• shortwavesurfer
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    edit-2
    1 month ago

    Idiot. Why did they not run those searches over the tor network to anonymize themselves? That is quite frankly stupid. And the fact that the SEC was using SMS-based two-factor authentication is also stupid. One time pads or bust motherfuckers.

    • cacheson 💤@piefed.social
      link
      fedilink
      arrow-up
      8
      arrow-down
      2
      ·
      1 month ago

      One time pads or bust motherfuckers.

      Not sure if you’re being facetious, but one time pads are for encryption, not authentication. They’re also impractical (and overkill) for most purposes.

        • InverseParallax@lemmy.world
          link
          fedilink
          English
          arrow-up
          9
          ·
          1 month ago

          They’re actually not, they’re algorithmically derived state machines, most are public key hashes of secrets concatenated to the current time in seconds from the epoch.

          Ideally they would be otp, but that would also be obnoxious.

          • shortwavesurfer
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 month ago

            Oh, interesting. Okay. In that case, they are totally misusing the term.

            • InverseParallax@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              ·
              edit-2
              1 month ago

              Yeah, I think it’s because that’s where the model originated, and that’s basically what it’s supposed to be, but having almost everyone synchronized on time gives us a new trick because we can just generate ‘keys’ and have them expire, so even if you manage to get one by force, it’s only valid a short window. Instead of one time pad they often call them one time passwords.

              You need extended access to a generator over time to be able to use it, which gives the user a chance to report it for invalidation.

              Not perfect, but it does its job fine especially compared to passwords or sms (where you’re at the mercy of the minimum wage kid down at the mall’s Verizon kiosk).

        • cacheson 💤@piefed.social
          link
          fedilink
          arrow-up
          5
          ·
          1 month ago

          Ah, gotcha. Those are one-time passwords. Same acronym, so it’s easy to confuse them.

          But yeah, I agree that everything should use (T)OTP for two-factor authentication, instead of SMS messages. The later mainly provides a false sense of security and presents only a minor hurdle for attackers to overcome.

      • shortwavesurfer
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        2
        ·
        1 month ago

        Well then again, you expect government agencies to be secure? Yeah, not hardly.

  • pandapoo@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    1 month ago

    Oh my god, someone please tell me about understanding of the following facts are wrong:

    They did all of that, compromised a SEC employee and the official SEC Twitter account, to move the price of Bitcoin only around 2.2%.

    They could have just put sell orders in, and waited a month.

    Here’s the hourly BTC high and low prices for the day in question, Jan. 9th., 2024

    All that risk, just to bump the price up $1,000, when it was already trading between $45-47k.

    That is so dumb, so painfully dumb, that I almost feel bad about laughing my ass off about this. JFC.

    Just over a month later, it was back trading around 50k….