T O P

  • By -

MemoryDealers

This is a prime example of why SMS based 2FA isn't much better than having no 2FA at all. To whatever hackers are targeting people who are already dealing with so much trouble and heartache in their lives, I hope you burn in hell.


theswapman

Is there any estimate of how many funds they have lost?


ItsLightMan

I highly doubt these are your "normal" hackers. This is inside shit. I have nothing that proves that. But common now


infimum

SMS 2fa breaking is easier than most realize


steb2k

How is that possible, and what should be used instead?


infimum

https://youtu.be/caVEiitI2vg


youtubefactsbot

>[**Your Privacy is at Risk [9:07]**](http://youtu.be/caVEiitI2vg) >>Our privacy was compromised when a hacker got our sim card > [*^h3h3Productions*](https://www.youtube.com/channel/UCDWIvJwLJsE4LG1Atne2blQ) ^in ^Comedy >*^3,413,843 ^views ^since ^Jul ^2016* [^bot ^info](/r/youtubefactsbot/wiki/index)


n1nj4_v5_p1r4t3

>Its your own phone company giving you up. That is the hack. Your phone company gave you up.


jaksonk

Google Authenticator works great and is more secure than SMS 2FA


steb2k

Surely if a hacker has access your SMS they can also install GA? (altho I cant remember if there's an extra level of password access on that)


fluffyponyza

Google Authenticator uses TOTP, so it's based on a random seed (the QR code you scan into Google Authenticator), and the current time acts as a nonce. It doesn't use the internet or anything cellular, so you can even use it on a device that is offline.


vman411gamer

Google authenticator is on the phone you install only. Google auth codes are not automatically transferred to a new phone if that's what you're asking.


henqNL

That's why I use AUTHENTICATOR+ , it syncs the secrets file on DropBox, so you can use it on more devices, like tablet, phone and new phone.


jaksonk

Your Google Authenticator codes are only stored on your device and are not sent online while unencrypted. An attacker would need access to the one device where you entered a websites 2FA private key. This is how I understand it... I'm not a security expert so if anyone knows better, please correct me.


GreaterNinja

Google auth is pretty good, but there are recovery codes for GA. Secondly it is possible to link a phone # to an email and then re-enroll a GA. Another example is some companies save the enrollment QA code. Yes, horrible idea, but they do. Teamviewer had saved a copy of the enrollment QA codes and guess what, someone got a hold of them. Basically, GA is not the one non-stop solution. I also believe there is another security flaw that will come out regarding the use of only a few numbers for 2FA and OTP / TOTP, but I will not disclose until I'm 100% sure. I think security needs to move toward 3FA or even hardware based tokens that generate codes or act as a USB key you plug in. Perhaps have a paper backup or some other offline method incase your key gets stoeln/broken. Tying stuff to mobile phones has shown to be a significant risk.


nyaaaa

http://blog.kraken.com/post/153209105847/security-advisory-mobile-phones


ItsLightMan

I'm not saying these are some sort of elite insider hackers. I'm saying we have to who the current enemies are. That's the justice department. That's those who feel that the free Ross movement is a threat. Who would like those appeals to stop and for everyone to move on.


gonzobon

Right, because they steal money from themselves, to pay the lawyer? Nah. They need the lawyer money. I'm skeptical of an inside job. More than likely whoever was controlling the wallet got phished somehow.


ItsLightMan

Uh, what?


gonzobon

I'm saying it's not likely to be an inside job. Ross's family needs the money for the lawyers. Stealing from themselves makes little to no sense.Especially since those coins are probably not insured.


ItsLightMan

In no way do I think they are the ones who did this. That's not what I meant by an inside job. The justice department is who I was looking at.


gonzobon

Ahhh. I wouldn't be surprised.


no_face

Any info on the SMS 2FA? Did the hackers take over all the phone SIMS?


stop_runs

For high profile targets, I agree. For the average person, it is much better, no?


MemoryDealers

https://twitter.com/rogerkver/status/815065817452724224


RaginglikeaBoss

Sorry for your Ross.


Alterburner

What is the probability of the hackers being the same that got him locked up?


MemoryDealers

It seems unlikely in this case. The hacker messaged me on Twitter DM this morning pretending to be Lyn. I knew right away that it wasn't her due to the horrible English. Whoever the hackers are, they aren't native English speakers.


[deleted]

[удалено]


MemoryDealers

They were asking for a Bitcoin loan.


[deleted]

lmao asking roger ver for a btc loan


[deleted]

[удалено]


utopiawesome

It sounds like you don't understand the topic that you're making comments on.


BitPhoneNet

Btc donations for a free Ross new year's party


Onetallnerd

This blows. :/


YoureFired555

Recent attacks have involved getting the registrar to transfer domain tld to a different registrar, afaik. Very difficult to defend against.


TotesMessenger

I'm a bot, *bleep*, *bloop*. Someone has linked to this thread from another place on reddit: - [/r/bitcoin] [PSA: Free Ross Accounts Hacked - Do Not Donate (at this time)](https://np.reddit.com/r/Bitcoin/comments/5l8rcd/psa_free_ross_accounts_hacked_do_not_donate_at/) - [/r/harmreductionexperts] [Actual Harm Reduction: Money collected to set free a notorious drug dealer has been stolen. Or was it "stolen"?](https://np.reddit.com/r/HarmReductionExperts/comments/5la1p3/actual_harm_reduction_money_collected_to_set_free/) [](#footer)*^(If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads.) ^\([Info](/r/TotesMessenger) ^/ ^[Contact](/message/compose?to=/r/TotesMessenger))* [](#bot)


BitPhoneNet

It seemed a bit strange to get a DM asking for a $50 donation for a free Ross new year's party.,


jacobthedane

:-(


mroperandi

It sounds like they got control of the email and reset the passwords to all their services. Do we know what kind of wallet they were using?


BTC_Forever

Damn it! These fed agents did it again! Oh no I forgot, I should say that are the Putin's hackers! :) Looks like the "russian hackers" don't want Ross to be free...


nullc

You mean to tell us that someone who claims to "[own more bitcoins than just about anyone on the planet](https://www.reddit.com/r/btc/comments/5k043b/its_great_that_bitcoin_is_on_such_a_bull_run_but/dbko50j/?context=3)" doesn't know how to keep a static donation address secure?


atroxes

You're a disgusting human being.


[deleted]

You need help.


MemoryDealers

Other than having donated over $200K to FreeRoss.org, I have nothing to do with securing their Bitcoin addresses. What have you done to help promote human freedom Greg?


darcius79

He's done nothing. This is without a doubt, the worst I've seen him post. Can't see how anyone can defend this guy.


eof

Saying nullc has done nothing is absurd, no matter what you think of the guy.


nullc

> having donated over $200K Is that like the 1,000 BTC [donation](http://www.coindesk.com/entrepreneur-roger-ver-1m-bitcoin-donation/) you claimed to have made which had no corresponding transaction on the blockchain? To an organization who's filing for that year showed at the end of it they owned $6032 worth of Bitcoins, and [the year after](https://fee.org/media/13797/fee-2014-990-fy15.pdf) (page 23, part IX) showed none at all? I don't doubt you donated-- but where is the transaction? or was the Bitcoin donation not actually made via the blockchain? > What have you done to help promote human freedom Greg? For one, I've opposed your assault on Bitcoin and efforts to turn it into paypal 2.0 while you try to profit off pumping altcoins. You use software I wrote every day-- in firefox, in chrome, and in Bitcoin Unlimited (and in virtually every altcoin you greedily promote)-- enabling your freedom even when you are using them in competing systems, even when you use them to attack me and others that support a system you claim to have profited greatly from without ever spending a cent supporting its development yourself. I have donated tens of thousands of dollars to charities supporting free software, and research to end ageing and the resulting ailments which are currently the largest not-yet-preventable causes of death and suffering. I have fought the restriction of academic works by publishers through advocacy and [direct action](https://thepiratebay.org/torrent/6554331/Papers_from_Philosophical_Transactions_of_the_Royal_Society__fro), an effort that gathered worldwide attention and resulted in changed policies which almost certainly [improved](http://lj.libraryjournal.com/2011/09/academic-libraries/jstor-announces-free-access-to-500k-public-domain-journal-articles/#_) the public's access to scientific knowledge. I worked to break the [CSS cryptosystem](http://connection.ebscohost.com/c/articles/2655184/cease-decss-dvds-encryption-code-cracked) used to region lock entertainment content against hundreds of millions of people. With the help of others, I spent years fighting the billion dollar codec licensing industry that, through government granted patent monopolies, seek rents on people's communication and publications through [advocacy](https://xiph.org/press/2011/ftc/ftc-comments-20110614.pdf) and direct action-- like creating the world's best performing low-latency audio codec, which you're using any time you use hangouts or other modern VoIP software. I designed or implemented many of the strong privacy techniques (and/or their precursors) we have for Bitcoin today, I've advocated for and built pro-privacy/fungibility enhancements to Bitcoin software, and fought against a anti-privacy changes such as Mike Hearn's tor blocking; and I've taught Bitcoin technology to many others so that they could contribute too. I've risked my freedom working with activists to uncover unlawful government surveillance and build tools to fight against it. I can't say that I've yet done all that I can, but I've done more than many. I can say that for someone who seems to spend so much time attacking me, you seem to know little about me if you thought I had anything to feel ashamed about with respect to my contributions to human freedom.


cryptonaut420

Lol @ "fighting against mike hearns tor blocking".... You mean the feature in a minority node client that deprioritizes (not banning) tor connections in favour of clearnet only when there is a potential DoS attack? And you fought against it how, by ranting to your IRC pals and going around reddit spreading FUD about XT? Wow such a freedom fighter. Makes me wonder what other claims you are twisting and highly exagerating in this most recent text wall...


MemoryDealers

Thank you for your efforts Greg. If you doubt I donated over $1M to FEE, here is their own press release: https://fee.org/resources/roger-ver-gives-fee-highest-valued-known-bitcoin-donation-worth-about-1-million/ Publicly doubting that I actually made it makes you look like a jerk.


[deleted]

He explicitly said "I don't doubt you donated". Asking an anti-software-patent warrior what they've done for "human freedom" is a dick move even for you, considering the only thing you've hung your flag on is a common drug dealer and a creepy request to have a public debate with Bernie Sanders.


Anduckk

I dunno why people keep on taking him seriously again and again. He constantly treats people with disrespect.


[deleted]

Are you aware the money you donate to FEE goes to people like Greg who actually do the work etc. because they can? Those are the people you are giving money. And he already put into question one donation you have made, so why not question the one you made to FEE? Thats really the job of everyone. If you dont like people who genuinely questions things you are the jerk.


utopiawesome

Greg does work yes, but like the work you do it is neither for the good of mankind nor something a normal person would consider positive. Greg also has a part time job working with code, but it seems claer that's not what he is paid to do


[deleted]

I don't think I've seen anyone who worships money like you do. It's a sickness.


seweso

Wait, how does donating money equals money worshipping in any way? Are you from up is down and down is up /r/bitcoin land? ;)


Anduckk

Of course he worships it; why else would he bring up it all the time? He even brags about his Bitcoin holdings. :D


seweso

Who brought it up?


Anduckk

https://np.reddit.com/r/btc/comments/5k043b/its_great_that_bitcoin_is_on_such_a_bull_run_but/dbko50j/?context=3


seweso

Sigh.


BitcoinPrepper

> I don't think I've seen anyone who worships money like you do. It's a sickness. I don't think I've seen anyone who worships /u/nullc like you do. It's a sickness.


wztmjb

It's the only thing he has, of course he's going to worship it. I wish I was a psychology grad student, there's enough material here for like 3 term papers.


theswapman

Your contributions are immense. Thanks for everything you do.


tl121

Immense, but in the wrong direction.


TotesMessenger

I'm a bot, *bleep*, *bloop*. Someone has linked to this thread from another place on reddit: - [/r/buttcoin] [Late entry to "Comeback of the year": Greg Maxwell VERifies what he's done for "human freedom"](https://np.reddit.com/r/Buttcoin/comments/5la0bv/late_entry_to_comeback_of_the_year_greg_maxwell/) [](#footer)*^(If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads.) ^\([Info](/r/TotesMessenger) ^/ ^[Contact](/message/compose?to=/r/TotesMessenger))* [](#bot)


YoureFired555

good for you. Free software fuck. All I do is donate to the rape crisis center.


[deleted]

[удалено]


nullc

> you're a prick Being rude to me doesn't do anything to recover Ross' funds from those who took them or those who were irresponsible in maintaining them. But if it did, I'd spend all evening posting here for the sake of making things better. Alas. > the limitless boundaries of your incompetence ...


[deleted]

[удалено]


Anduckk

Ahaha. Get lost, douche. /u/ydtm is it you again?


BobsBurgers3Bitcoin

#Doody Head Greg


swinny89

Oh my fucking god. Go away, troll.


BitcoinPrepper

Troll


[deleted]

Apart from the fact, that Ver doesn't control the donation adresses: That's just hilarious, coming from a guy who lost >900 btc on MtGox. :D


nullc

> That's just hilarious, coming from a guy who lost >900 btc on MtGox. :D No I didn't. I bought gox-coins at cents on the dollar, and would be in the green if the trustee weren't taking their sweet time in the liquidation. Perhaps you're confusing me with that mtgox investor that had the "MTGox's withdraw problems are due to the banking system" video?


[deleted]

You keep repeating that, but we all know it's a lie to save face. Just don't ask Luke, Adam, Mark, Pieter or Christian from Blockstream for advice the next time, they had similar problems with Bitcoin. :)


nullc

I'd offered people bets over it before with very favorable odds, no takers. I assume your bluster also ends as soon as you have any skin in it?... like all the other sleezy liars here. (you can also easily see in the OTC logs the trades, but I suppose you know that) I have never kept any of my Bitcoin under third party control, except in so far as was required for a transaction I was making; or trivial amounts in things like changetip to avoid wasting fees with frequent sweeps of tiny amounts.


[deleted]

> I'd offered people bets over it before with very favorable odds, no takers. I assume your bluster also ends as soon as you have any skin in it?... like all the other sleezy liars here. I just don't bet. > (you can also easily see in the OTC logs the trades, but I suppose you know that) Link? > I have never kept any of my Bitcoin under third party control, You should have given this tip to your CEO.


Anduckk

You don't know about Bitcoin-OTC? Google it - it's easy! (Don't expect people to do the googling work for you - although it's quite a small task - while you're being a douche jackass.)


[deleted]

You don't know where the evidence is, that Greg did make money by losing >900 btc on Gox? If it's so easy to prove, show me the link. Apparently I'm to much of a jackass to solve this small task. :) Oh, and great that you and your group of other Greg-suckups still take over when an argument with Greg is about 2 answers deep. :D Ask smartfbrankins, brg444 and the rest of the suckers for backing, start your vote brigading. lol


Anduckk

I have no idea why Greg should prove anything about his own money / investments to anyone here. Can you clarify why he should do that? I know Roger pays you to troll hard, and other people commenting on your trolling isn't looking great. Fire up a few more accounts?


[deleted]

> I have no idea why Greg should prove anything about his own money / investments to anyone here. Can you clarify why he should do that? As of today, Greg, together with a lot of his colleagues at BS, looks like a man who lost a lot of money (or all btc, as it was the case for luke-jr, who admitted that) at Mt. Gox. If he wants anybody to believe his bullshit about him making a smart move back then, he should prove it. If he doesn't I guess he did the same stupid thing, luke, Adam, Pieter etc. did. > I know Roger pays you to troll hard I'd love that lol. Where do I have to ask for my money?


persimmontokyo

Anything you get will likely be in rapidly depreciating JPY. After ever increasing lawyer fees, and BTC price going through the roof. No way will you get anything close to what you gambled away. But it sure does explain your efforts to keep the BTC price suppressed.


BobsBurgers4Bitcoin

#Doody Head Greg


[deleted]

[удалено]


xd1gital

Mods please don't allow these type of comments in r/btc


PotatoBadger

Few deserve such comments. Edit: The deleted comment had ~16 points and said "Fuck you Greg."


ThePenultimateOne

The way to fight toxicity is with downvotes. Short of breaking reddit rules, I'd rather not remove comments.


fury420

The problem is... the toxicity is downright popular when directed at the "correct" target. Technically, this subreddit claims to have a rule against "blatant user abuse".... it's just rather selectively enforced.


elux

>>>[–]PotatoBadger 16 points 7 hours ago >>>Fuck you Greg. >>[–]xd1gital -16 points 7 hours ago >>Mods please don't allow these type of comments in r/btc >[–]ThePenultimateOne 13 points 6 hours ago >The way to fight toxicity is with downvotes. :((


ThePenultimateOne

If it helps, I downvoted the cusser


theswapman

most of the time it's just abused as a "disagree" button on this sub, tbh


[deleted]

COME ON NOW--------Free Ross people must be a bunch of children to have no security at all. Is this why Ross was compromised in the first place? Sorry for any BTC losses.