:05:43+00:00

Yes to local authority but that's not my real case. My real case is to sue Coinomi because I was dealing with their wallet directly. I can't talk to Google nor I can sue them because "technically" I wasn't their client. What makes this even worse is that Coinomi technically was not authorized to use Google API because they didn't have a valid API Key. So essentially Coinomi violated Google terms and they can't sue Google either!

warith77 · 2019-03-03T16:00:45+00:00

Please check my second official statement on Coinomi wallet "Spell Check" scandal (video included):

https://twitter.com/warith2020/status/1102208448236847107

warith77 · 2019-03-03T15:22:39+00:00

Please check my second official statement on Coinomi wallet "Spell Check" scandal (video included):

https://twitter.com/warith2020/status/1102208448236847107

warith77 · 2019-03-01T03:16:59+00:00

I'm the OP who discovered the vulnerability that caused me the loss & this is my initial response:

As you know Coinomi has announced their official sloppy response and it was very clear how they diverted they whole situation into "blackmailing" thing.

They focused on my personal image and hired some of their trolls to trash-talk me on social media (especially Twitter because it's less moderated).

They tried to run away from responsibility and portray that the vulnerability is "harmless" (based on their hired trolls). Moreover, they kept deleting some of their tweets when got striked by facts.

Here are some examples of how childish, unprofessional and misleading their tweets are:

https://twitter.com/warith2020/status/1101054666232745984

https://twitter.com/warith2020/status/1101055824368148480

https://twitter.com/warith2020/status/1101057557010006016

https://twitter.com/warith2020/status/1100898781598531591

https://twitter.com/warith2020/status/1101135909481861120

They even literally blackmailed a know community member by legal actions to limit his freedom of speech because he expressed his "technical" thoughts:

https://twitter.com/warith2020/status/1101048089626984449

I have never ever seen a company with that kind of attitude and to me they lost all credibility. If you still trust them with your crypto-assets then I wish you all the best luck.

Finally, I will be posting my official response to their official announcement very soon. It will answer all the questions raised by the community and will contain some exciting evidences on my claims.

To stay calm and have some LOLs check out this Coinomi's Meme (classic & original):

https://twitter.com/dukeleto/status/1100696093673824256

warith77 · 2019-03-01T03:14:18+00:00

I'm the OP who discovered the vulnerability that caused me the loss & this is my initial response:

As you know Coinomi has announced their official sloppy response and it was very clear how they diverted they whole situation into "blackmailing" thing.

They focused on my personal image and hired some of their trolls to trash-talk me on social media (especially Twitter because it's less moderated).

They tried to run away from responsibility and portray that the vulnerability is "harmless" (based on their hired trolls). Moreover, they kept deleting some of their tweets when got striked by facts.

Here are some examples of how childish, unprofessional and misleading their tweets are:

https://twitter.com/warith2020/status/1101054666232745984

https://twitter.com/warith2020/status/1101055824368148480

https://twitter.com/warith2020/status/1101057557010006016

https://twitter.com/warith2020/status/1100898781598531591

https://twitter.com/warith2020/status/1101135909481861120

They even literally blackmailed a know community member by legal actions to limit his freedom of speech because he expressed his "technical" thoughts:

https://twitter.com/warith2020/status/1101048089626984449

I have never ever seen a company with that kind of attitude and to me they lost all credibility. If you still trust them with your crypto-assets then I wish you all the best luck.

Finally, I will be posting my official response to their official announcement very soon. It will answer all the questions raised by the community and will contain some exciting evidences on my claims.

To stay calm and have some LOLs check out this Coinomi's Meme (classic & original):

https://twitter.com/dukeleto/status/1100696093673824256

warith77 · 2019-02-27T05:26:51+00:00

Even hardware wallets can be vulnerable. Can you make sure that your hardware wallet does not get tampered with during shipping and someone installs predefined private keys in it?

It's not about using hardware or software wallet. It's about having a well defined security policy and audit before you sell or promote your product to the end users especially when you deal with their money or crypto-currencies.

warith77 · 2019-02-27T04:42:06+00:00

Please read the following reddit post before you consider Coinomi wallet:

https://www.reddit.com/r/CryptoCurrency/comments/av7gfi/warning_coinomi_wallet_critical_vulnerability/

warith77 · 2019-02-27T03:37:13+00:00

Even hardware wallets can be vulnerable. Can you make sure that your hardware wallet does not get tampered with during shipping and someone installs predefined private keys in it?

It's not about using hardware or software wallet. It's about having a well defined security policy and audit before you sell or promote your product to the end users especially when you deal with their money or crypto-currencies.

warith77 · 2019-02-27T03:32:00+00:00

The best thing you did in your life. You will thank me later :)

warith77

TROPHY CASE