Avatar
Niall Young
234dd2c21135830a960a462defdb410ac26f178cbf8e13fbe43890f8656ee983
Software Engineer; Sceptical Scientist; Bitcoin Maximalist; Carnivore; Suspicious0bserver; Freedom Patriot. Protected Political Speech. goNDK #golang

is such a thing even possible

We're still investigating what happened here. It seems a handful of accounts may have been compromised and had their autowithdrawal settings tampered with, including our own "coinos@coinos.io" account.

We ran a script to search for accounts that had the attacker's "speed.app" withdrawal address in place and found about 9 that seem to have been affected. There could be more though, we will update as we have more information.

I worry that this may be the same attacker who exploited a password reset vulnerability back in January which allowed them to gain access to a number of accounts. It's possible that since that time they have been sitting on the account data and working to brute force the encrypted nostr private keys that we had on file for some accounts that had imported their nostr key into Coinos. Those keys were encrypted at rest in our database but it's possible they may have been cracked.

We no longer store nostr private keys for accounts and have since added support for external signing apps and browser extension login, but there was a time when we were storing encrypted nsec private keys.

Having a users nsec would allow an attacker to authenticate into Coinos by signing a nostr event and change the user settings. It also means your entire nostr profile and identity may be compromised.

This is only a hypothesis at this point and we need to investigate further but we may end up recommending that affected users rotate their nostr keys.

nostr:nevent1qvzqqqqqqypzpggzvz325tcf9kz79s9c9627430ccc82r8rgujycwxd43n92y037qy88wumn8ghj7mn0wvhxcmmv9uq32amnwvaz7tmjv4kxz7fwv3sk6atn9e5k7tcqyrdx8njpnvvulfcsqqd7ud47uw6dnzl4a3fmsrafsp0rte9f29h5uxpgg73

#NYKNYC-OS

grinding at the coal-face

in multiple dimensions

solo work is so liberating

hand crafted code

Zelensky a dead man walking?

Assassination and one final hypersonic strike in 3, 2, … 🤷‍♂️

nice work man, clean well structured code 🙇‍♂️

main is awfully large and untestable - recommend delegating it all to another abstraction, make main minimal and focused on runtime/config concerns 👍

have you had any thoughts how to approach testing all wait/sync/gofunc core 🫨 I haven’t yet 😔 circled back yet to relays but will join you soon hopefully, focused on platform and revenue first then 😁