Hacker News new | past | comments | ask | show | jobs | submit login

What if an attacker covertly steals the victim's secret key/credential and then deletes it from the victim's device?

Maybe the victim thinks they accidentally deleted the key or whatever ("oops, my hard drive failed"). The victim then goes to recover their account, thinking that there will be no problem because nobody can possibly challenge them. Then the attacker denies their claim and doubles their winnings!

What makes this especially bad is that the victim's second loss is likely to affect them more than their first loss. Most people aren't going to put their retirement savings or paycheck in Bitcoin - it's more likely to be discretionary income that isn't going to kill them if they lose it. The escrow money is less likely to be discretionary income - it'll be real money, not funny money that has been sitting in their Bitcoin wallet for 5 years.

So now the victim is in a really bad position and the attacker has significant leverage over them. "Hey victim, I'll give you your life savings back if you do insert_illegal_thing_here for me."




The escrow amount wouldn't be the same as the amount in the original account, it'd be a token amount.


Plenty of comments now describing the fallout of token amounts.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: