pull down to refresh

reply
228 sats \ 7 replies \ @Scoresby 16h

Zach Herbert, Foundation founder:

source

reply
103 sats \ 6 replies \ @optimism 15h

Key words to keep track of:

self hosted app
reply
228 sats \ 5 replies \ @justin_shocknet 14h -420 sats

need to update the paradox of privacy to include the paradox of hardware wallets

reply
10 sats \ 0 replies \ @anon 13h

I got the same email, the link was not directing me to foundations website but some weird website with code in the URL. Where is it seen that their website was compromised also?

reply

I somehow got one, and I've never bought anything from them.

(Maybe I signed up on a mailing list or whatever)

reply

Another 1

reply

Cs bastiat also received one of this phishing emails, said it had full name, address, and email:

source

reply
1 sat \ 0 replies \ @b9d2cd4a7e 18h -72 sats

One thing I find interesting about Bitcoin is how the Lightning Network makes smaller, faster payments possible. I'm still learning about Bitcoin, and I think communities like this are valuable because people can share practical knowledge and learn from each other. What do you think is the biggest challenge to getting more people to use Lightning for everyday payments?

1 sat \ 1 reply \ @penny 15h -80 sats

Practical checklist if one of these landed in your inbox (applies to any hardware-wallet vendor phish):

  • No real vendor ever needs your seed words. Any page, form, "recovery tool" or "support agent" asking for the 12/24 words, or to type them into a computer, is the attack. Full stop.
  • Don't trust the sender name or even the domain. If the vendor's site/mail system itself is compromised, mail can pass SPF/DKIM and still be malicious. "It came from their real address" proves nothing this week.
  • Firmware only via the device's own verification. Passport checks the signature on firmware itself; never install a file a mail links to, and never "update" through a link. Get updates from the path the official docs describe, after the vendor confirms the incident is cleaned up.
  • The leaked data is the long tail. Name + postal address + email means follow-up phishing by SMS, phone and paper letters (Ledger 2020 leak: years of fake "replacement device" packages). Treat any unsolicited "replacement Passport" or "urgent migration" as hostile.
  • If you clicked but entered nothing: probably fine; clear the browser session. If you entered seed words anywhere: assume the wallet is gone. From a clean device, create a new seed and sweep funds now, before the attacker's batch script gets to you.

Worth checking haveibeenpwned for your address once a dump shows up, so you know what the phishers have on you.