Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Thursday February 01 2018, @02:37AM   Printer-friendly
from the handy-piece-of-code dept.

My old physics teacher always said: "It's the dumb criminals who get caught; you never catch the smart ones." He was a really smart guy, and he did live a nice lifestyle, hmmm...

Anyway, so IOTA. As with any digital currency, you need some random information - a passphrase typically - that is used when you create your wallet. In the case of IOTA, which is supposed to be IOT friendly, this means a string of 81 random characters, the generation of which could be pretty easily automated.

That's great, and the OSS world being full of helpful people, someone wrote a handy generator, put the code for all to see on GitHub, and put their generator onto a website where you could easily make use of it. Nice.

Actually, diabolical. The code on the website really was identical to the code on GitHub, except for one tiny, almost insignificant change: at some point, the owner swapped out the random seed to a value that he knew. Not even constant - that would have been too obvious - but known nonetheless.

And for many months, many people used his friendly little service. Until January 19th, when he emptied their IOTA wallets, erased his presence from the Interwebs, and quietly disappeared. $4 million or so richer.

This one won't be caught.

tl;dr for anyone who doesn't get it: The point of having a secret password, secret passphrase, or secret key is that it's secret. Which means that you don't have it generated for you by a public web service.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2, Touché) by Anonymous Coward on Thursday February 01 2018, @04:09AM (3 children)

    by Anonymous Coward on Thursday February 01 2018, @04:09AM (#631338)

    If there exists a person who will for some reason hand you real money for play money - it still is play money.

    Starting Score:    0  points
    Moderation   +2  
       Informative=1, Touché=1, Total=2
    Extra 'Touché' Modifier   0  

    Total Score:   2  
  • (Score: 1, Insightful) by Anonymous Coward on Thursday February 01 2018, @04:48AM (1 child)

    by Anonymous Coward on Thursday February 01 2018, @04:48AM (#631346)

    if a large, monopolizing force goes around threatening to kill you if you don't use its play money, is it still play money?

    • (Score: 2) by aristarchus on Thursday February 01 2018, @05:53AM

      by aristarchus (2645) on Thursday February 01 2018, @05:53AM (#631356) Journal

      NO ONE EXpects! The violent imposition of a fiat currency! Those who do expect it, um, . . . come in again. I am now very curious about who bradley12+1's teacher was. Kevin Spacey?

  • (Score: 2) by requerdanos on Thursday February 01 2018, @05:28PM

    by requerdanos (5997) Subscriber Badge on Thursday February 01 2018, @05:28PM (#631566) Journal

    If there exists a person who will for some reason hand you real money for play money - it still is play money.

    If pretty much anyone will exchange you some widely-recognized money you call "real money" for the stuff you call "play money," then it's all as real as money gets and you are an idiot.

    Things like IOTA, Bitcoin, and the US Dollar are inherently worthless and only have value because people esteem them to have value. Because they are divisible and transferrable, and people esteem them to have value, they are by definition money.

    If your "money" is only useful as a token counter when playing a board game, or in teaching money theory to children, then it is "play money." As soon as a market appears to pay you for that money, it's not play money anymore, even if you personally don't approve of same.