If I understood correctly (bear in mind that this rarely happens 
) fluffypony was referring to the possibility of MITM attacks.
) fluffypony was referring to the possibility of MITM attacks.In part yes, but also malware on your computer. There is no substitute for cold storage, paper wallets, good hardware wallets, etc.
Quote
So, afaik, there is nothing less secure with the wallets created with mymonero (discounting the 13 vs 24 word mnemonic).
If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.
If you, for whatever reason, used mymonero to create a coldish wallet, and never login again, you should be pretty safeish.
That is true assuming you are completely sure that nothing was compromised when you created it. Hard to really know that.
Well, what I wanted to convey is that, if one has already created the wallet for cold storage in mymonero, either the coins are already gone or they are still there.
Therefore, accessing mymonero just to transfer the coins to another cold storage may in fact worsen your chances of getting hacked. It would be safer to wait for the code to restore short mnemonic seeds to be available for offline use. Either through simplewallet or a third party client.
I'll just speculate here, but I believe what was ultimately referred to was the vulnerability of MITM when accessing mymonero via Tor because outproxies are essentially just "men in the middle" and anyone using them is trusting that they are benign. I'm pretty sure that if you see the https in standard clearnet, things are encrypted end to end so noone in the middle can read your stuffs. This doesn't prevent malware on your end from swiping your stuffs though. Keyloggers I guess would be the main thing. Or if your text input into the mymonero login is stored temporarily in any fashion. But ultimately I don't really know what I'm talking about, I'm just piecing together what I've gathered so far.
What concerns me is the amount that was stolen. That had to have been one of the larger if not the largest wallet on there. That says to me someone either targeted him specifically or had/has access to that info. I would not consider MyMonero safe for other than pocket change. And expect that someday every one of those accounts will be emptied. The Odds of only his account (specifically such a large one) going through a poison Tor node are So extremely low I can't even entertain the thought of that being the method of compromise.
Highly unlikely it was a targeted attack. Also, fairly unlikely that it was a Tor MITM attack. Even if it was, it probably was a driveby attack instead of a targeted one. MyMonero doesn't have a .onion link and therefore it is fairly easy to perform an MITM attack for a tor exit node (I think fluffypony stated that they already had earlier cases of TOR MITM attacks on MyMonero). Same happened to blockchain.info before they had a .onion address. Lots of threads about people that had their BTC stolen.
It is more likely malware/trojan/rootkit/virus etc. that somehow stole his XMR, i.e. acquired his seed somehow.