Hi,
It seems an attacker has gained access to a database backup that contained NWC connection secrets for Coinos accounts so I've gone ahead and invalidated all our NWC connections.
To create a new one you can visit this page https://coinos.io/apps/new and then use the "Copy NWC" or "Connect" buttons to re-link the new connection to your Nostr clients and apps.
Sorry for the inconvenience. I think I managed to contain and refund any accounts that had funds stolen but please reach out to support@coinos.io if you notice any unsolicited activity in your account.
Hacked again? Man coin os is one big honeypot!
the problem is NWC
why? how?
Why: convenience
How: convenience needs a hot key
Well, the problem is that someone hacked into coinos db. Not really a NWC specific thing! And I think there was a bug in the limit checking that excluded the tip and/or routing fees. Maybe a problem of centralization (becoming a honeypot) more than anything else.
I agree with that. But I think it's also fair to say that if we're taking root causes, the root cause here is an additional key liveness requirement for NWC on top of the set already required for LN. That subsequently there are no palatable p2p solutions for the less technical among us and thus everyone is using (unlicensed, uninsured) banks to centrally manage all the keys and moneys... is perhaps only a secondary problem.
Without NWC and without requiring automated invoicing, Zeus/Blixt with private channels, or simply Phoenix, works perfectly. That part is solved, but serverless, non-custodial connected wallets with auto-invoicing is not.
Quote from the lightning paper:
Due to requirement goalpost shifting (a category that the
Cof NWC definitely belongs to), and a failure to solve liveness well outside of a server environment, the well-implemented use case for non-custodial LN is currently smaller than the "automated" NWC use-case requires, but the same also goes for lnaddr / lnurl. Every time we run into issues, we bring back custodial bitcoin :-/Agreed.
I try to accept the world as it is and be optimistic about it (no pun intended xD).
Convenience is important to many. Also price stability.
I'm sure many of us here would be happy to be Uncle Jim service providers for friends and family. And a plebs lnbits node is not a juicy target, which would solve or mitigate this problem.
If we can't solve self custody, at least we could try and do better in decentralization.
Yes! Except if acceptance criteria aren't met, then there shall be no acceptance coming from me.
What I honestly wonder about though: are the acceptance criteria (for NWC / lnurl) right within LN constraints to begin with? Are they compatible with the baseline tradeoffs made for LN?
Bottom line, perhaps it all depends on whether you think Bitcoin should be for governments and mega corporations, or it should be for individuals too. To me, the "for individuals" part is the #2 acceptance criterium, after the promise that it "allow[s] online payments to be sent directly from one party to another without going through a financial institution", which is #1. I didn't walk this path to finally be enslaved / get rugged by banks ran by amateurs instead of professionals. As long as the individual-to-individual is enabled, all friction can probably be made bearable, scripted away - for me.
After all, the only place I connect a wallet is SN, and here I only do it to be environmentally responsible, as the sea levels will rise towards the point where on the Maldives you'll only have water villas and nothing else, through the addition of all the tears from stackers when they receive CCs.
CLINK would require no key DB
NWC key fumbling has always been a hot mess
The problem was storing secret keys in a wide open database (host 0.0.0.0) with no auth. Surprized this did not happen earlier. Secret keys are only needed once to generate NWC connection strings. After that, only public keys need to be stored on the server side. Sister wallet https://coinos.pro did not suffer this attack, but nevertheless wiped all the keys and patched this vulnerability.
NWC is so borked!
NWC is annoying. Any chance of implementing ~lightning payments via CLINK?
Thanks for the heads up. Just created a new NWC.
Everything seemed to be working and now I am getting this message when I go to coinos.io
Error 1106
Access denied
What happened?
The owner of this website (coinos.io) has banned your IP address
Can you send a message to support@coinos.io with your IP please and I'll see about unbanning you
Sent.
Thanks mate! They tried to take out sats from my coinos account, as long as the site was not loading I checked at my Nostr clients...and payments where showing as "pending" once u restored the site I saw that funds were back.
Second time today I have had to recreate the NWC connection for StackerNews and CoinOS.
Thanks for letting me know.
Obviously, this had to happen right now.
I’m barely getting started with all this stuff. Yesterday I was still trying to figure out who does what between Coinos, NWC, Alby, Stacker News and YakiHonne.
I’d managed to get everything connected. With a bit of help from AI, I was following the steps, sort of understanding what I was doing… well, “sort of.”
Let’s say I’d just moved into the apartment. I was starting to figure out where the table was, where the chair was, where the kitchen was.
And this morning, someone turns the lights off.
Ouch. Little toe, straight into that fucking coffee table.
“This NWC connection has been retired.”
So I had to create a new connection, reconnect Alby, check Coinos, figure out why my 50 sats were still there, why my Nostr identity hadn’t moved an inch, and what had actually broken.
And funny enough, that little mess taught me way more than yesterday’s setup did.
It made me think of people using AI to code when they don’t actually know how to code. As long as everything works, you can easily feel like you understand it. It’s when something breaks that you find out how much you really understood.
I’m still a long way from being any kind of Lightning or NWC expert.
But at least today, I’ve got a slightly better idea where the table and the chair are.
Thanks for the crash course. Timing was perfect.