Quote from: bumbo on April 10, 2013, 08:13:41 AM

Quote from: Boussac on April 04, 2013, 04:53:44 PM

An intruder was able to access the instawallet database. As a result, all "hidden" urls, i.e wallets, have been compromised and are no longer safe to store bitcoins.

Why would that be the case? If you stored strong salted hashes of the URI keys, then it would be next to impossible for the attacker to brute force valid URIs out of your DB. The fact that the actual keys appear to be stolen and you set up a long time (3 months) instead of a short time for claims process raises suspicion.

Please do officially confirm that you did not store the secret in plain text on a webserver.

Also, how do you store user passwords in other Paymium services? Thanks.

A little history (as I understand it):

'Instawallet' was conceived of and implemented by a user named ~jav. He seemed to me like a pretty straight up guy.

~jav got tired of it and/or busy and ~davout adopted it because 'it was to cool to let die' or something along those lines. I don't recall if I started using it before or after this switch.

It would make perfect sense to me if ~jav never really put in the effort to adequately secure the thing. It would be a good reason to drop it since such work would be tedious. Remember, back in those days BTC were not worth anything near what the are today.

It would also make sense that ~davout never got around to either evaluating th implementation, or doing the necessary security work (assuming he was even capable.) He has likely been very busy with other projects. In short, it would not surprise me if it were true that theft of the database would result in loss of the URL's.

As I recall, ~jav open-sourced it and ~davout just took his work so perhaps some of these conjectures about at least the original ~jav vintage implementation could be verified. A good task to run down at a later date since it is late tonight and I'm tied up most of tomorrow.

---

But, as I said in the other note, the ONLY thing that adequately explains the evasiveness about the supposed police report is that it is bullshit. And the only thing that adequately explains them lying about that is that they are, in fact, the perps.

This in turn means that they have all the URL's and and all the coins and the mythical 'attackers' do not. They could give all of them back at any time if they so chose.