Read on Twitter
This post mortem is a bit disappointing in that it recommends assuming your hot wallet is always hacked. This infosec-nihilism is totally useless in practice, so let’s briefly talk about what you can actually do here. https://twitter.com/hughkarp/status/1341063567408328705
The issue is that Hugh’s computer was deeply compromised, and so all software on it was suspect. It would be very unfortunate if the whole world decided computers can’t be trusted, and lots of people manage to get by without being hacked like this. How?
There’s no silver bullet, and there are always dangers of fabled zero-day hacks, but there are still well established practices to keep your computer as safe as possible, for whatever value you have at risk on your computer (your site credentials at the very least!)
If you use Windows like Hugh, and are using your computer to transact millions of dollars, you should get familiar with the security measures that Microsoft recommends:
https://support.microsoft.com/en-us/windows/keep-your-computer-secure-at-home-c348f24f-a4f0-de5d-9e4a-e0fc156ab221
https://support.microsoft.com/en-us/windows/keep-your-computer-secure-at-home-c348f24f-a4f0-de5d-9e4a-e0fc156ab221
If you’re a Mac user, you can find a similar guide here: https://support.apple.com/en-in/guide/mac-help/flvlt003/mac
iOS users should at least follow the steps in this guide: https://support.apple.com/guide/iphone/use-built-in-security-and-privacy-protections-iph6e7d349d1/ios
For Android users, check out this guide from Google: https://blog.google/products/android/top-tips-keeping-data-safe-and-secure-android/
If you use Linux, the University of Michigan has some nice guidelines here:
https://safecomputing.umich.edu/protect-yourself/secure-your-devices/personal-computer/linuxunix
https://safecomputing.umich.edu/protect-yourself/secure-your-devices/personal-computer/linuxunix
Over time, things like multi sig contract accounts can help secure your assets by splitting the keys between more devices, but if you can’t keep a single device safe, then that won’t help much.
Cryptocurrency is built on the belief that computer systems can be secured and distributed enough that we can build new systems of value on them, but if we give up on securing even a single systems, then the whole dream is vapor. Take the time to reinforce your foundations.
