@MaxVernon what makes it tough to use? I've looked at those before

@Willtech I think maybe its related to the posts in this Reddit thread? web.archive.org/web/20170315033837/https://www.reddit.com/r/btc/…

Here is the paper, $30USD paywall though link.springer.com/chapter/10.1007%2F978-3-319-77935-5_11

Google Books is selling it for AU$61.77

@chytrik the tiles are quite tiny, and there is very little contrast between the letters and the background since the letters are simply stamped onto each stainless steel tile. It tool me about an hour to input my recovery seed.

→ 2 messages moved to Trash

I've been wondering if there is anything that can be done to help prevent scams like this: bitcoin.stackexchange.com/questions/74362/…

I've seen this scam a number of times here, it plays out like this:

I don't know about preventing them, but I think it would be worthwhile to have canonical, detailed answers for situations like "How can I get the private key for Address X"

And then close all of these as dupes

It's what we did for Android/Java on StackOverflow

This question for instance probably has over a thousand dupes

Scammer contacts victim through social media (Facebook messages), tells them they'll 'set up their account for mining'. Convinces victim to empty wallet, send login info, and then the scammer 'sets up their account for mining', when in reality they're just copying down the seed phrase and adding a watch-only address

Victim is then instructed to log back in, change passwords, and 'start mining'. Scammer sends some BTC to the watch only address, says its 'mining profits'. Instructs victim to deposit more BTC to the account in order to realize more profits. Once BTC is deposited, the scammer steals it away (using the seed phrase to recreate the wallet, bypassing any local login requirements)

@RaghavSood agreed, I don't expect there is anything that can be posted here as a proactive warning. Unfortunately victims will likely only seeks advice once they've started to realize something isn't right. I guess maybe a good canonical answer that hits keywords related to the scam could be found in google results though.

For prevention, I don't think there's much we can do except Google optimize like you said (although most people falling for these won't really be googling for it I suspect)

Just something like "If someone else asked you to set this up, read about common scams here"

Their wallet seems to be the goto for such things

why anyone would ever accept help from a stranger regarding money is a mystery to me. Would you trust someone with your debit card and PIN?

As for landmark answers, I've noticed several questions that could benefit from it (How to create P2SH-P2WPKH addresses, How to get private keys for watch only addresses, How to import keys into Electrum, How does Base58 work, How does bech32 work, How to create bech32 addresses, etc.)

Some people are just desperate for money/help tbh

I masquerade on reddit as devbitcoin and try to help less technical users recover coins sent to cross-chain addresses/wallets with forgotten passwords/partially missing seeds

You'd be surprised at how many people willingly hand over their keys if they get desperate enough

I always offer a guide on doing the recovery themselves first, along with any scripts they might need, so that they never share any keys

But the majority prefer that someone else does it for them

For instance, at the moment, I'm trying to help someone get >10k worth of LTC out of their ledger which was sent to the BTC address, which is normally pretty straightforward. Except, when he wrote the seed down, he wrote it down in a random order

So we're trying to bruteforce the seed by rearranging the first 12 words

Failing that, he's going to physically send me the ledger, and I'm going to try and write a ledger app to sign the tx for us if we can't get the seed

Crypto is mysterious and hard to use for a lot of people, so if someone shows up promising to help and make them money/get their stuck money back, a lot of people are willing to take the risk

@RaghavSood Yea, thats more along the lines of what I was thinking. I would guess they must be aware of these sort of scams, if we're seeing questions here often enough, they must be getting customer service emails about it.

I'm sure they are, but it's pretty hard to fight against these or inform people about it

I work at an exchange myself, and we've had people who get scammed in... creative ways

We try to send out emails with common scams, put them on our knowledge base etc., but most people don't look even if you email it directly to them with subjects like "Common scams to be aware of when using Bitcoin/Ethereum"

Though tbh I find blockchain.infos wallet and UI does not incentivize best practises in general (for example, reusing addresses is something a user could 'intuitively' do when using their wallet, while some other wallets do not present any option for this). Having clear warnings set around certain wallet functions would be great, but like you mention, scammers are inventive, and will probably find ways to work around them

I like MyEtherWallet's approach to it. They have very prominent warnings and descriptions of phishing/scams right when you open the site

That sounds like a good approach, I think its a balance of 'educating without presenting so much info that people won't even read it'.

I suspect a good way would be to display a very large warning like "Funds sent to this address will not be accessible in your wallet" when the user opens a watch-only address in blockchain.info

Cryptocurrency is like 'hardcore mode' in trying to create good, secure UX. Shortcomings can have dire consequences

Yup, but it's hard to strike that balance

MyEtherWallet made me crazy with all the warnings. And, how hard is it to understand "watch-only" means "you can't spend this money"?

A scammer could easily tell someone something like "Oh yeah, watch only means that it's being used for mining. Let me know when you want to withdraw and I'll stopping mining with it"

@MaxVernon I think that without explicitly highlighting that fact, the 'watch only' name is kinda lost in the general 'crypto jargon' new users are going to encounter. The scam I mentioned above isn't going to work on anyone with a reasonable knowledge of bitcoin/mining

@RaghavSood anyone with half a brain is never going to get someone to mine for them. Sorry if I sound obstinate, it just seems like designing for the lowest common denominator gets you Windows 8 or, god forbid, Windows ME.

@MaxVernon 'idiot proof' is a tall order for cryptocurrency security!

Falling for someone "mining for you" is exactly like asking someone to mine gold and give it to you. Who would do that?

@chytrik idiot proof is impossible, sadly.

The stupider you make something, the more stupid people will use it.

and I sound like a right nut job. sorry.

I'm old, and I like saying "get off my lawn", lol.

I agree that it's not the most sophisticated thing, but I do feel that companies can take steps to protect against some kinds of scams. It's impossible to protect everyone, but simply following the "Play stupid games, win stupid prizes" philosophy isn't good for the crypto-space as a whole

@RaghavSood I agree there are some things that can be done to make it less likely that newcomers will be scammed... but people really have to take care of themselves. Caveat Emptor, and all that.

a good multiple choice questionnaire at sign-up time might be a good way to gauge the skill level of a new customer. "What is a private key?" "a. Something I open my door with. B. Something I can use to sign a transaction"

A lot of users won't have the background knowledge for that (What does it mean to sign a transaction?), though. For people coming from non-technical backgrounds, crypto is basically black magic

@RaghavSood I agree... it was a really quick little lame attempt at an example.

@RaghavSood I think, if you can't get someone to understand how to use 2FA, then you shouldn't allow them to sign up.

I think maybe just a quick checkbox list like "No one has asked me to create this account", "I've read the list of common scams and am not being targetted", "I understand that crypto transactions are irreversible", would be more helpful

True, I think a big part of it is just educational. Users are used to having a fallback for when they mess up. Forgot your password? Email customer support... etc. Creative ways to educate (like a quiz) would only help I'm sure.

Oh yeah, definitely. When we enabled mandatory 2fa at the exchange the support ops team was flooded for over a month

And that's just plain totp 2fa, no fancy hardware tokens or yubikeys

@RaghavSood when I signed up for ETN a while back, they don't support 2FA, but they make it mandatory that you provide a second email address, for "security".

@RaghavSood yah, I was just thinking of TOTP.

I deal with a particular bank that enforces your bank sign-on password to be 6 characters. All upper case, and at least one number. No special characters allowed.

If a bank can get away with that in 2018, it's no wonder people get scammed in cryptoland.

wow, thats pretty bad. can't be more than 6?

nope

exactly 6

and all upper case, crikey

my.electroneum.com/register -> sign up with Facebook. SMH.

I think over the weekend I'll spend some time putting together detailed answers to common questions. Hopefully that will rank high enough on Google to save some people. Beyond that, I think some of this will get solved with time eventually as crypto becomes more mainstream, and companies take more steps to evolve against scams

A lot of companies in crypto got absolutely hosed by the huge demand last year, so they've barely been able to keep up day to day operations

link those answers in here so we can get them upvoted and linked-to

As things calm down and they scale, I think more will take steps to safeguard users

Will do

@RaghavSood I agree, as crypto goes more mainstream the general knowledge of how to stay safe will only increase. Though I do believe there will always be some portion of the population that does not care or want to learn how to fully manage their own keys/accounts

Well, people still get scammed in the regular banking system, and that's been around for ages, so I don't think you can ever save everyone

I can't help but think 'bitcoin banks' will be a necessity for some users, though certainly the ecosystem should be built in a way that always allows a user to 'be their own bank', should they so desire

It's one of my eventual goals to put together a more user friendly/lower cost of entry "Be your own bank" for most coins

Where a user controls their keys, but has support infrastructure to make day to day operations point and click

Sort of like Ledger/Trezor, but with more coins, and software based (with hardware support if desired), so that users can access it more easily

I've already started some work towards that. Working on a generic indexer right now which you can point at an RPC for most coins, and it will generaet a tx, address, and block index

@RaghavSood kudos on the devbitcoin subreddit btw, I'm sure your help is greatly appreciated by the users there. I'm not surprised to hear how eager some users are to share private keys, etc, even if that is a terrible idea in general (not to say you're not trustworthy, but you know what I mean :P)

Thank you! I always recommend that they try the recovery themselves first, sometimes they do. Even if I do it, I insist they reset the ledger/trezor/wallet (and send the coins back to the reset ledger's address as a confirmation that they have)

@RaghavSood Definitely good advice to burn the old wallet after recovery, even if you can be trusted, if your account or the reddit servers are compromised the data could be stolen from the message history

Yup, I don't store seeds, and I ask that people email them to me, preferably with PGP so that reddit isn't an attack vector (beyond hacking my account and misusing the trust established)

Flowcrypt has fortunately made PGP easy enough for most people to use

@RaghavSood I think its no secret a good solution there will be very valuable. Hardware wallets are great, but are still somewhat technical in their operation, and the price tag (while very fair) will still deter some people

@chytrik trezor. :-)

@chytrik I'd be very very reluctant to receive a private key from anyone. At some point in the future, after someone else scams them out of their money, they could claim it was you.

@MaxVernon I mean more of a custodial service though, a situation like "I can just sign up and they'll take care of all the security for me" (including a password longer than 6 digits XD)

I think Trezor and Ledger do a good job for people who are genuinely interested in the space, and I've seen more and more "average joes" using them. But they support a limited number of coins, and being completely hardware based means that rapid development isn't really an option (for instance, adding Monero to the Ledger has taken quite a while because it's structurally different from most coins, and Trezor only adds coins with Insight-API ports, which restricts them to Bitcoin-based coins)

A software-based solution that ties into hardware optionally, while still giving users control would be very beneficial

Something like Exodus on steroids

@chytrik oh I agree. I think over the next 6 months of so, we'll see some really good custodial options appear in the market. I think the 2nd half of 2018 is going to be truly amazing for BTC.

@MaxVernon It's definitely a risk. I've only had that happen once, and that was only because the guy had some omni-layer coins which weren't showing up on blockchain.info (they were still in his address, I didn't scam him lol. He just couldn't see them)

@MaxVernon Very true! I think that is a danger most people don't consider. Knowledge of a key makes you at least somewhat socially liable for those coins

But for most people, changing the seed to something that they know that I don't know is enough for them to be confident that they're safe from me

that message will self-destruct in 3..2..1

Ethereum and Ethereum classic are the exception to the Insight-rule

I have the original Trezor, Ledger Nano, and Ledger Nano S. I'm pretty happy with them, stick to a combination of those and paper wallets

@MaxVernon I agree, the crypto space is as exciting as ever. I'm very interested to see what sort of UIs are developed for LN apps. I think there is a lot of room to abstract the technical crap away from the UX, which will always be good for adoption.

@chytrik I've been thinking about running a lightning node, I just haven't had the time to really look at it.

@RaghavSood I have a 'cold card' on pre order, I'm excited to see how it compares to the others. Hopefully won't be too much longer until it ships

@RaghavSood Cryptosteel is the ultimate paper wallet, in my opinion.

it withstands fire up to 1200°C and flood, and even famine. Ok, just kidding about the famine.

I've been thinking about making my own cryptosteel at the uni mechanics shop

I love that it's open-source.

@chytrik Interesting, somehow missed that one. Might pick up one, thank you!

it seems like it would take a while to make all those tiles though.

We have an embossing machine that's manually cranked (so no digital cache of my seed) that I can use

Probably would go a lot faster than a hammer and block I suspect

wow, there are a lot of results that look identical on this page: duckduckgo.com/…

@RaghavSood sweeeet

@MaxVernon this is kinda paranoid, but one thing that stopped me from order one is the idea that the cryptosteel's customer list is a goldmine. Probably a large portion of their customers will have hardware wallets stored at home. I suppose its not too different from any other hardware wallet manufacturer though

@chytrik That's why I DIY :)

@chytrik that is a really good point.

@RaghavSood from Europe, no doubt!

Gonna delete that before people come to mug me

@RaghavSood yea, I came to the same conclusion.

Although, if they come all the way here for that, I might give them my wallet just for effort

Just the regular wallet, though :)

@RaghavSood that's why you need two (or more) wallets.

mmmm pretty colors

"I split my seed phrase into 3, and deposited each part into a safety deposit box of a major bank, on 3 different continents. Sorry Mr Home Invader, no private keys here"

@chytrik That's actually similar to how my seeds are stored right now, actually! I only moved to redacted in feb, so they're split up over my current location and my previous homes

@MaxVernon Yeah, I carry a plain wallet with just cards and $10, and second one with IDs and cash. Cards are easily cancelled, $10 is a fair price for not getting stabbed I'd say

I'm personally a big fan of staying alive

@RaghavSood I agree with that!

@RaghavSood easier said than done, for some people!

(Darwin Awards)