Re: Bitfi wallet - most user-friendly functionality, does not store private keys
The real drive is we don't want newbies who don't know any better to be ripped off by buying a glorified brain wallet and end up losing all their hard earned bitcoin.
The only reason the bounty wasn't awarded is because Bitfi kept changing the goal posts and then cancelling it all together so they didn't have to pay out. The conditions were met several times by different people. They managed to extract the seed in plain text from the device, meaning all coins can be instantly stolen. Bitfi's claim was their wallet was "unhackable". I'm pretty sure extracting the seed counts as being hacked.
Even forgetting how horribly insecure their device is, even forgetting it had been hacked wide open multiple times, even forgetting the seed is extractable, even forgetting you can gain root access and install custom firmware; even forgetting all that, at the end of the day, it's still a brain wallet. Brain wallets are even worse than web wallets on the scale of "good security".
Buy one if you want, but realise that your funds are at constant risk of being stolen, and there is literally nothing it does that cannot be achieved more securely and for free with some freely available and open source software.
The only reason the bounty wasn't awarded is because Bitfi kept changing the goal posts and then cancelling it all together so they didn't have to pay out. The conditions were met several times by different people. They managed to extract the seed in plain text from the device, meaning all coins can be instantly stolen. Bitfi's claim was their wallet was "unhackable". I'm pretty sure extracting the seed counts as being hacked.
Even forgetting how horribly insecure their device is, even forgetting it had been hacked wide open multiple times, even forgetting the seed is extractable, even forgetting you can gain root access and install custom firmware; even forgetting all that, at the end of the day, it's still a brain wallet. Brain wallets are even worse than web wallets on the scale of "good security".
Buy one if you want, but realise that your funds are at constant risk of being stolen, and there is literally nothing it does that cannot be achieved more securely and for free with some freely available and open source software.
I´m not sure if I agree with you 100%, you focusing to much on the bounty IMO
The hackers were able to hack into the firmware, modified the whole device and only then do a transaction and tracing the seed out of the RAM as long as it was there in using a security whole in the device.
Am I wrong with that? They did not get into anything that already was on the device, didn´t do a withdrawl of the original transfered coins.
To me this is totally fine with the bounty rules. If they said, buy a new one, load it up with your coins yourself and try to hack it, that would be a different story, then they would have
lost the bounty.
Is it OK to not reward the bounty hackers with something after there experts didn´t find that RAM problem themself and actually produce the first Bitfi? Or did they find out themself???
I think rewards should get paid out if it can be proven. There was something paid so don´t know for what and if that front is cleared or not, lost overview with that
So as I said before, we have 2 parties who are not 100% right or wrong. Doesn´t Bitfi have the right to correct themself even if they had a big mouth?
- I´m with you that a security device at first should not be hackable that easy and get root-access on top of that -- is this fixed? I don´t think so, is it feasible at all? I don´t know!
- Nothing in the device should store anything from a past transaction -- that was fixed, can anybody prove it is not so? That would solve the most important big problem IMO
- The Dashboard did not detect that the device was modified -- is a fix feasible? I don´t know, but this is a problem every device has and SURELY I WANT THEM ALL TO FIX THAT.
If your device can´t be 100% secured from a root-hack, your software/portal/dashboard, whatever !!! HAS TO DETECT THAT AND WORN YOU THAT THE DEVICE WAS COMPROMISED !!!
I don´t care how they do it but without that safety of our funds are at risk. You know how I shit myself when Komodo had their problem with the Agama Wallet? I sick of all that nonsense.
If I can´t be 100% sure that my device is 100% as the manufacturer produced it how secure can I feel then?