from Hacker News

Casa Client Case Study: The Tinder Trap

by bdickason on 7/9/21, 1:50 PM with 197 comments

• by vishnugupta on 7/9/21, 2:37 PM

  I've been working in the payments industry on and off for 15 years. I am yet to work with a payment method that does not support reversal (except for physical cash). As a last resort victims can file chargeback with their issuers or police.

  To begin with there are several layers of protection built in at acquirer, issuer, network and so on. Almost at each step there's an option to reverse the payment (or issue a compensating transaction) and finally the chargeback and legal recourse.

  Bear in mind that each of the business process of the current payment systems exists for a reason. They are the result of decades of learnings and trial and error.

  Are there plans to build equivalent features on Blockchain for crypto currencies? Or do their users have to go through the same painful failures?

• by polote on 7/9/21, 2:17 PM

  Honestly I wouldn't put too much trust into a SEO blog article.

  A better title would be. "If you get drugged and use Casa, you will be able to save your money"

• by asdfasgasdgasdg on 7/9/21, 2:26 PM

  If the money were in a bank or investment account, the worst this guy would have to deal with (in the US) is a little aggravation when getting the fraudulent transactions reversed. Personally I wouldn't reveal to strangers that I'm into crypto. It's like broadcasting the fact that you've got thousands of dollars of cash in your pocket.

• by lordnacho on 7/9/21, 2:22 PM

  But if you don't have the keys to move your money, it becomes a lot less useful as money. It's still like gold though, something that you have a sort of vault that you rarely visit.

  If you got drugged and someone took your phone to do a bank transfer, I would imagine there would be some hope of reversing the transfer, with a whole lot of painful steps. With crypto it's pretty futile if they manage to move it.

  Also the $5 wrench attack can evolve, right? Just because you have your keys in different places doesn't mean you can be coerced into getting them together.

• by deregulateMed on 7/9/21, 2:16 PM

  This is one of my biggest fears.

  As a result I use the supposedly not ok, security by obsecurity. (Along with other normal precautions)

  I don't tell people which Bitcoin wallet I recommend, I simply say "I don't tell people where I hide gold".

  Although not sure if I could survive devil's breath.

• by BitwiseFool on 7/9/21, 2:25 PM

  "Not your keys, not your Crypto" is good advice, but I personally prefer to leave my wallet in the hands of a trusted large exchange like Gemini, Coinbase, or Kraken. Not only do they have better security than I do, they also have a whole slew of extra barriers in the event a malicious actor wants to drain my funds.

  I can freeze withdrawals, whitelist specific addresses, and put time/wait barriers to all of these things.

  Edit: I'm not recommending everyone do this. This is a personal risk-management calculation I have made based on my outlook.

• by abstractbarista on 7/9/21, 2:20 PM

  While the article seems part-advertisement, the risk is real. Best not to let strangers know your worth, and use multi-factor authentication everywhere. It's a disgusting (and beautiful) world we live in!

• by mabbo on 7/9/21, 2:52 PM

  Cryptocurrencies offer a single property that is both good and bad: there is no authority who can reverse or block a transaction against the will of the participants.

  Lawsuits and criminal proceedings can cause government authority to direct banks and financial institutions to do what they say. Government can set rules to block transactions, or to demand more identification to be tied to a transaction. Even cash can be physically seized and taken by the government. I'm not arguing this is good or bad, just that it is. You can come up with a list of circumstances where this authority is a bad thing, or a good thing.

  And in cases like this, we see why that overriding authority can be a good thing. If your bitcoins are stolen, there is nothing anyone can do to get them back. They are gone.

• by heynk on 7/9/21, 2:55 PM

  You might be interested in this "database" of wrench attacks. It's maintained by the same author of this article (Jameson Lopp).

  https://github.com/jlopp/physical-bitcoin-attacks/blob/maste...

• by arbuge on 7/9/21, 2:19 PM

  Related (though no Tinder involvement in this one):

  https://timesofmalta.com/articles/view/victim-describes-his-...

• by klenwell on 7/9/21, 2:37 PM

  This Simpsons joke was funny in the 90s because of its absurdity:

  https://www.youtube.com/watch?v=70ZMzE-wQOQ&t=80s

  Now it's funny because it's true!

  Download to Papa. Yoink-dot-adios-backslash-losers.

• by dannyw on 7/9/21, 3:04 PM

  This is such an interesting account. I wonder to what scale this happens.

  Surely after you get roofied after a tinder date with an attacker draining your crypto accounts, you'd file a police report and maybe we'd hear about it in the media?

• by bpsh on 7/9/21, 3:18 PM

  Sounds like a made up story for the purpose of self promotion to me

• by akarma on 7/9/21, 2:51 PM

  > If a stranger mentions being into crypto but then does not actually seem to know much about it, consider that they may simply be fishing for a specific type of victim.

  Or, more likely, they're just trying to impress you and find common ground! I've seen this many times on dating apps but have never been drugged.

  A lot of this advice is great, regardless of whether you're into crypto, but this point is a bit much.

• by analyst74 on 7/9/21, 3:15 PM

  unrelated, but this basically describes a large number (possibly majority) of tinder profiles.

  > Compare the person's profile photo when you meet them in real life. If it is questionable that the photos are actually of themselves, that is a red flag.

• by break_the_bank on 7/9/21, 2:26 PM

  Was wondering how vulnerable my traditional bank accounts are to this attack. I’m assuming this is one of those times that a daily limit could be useful, though that can also be bypassed to some extent by phone banking.

• by m3kw9 on 7/9/21, 3:25 PM

  Couldn’t Coinbase just add a hardware key to match this feature? It still doesn’t prevent internal theft but it will protect such fishing cases.

• by etc-hosts on 7/9/21, 3:38 PM

  It is funny that a man so obsessed with privacy, anonymity and his physical security still uses online dating apps.

  https://www.nytimes.com/2019/03/12/technology/how-to-disappe...