Quote from: chodpaba on June 27, 2011, 05:58:41 AM

ZOMG people!

You have real money on your computers now.

Stop using Windows.

That is all...

Oh come on. While I absolutely agree that Linux is more secure and generally a better idea to use it, this could not have been prevented by using Linux.
Your wallet.dat is in your home directory, in the .bitcoin folder. That means it is freely accessible by any binary you run. All it has to do is grab that file, and ftp/email/something else it to someone. That is all perfectly possible, even from a severely limited Linux user account.
Supporting Linux for its features is all fine, but don't go run around like a blind fanboy, saying the entire world could be saved by running Linux.

Quote from: cschmitz on June 27, 2011, 06:04:20 AM

Quote from: allinvain on June 27, 2011, 06:01:49 AM

Oh here we go..attack of the Linux nerds!

OMG OMG the default bitcoin cleint's security sucks..OMG unencrypted wallet.dat is such a good idea!

Anyways, this is the standard response most of you give...so yeah..moving on.

Keep proving the world that you are a bitter troll with no clue about computer security. A wallet.dat encryption is a false security feature, go troll somewhere else.

Bullshit. A wallet.dat with a password (and said wallet.dat never touching the disk in unencrypted form) prevents outright stealing of a wallet.dat file, as you would need the password and/or keyfile to unlock it. That means that simple hit-and-run wallet.dat stealers are practically useless.
This is also why third-party encryption is practically useless. Either your virtual disk with wallet is mounted (and it can be read off said disk as if it was never encrypted, doing a simple filesystem search) or it's not, in which case you can't use Bitcoin. Having to decrypt the wallet every time you want to use it (and thus leaving an unencrypted copy on your hard drive) is not an option either. This is why the client ITSELF should provide encryption that only happens when the wallet is actually needed, and that doesn't let the unencrypted wallet touch the drive, ever.

Quote from: bitcola on June 27, 2011, 07:08:54 AM

Quote from: allinvain on June 27, 2011, 06:05:35 AM

Quote from: bitcola on June 27, 2011, 06:01:28 AM

This sucks and is really putting me off investing in bitcoin.

What is the point if some hacker can just come in under my nose and steal everything?

There is no security in bitcoin, it's ridiculous.

There is security in bitcoin, but it has to be YOU! Don't count on security by default...

I've been thinking and I've come to the conclusion that Satoshi and the dev team should have never released a bitcoin client for windows!!!

Then right now we'd all be a bunch of Linux geeks enjoying our geeky little currency and nobody would've had the opportunity to steal from us. Later on maybe once the security of the default client is vastly improved, then and only then release a windows version. Just my 2 cents.

Where is the security? One unencrypted desktop file compromised and, hey presto, your money is gone. This doesn't happen with internet banking.

Even a web client that you install to your own hosting would have been WAY better than a dumb desktop client.

And what if your server is compromised? Exactly.

Quote from: allinvain on June 27, 2011, 07:32:15 AM

Quote from: beeph on June 27, 2011, 06:44:40 AM

how about we add a few bits and let people do wallet locks? i think most of us at this time are hoarders who know bitcoisn will be worth 100,000$ per bitcoin one day

a wallet lock is something that only honest users would be interested in imho.. u can use a password to lock/unlock but not to send coins

the fact is.. yeah windows has exploits that pretty much allow hackers at anytime to own your system, they are in the wild before they're even patched and no windows box is ever totally secure at any given time.. a 0-day hacker can always rape yer bitcoinZ

But then the virus would have to just wait longer until you type your password. I favor a "secure keypad" that you input your password via mouse clicks. Next question is how to trick viruses that may take screenshots?

Screen flickering and/or hiding the numbers/letters when mousing over them (funnily enough Runescape uses a system like this for their bank PINs).

Quote from: chodpaba on June 27, 2011, 03:32:57 PM

-snip-

In which case you have to rely more on the security of the platform you are running it on. I actually think Windows can be secure, in principal if not in practice. Microsoft improved things greatly by giving their users an anti-virus solution that users could upgrade for free. Perhaps they finally observed that DRM was counter-productive to security because average users would not pay for it, just as they won't pay to upgrade their OS.

Linux does not have this problem, so has better use effectiveness of its security features. Users are more likely to keep it updated.

There have been proper free antivirus solutions for years. The problem is that the antivirus solution offered by Microsoft is really only a patch to something that should have been prevented before. They should have made a properly secured architecture for Windows from the very beginning. Look at it like this: Linux uses a condom, Microsoft relies on the morning-after pill.