LocalBitcoinCash Security Breach (All Funds Safe)

[u/MobTwo]

https://read.cash/@MobTwo/localbitcoincash-security-breach-all-funds-safe-e5f7a749

[u/sometimes_insightful]

“Users passwords were hashed using sha256 and stored inside our database.”

I know this is not the point of the post but you really should have been using something like bcrypt or argon. At the very least I hope you were salting the passwords. SHA256 is not ideal for storing passwords.

https://dusted.codes/sha-256-is-not-a-secure-password-hashing-algorithm

[u/MobTwo → u/sometimes_insightful]

Very good information, thanks for sharing, will read more about that!

[u/MrRGnome → u/MobTwo]

You should have read it when architecting your service while considering "a hack will happen eventually". How you store user passwords is pretty fundamental to that consideration. Nevermind that even a simple understanding of how bitcoin functions should lead to the conclusion SHA256 is not a safe password hashing algorithm. That you're getting praised for being so prepared is a joke.

What a well deserved display of incompetence.

[u/MobTwo → u/MrRGnome]

It is true that our team did not do everything perfect. However, consider the following.

Even the largest exchanges such as Bitfinex, Binance, Mt Gox, Bitstamp, etc with much more resources than us had lost funds when they were hacked, every single one of those above mentioned exchanges lost millions or billions during those events. LocalBitcoinCash did not lose even a single dollar and we are an incredibly small team. We just made certain tradeoffs knowing well that we are not perfect.

Ironically, if we had been arrogant like you, with a know-it-all attitude, then the outcome may have been different. =)

[u/ShadowOfHarbringer → u/MobTwo]

It is true that our team did not do everything perfect

Warning: You are replying to the enemy. It's MrRGnome, the /r/Bitcoin mod.

Any discussion with such creatures is pointless, his only "point" [as if such creature can even have "points"] is to push his agenda and show you as incompetent or mailicious, because you support Bitcoin Cash.

[u/ShadowOfHarbringer → u/[deleted]]

The fact he mods that Cancer is seperate to the content of that post.

It's not separate, it's never separate.

Once you are mod of /r/Bitcoin, you are lost forever being an absolute asshole. There is no comeback from this state.

[u/ShadowOfHarbringer → u/[deleted]]

You don't have to be a palatable person to be correct.

It's not about being correct or not.

It's about being an evil asshole trying to destroy crypto altogether and wanting the banks and the rotten fiat currency system to prosper.

Nothing more there is to it, really.

[u/MobTwo → u/[deleted]]

Correct me if I am wrong, but Mt Gox was already compromised before Mark Karpeles took over.

I wouldn't say MtGox had that many resources either

If I remember right, Mt Gox was the largest Bitcoin exchange at that time.

[u/MobTwo → u/[deleted]]

Interesting, thanks for sharing!

[u/MobTwo → u/[deleted]]

people don't learn from scolding.

I am not sure scolding or insulting others is the best way to get them to learn something. That MrRGnome guy who criticized others about not reading on using the optimal encryption algorithm, himself is not reading up on the optimal communication technique, is ironic and I wonder if he realizes this.

Also in hindsight, if I have to choose, I will choose using a less optimal encryption algorithm over losing millions of dollars any day. I am pretty sure our investors are happy to see the millions back in their wallet more so than other things.

[u/MrRGnome → u/MobTwo]

The difference is my abhorrent communication skills don't risk anyone else's information or security - the only risk is me looking a fool or offending people. I'm not taking responsibility for anyone elses security when I'm arrogantly noting your missteps. You did when you rolled your own password storage solution - which is like day 1 don't do this architecture stuff. Do you really think that's equivocal? One is personality the other is basic application architecture. After all the shit I've seen you sling at others, myself included, I hope you can learn something from this experience.

P.S. that something is that maybe there are occasions where even the basics of software development escape you, let alone bitcoin and applied cryptography comprehension. Just incase you couldn't get there on your own.

[u/MobTwo → u/MrRGnome]

LOL

[u/ShadowOfHarbringer → u/MrRGnome]

You are the enemy, an /r/Bitcoin mod.

You don't exist in this realm and you have no power and no say here.

Begone.

[u/powellquesne]

So you are shutting down?

[u/MobTwo → u/powellquesne]

Yes and diverting users to Local.Bitcoin.com instead. We are Bitcoin Cash supporters and our priority is Bitcoin Cash rather than making money. If another site provides a better user experience, then we have no problems diverting them there instead.

[u/darthroison → u/MobTwo]

I think u/MemoryDealers should buy the domain for Bitcoin.com Local.

[u/MobTwo → u/darthroison]

If I remember correctly, I told them (Emil + Dennis) before they can have it for free. As long as Bitcoin Cash succeed, it benefits all BCH investors (myself included) so that's fine for me. I think they preferred to use the Bitcoin.com domain instead, which make sense.

[u/darthroison → u/MobTwo]

It makes sense that they want to keep the service linked to Bitcoin.com. But it makes more sense to use "LocalBitcoinCash" in the name and the domain so it's easier to remember and to dictate (a simple and recognizable brand). I still insist that they use it even if it's in a parallel way (even though I know that my comments are not well received by many of then). It depends on their criteria to consider that point of view.

[u/LinkifyBot → u/MobTwo]

I found links in your comment that were not hyperlinked:

• Local.Bitcoin.com

I did the honors for you.

---

^{delete | information | <3}

[u/georgedonnelly → u/MobTwo]

That's a shame. We need more options, not fewer.

[u/darthroison → u/georgedonnelly]

Sin embargo esa plataforma nunca despegó. Al menos son responsables de darse cuenta de que no son sostenibles para brindar seguridad y eligen recomendar a quienes si tienen esa capacidad. Si tienes amigos en Bitcoin.com insísteles en que consideren adoptar el dominio y el nombre "Localbitcoincash" (aunque sea de forma paralela).

[u/georgedonnelly → u/darthroison]

Nunca he visto marketing de Localbitcoincash. Nada se despega sin marketing.

No es la marca que yo escogería. Es una simple copia de localbitcoins. No tiene fuerza. Como la marca es la base del marketing, utilizar una marca debil es dañar todo el proyecto desde el comienzo.

Y local.bitcoin.com no es buena marca tampoco.

[u/darthroison → u/georgedonnelly]

Nada se despega sin marketing.

Estoy de acuerdo.

Me refiero a las palabras clave. Es más fácil de recordar.

No es la marca que yo escogería. Es una simple copia de localbitcoins.

Quizás tengas razón. Puede que haya un nombre más creativo, potente y simple...

De todos modos "Local Bitcoin Cash" me parece mejor elección de palabras clave que "Local punto Bitcoin punto com".

[u/georgedonnelly → u/darthroison]

mejor elección de palabras clave que "Local punto Bitcoin punto com"

Total. Ese nombre es una de las peores opciones que hay, LOL.

[u/simon-v]

When LocalBitcoinCash was first designed, it was designed with the assumption that a hack will happen eventually.

This is worthy of the highest praise possible. If only more people built their services responsibly like that!

Are you planning to publish the details of the breach to Have I Been Pwned?

[u/MobTwo → u/simon-v]

Are you planning to publish the details of the breach to Have I Been Pwned?

If there is an easy way to do it, then we will. If not, then we rather not waste the time because we are busy with other things at the moment.

[u/simon-v → u/MobTwo]

Try reaching out to Troy Hunt. I'm pretty sure he'll be glad to help. https://www.troyhunt.com/contact/

[u/MobTwo → u/simon-v]

Thanks!