EU moves to ensure software/hardware wallet providers protect customers

[Gozie51]

Barely a week ago, precisely on September 4th that Trezor and Bitbox warned customers of being at risk of data breach.
"The EU is telling cryptocurrency hardware and software wallet providers that they have 24 hours from awareness to report actively exploited bugs or severe security vulnerabilities affecting their products". I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

"On Wednesday, Trezor and BitBox warned users about phishing emails disguised as urgent security notices after suspected compromises involving third-party email services". This was around last week and they have levied huge fine to wallet providers who are negligent of warning customer's 24 hours from when they notice such breach from third party compromise. The fine could reach
$17 million. I think this will make such wallet providers to seat up and restrategize on their technology and security architecture to wade of phishing links or at most inform customers within 24 hours.

However, users should also do the needful to ensure that their wallet is also secured and avoid using third party gadgets to access their wallet.

https://cointelegraph.com/news/eu-cyber-rules-put-crypto-wallet-24-hour-reporting

[Accardo]

Not only the crypto niche is affected, the entire software and hardware industry, including video games, smart watches etc. This warning would help developers stay very serious about software security and updates, though unnoticed bugs are there to be exploited, $17million fine is enough to instill in the team the need to double their software security. However, this won't stop hacks, the government gets richer whenever a malicious attacker succeeds.

[Gozie51]

However, this won't stop hacks,

Surely we know that hacking is an old time business that will not stop but can be reduced through knowledge of how to get secured.

the government gets richer whenever a malicious attacker succeeds.

However, I believe hacking is perceived as one of the negative and illicit business to do because of its reputation. Although there are hacking companies that are made to follow the laws. So except such benefit to the government is in the area of fines when they don't follow the laws.

Well, hacking may be negative or positive benefit to government. Negative in the sense that it cuts down tax from hacked company which they would have paid to government. Also, positive in the area of fines when they are caught through forensic means, seizure of such assets etc.

[hd49728]

Barely a week ago, precisely on September 4th that Trezor and Bitbox warned customers of being at risk of data breach.
"The EU is telling cryptocurrency hardware and software wallet providers that they have 24 hours from awareness to report actively exploited bugs or severe security vulnerabilities affecting their products".

It's unrealistic task.

Security is a like a great wall, and any point of the great wall if broken can be exploited by hackers. More important, a safe wallet, a safe product today can become broken tomorrow, and it's very basic in security.

People say like "If the code works well, don't touch it" but we all know that wallets, sites, softwares all need upgrades which will bring new security risk each time.

I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

It's only a bullshit from EU parliament because they are either stupid in knowledge about security or know about security basics but only do that to play their game and show off like they are actually care about their citizens.

If there is no security bond, there is nothing to protect citizens and users of digital products.

[Gozie51]

I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

It's only a bullshit from EU parliament because they are either stupid in knowledge about security or know about security basics but only do that to play their game and show off like they are actually care about their citizens.

If there is no security bond, there is nothing to protect citizens and users of digital products.

I don't talk down on people or groups for what they are doing with honest intention to safeguard people. No ruse that nothing is perfect and no smoke without fire. But then, parliaments have ad-hoc committees and other committees that over see special duties and assignments because they are carefully selected as professionals in such fields. I believe legislation provides the guiding principles as laws that everyone look up to and contravention becomes punishable. So, it is there duty to make rules that organizations should work with.

[promise444c5]

But bugs doesn’t work that way.. yes, there are bugs/vulnerabilities that  are actively known and reported as issues , some could be critical, some can even be left unannounced if it doesn’t break anything serious. These can be easily reported but the major ones that eventually lead to hacks aren’t really that easy to find.

They get known mostly after exploitation or thorough review, which is different from how attacker with the skills of breaking things will go about it.  

What if.. they start going after the reports?

Let’s  even leave open-source out of this.. I bet closed-source wallets have a lot of magic going on in the background that can be easily exploited, this can even lead to more  potential risks..

Not sure why Trezor was mentioned but it was indirect, how are they supposed to know that a service didn’t honor an agreement and how would know  if the service is about to be hacked ?

[Woodie]

Am pretty sure the EU means well in this,  but unfortunately over regulation won't make this industry attractive for businesses to operate in because if such a vulnerability was discovered and not reported, it would mean hefty penalties..this already looks good for consumers but not the service providers!!!

Btw if this turns out to be successful,  then Bitcoin and other cryptocurrencies become part of the financial systems and could be bullish news in disguise.

One more thing, this vulnerability reporting task they are giving software/hardware developers,  what guarantee do they have that this epnt be used against them because such delicate info needs less third-parties handling it.