EU moves to ensure software/hardware wallet providers protect customers

[Gozie51]

Barely a week ago, precisely on September 4th that Trezor and Bitbox warned customers of being at risk of data breach.
"The EU is telling cryptocurrency hardware and software wallet providers that they have 24 hours from awareness to report actively exploited bugs or severe security vulnerabilities affecting their products". I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

"On Wednesday, Trezor and BitBox warned users about phishing emails disguised as urgent security notices after suspected compromises involving third-party email services". This was around last week and they have levied huge fine to wallet providers who are negligent of warning customer's 24 hours from when they notice such breach from third party compromise. The fine could reach
$17 million. I think this will make such wallet providers to seat up and restrategize on their technology and security architecture to wade of phishing links or at most inform customers within 24 hours.

However, users should also do the needful to ensure that their wallet is also secured and avoid using third party gadgets to access their wallet.

https://cointelegraph.com/news/eu-cyber-rules-put-crypto-wallet-24-hour-reporting

[Accardo]

Not only the crypto niche is affected, the entire software and hardware industry, including video games, smart watches etc. This warning would help developers stay very serious about software security and updates, though unnoticed bugs are there to be exploited, $17million fine is enough to instill in the team the need to double their software security. However, this won't stop hacks, the government gets richer whenever a malicious attacker succeeds.

[Gozie51]

However, this won't stop hacks,

Surely we know that hacking is an old time business that will not stop but can be reduced through knowledge of how to get secured.

the government gets richer whenever a malicious attacker succeeds.

However, I believe hacking is perceived as one of the negative and illicit business to do because of its reputation. Although there are hacking companies that are made to follow the laws. So except such benefit to the government is in the area of fines when they don't follow the laws.

Well, hacking may be negative or positive benefit to government. Negative in the sense that it cuts down tax from hacked company which they would have paid to government. Also, positive in the area of fines when they are caught through forensic means, seizure of such assets etc.

[hd49728]

Barely a week ago, precisely on September 4th that Trezor and Bitbox warned customers of being at risk of data breach.
"The EU is telling cryptocurrency hardware and software wallet providers that they have 24 hours from awareness to report actively exploited bugs or severe security vulnerabilities affecting their products".

It's unrealistic task.

Security is a like a great wall, and any point of the great wall if broken can be exploited by hackers. More important, a safe wallet, a safe product today can become broken tomorrow, and it's very basic in security.

People say like "If the code works well, don't touch it" but we all know that wallets, sites, softwares all need upgrades which will bring new security risk each time.

I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

It's only a bullshit from EU parliament because they are either stupid in knowledge about security or know about security basics but only do that to play their game and show off like they are actually care about their citizens.

If there is no security bond, there is nothing to protect citizens and users of digital products.

[Gozie51]

I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

It's only a bullshit from EU parliament because they are either stupid in knowledge about security or know about security basics but only do that to play their game and show off like they are actually care about their citizens.

If there is no security bond, there is nothing to protect citizens and users of digital products.

I don't talk down on people or groups for what they are doing with honest intention to safeguard people. No ruse that nothing is perfect and no smoke without fire. But then, parliaments have ad-hoc committees and other committees that over see special duties and assignments because they are carefully selected as professionals in such fields. I believe legislation provides the guiding principles as laws that everyone look up to and contravention becomes punishable. So, it is there duty to make rules that organizations should work with.

[promise444c5]

But bugs doesn’t work that way.. yes, there are bugs/vulnerabilities that  are actively known and reported as issues , some could be critical, some can even be left unannounced if it doesn’t break anything serious. These can be easily reported but the major ones that eventually lead to hacks aren’t really that easy to find.

They get known mostly after exploitation or thorough review, which is different from how attacker with the skills of breaking things will go about it.  

What if.. they start going after the reports?

Let’s  even leave open-source out of this.. I bet closed-source wallets have a lot of magic going on in the background that can be easily exploited, this can even lead to more  potential risks..

Not sure why Trezor was mentioned but it was indirect, how are they supposed to know that a service didn’t honor an agreement and how would know  if the service is about to be hacked ?

[Woodie]

Am pretty sure the EU means well in this,  but unfortunately over regulation won't make this industry attractive for businesses to operate in because if such a vulnerability was discovered and not reported, it would mean hefty penalties..this already looks good for consumers but not the service providers!!!

Btw if this turns out to be successful,  then Bitcoin and other cryptocurrencies become part of the financial systems and could be bullish news in disguise.

One more thing, this vulnerability reporting task they are giving software/hardware developers,  what guarantee do they have that this epnt be used against them because such delicate info needs less third-parties handling it.

[Fiatless]

Am pretty sure the EU means well in this,  but unfortunately over regulation won't make this industry attractive for businesses to operate in because if such a vulnerability was discovered and not reported, it would mean hefty penalties..this already looks good for consumers but not the service providers!!!

Btw if this turns out to be successful,  then Bitcoin and other cryptocurrencies become part of the financial systems and could be bullish news in disguise.

One more thing, this vulnerability reporting task they are giving software/hardware developers,  what guarantee do they have that this epnt be used against them because such delicate info needs less third-parties handling it.

Unreported vulnerabilities could cause more harm to users. Some of these platforms wouldn't want to report these issues not because they are not aware of their negative impact but because they want to protect their image or reputation. I have been a victim of delays in reporting security breaches at an exchange. And so many people lost money not just in the affected crypto exchange but in others since they used the same passwords and emails.

Any platform can suffer from attacks, and reporting it doesn't mean that the platform is not taking security seriously. With the development of artificial intelligence, attacks will keep increasing.

[Perfectbaby]

There are people who are not security experts but they try as much as possible to make sure that they are secured, tho just as you said we should be that careful on the public network we should be that using especially those that are LAN cables which are even more deadly than those who are public WiFi because some of the LAN are being used to access the next person information and if that settings aren’t blocked they could use it to access your personal information through the LAN network but I am not that sure of WiFi as it’s a bit more protected than the LAN network.

[Alphakilo]

But bugs doesn’t work that way.. yes, there are bugs/vulnerabilities that  are actively known and reported as issues , some could be critical, some can even be left unannounced if it doesn’t break anything serious. These can be easily reported but the major ones that eventually lead to hacks aren’t really that easy to find.

They get known mostly after exploitation or thorough review, which is different from how attacker with the skills of breaking things will go about it.  

What if.. they start going after the reports?

Let’s  even leave open-source out of this.. I bet closed-source wallets have a lot of magic going on in the background that can be easily exploited, this can even lead to more  potential risks..

Not sure why Trezor was mentioned but it was indirect, how are they supposed to know that a service didn’t honor an agreement and how would know  if the service is about to be hacked ?

This tells one thing, and that is, all CEX is monitored by the government hence why there's so much regulatory policies guiding them.
I don't think the EU is wrong in this approach of trying to ensure stricter rules, because good image is good for business and that means many of these CEX try to look good while hiding beneath the pain and cost of having struggling developers working on fixing an already noticed hack or bug without wanting to tell their customers in time, because they think to want to avoid panic and loss of business due to loss of customers.

As users, we are to be very vigilant and cautious mostly when it concerns new emails from the services provider we use. We must verify them, we must realize that we expose our data that can be used against us when we want to buy hardware from a company and should try to learn to use false identity. It's also a big 'no' when it comes to keeping or using your seed phrases online mostly when it's demanded by most of these emails that look suspicious.

[jossiel]

The move is showing how concerned they are for the people's asset. But IMO, there are some things they have to consider about this.

How they're going to give that report and through? through email, website, social accounts, etc.

And if it's with email, I think that it even entails more potential risk since phishing emails have been rampant targeting their users.

What these hackers only have to do is to make their email design more professional and better. Raising awareness is fine but I think that there could be any other better way for this.

[BitMaxz]

Is the $17 million a sanction? But what are they going to do with the $17 million? It looks like a corruption to me asking for a penalty due to informing customers about security breach and avoid such phishing emails.

That is why I also don't trust most of the hardware wallets out there. Even if it is open-source code, having a cold storage wallet is way better because you can DIY it and it is much safer if you stick with known oldest wallet exist.

Now, since most of the news nowadays talks about hardware wallet breaches, how will people trust hardware wallets?
I'm sure most of the users will likely move their assets to exchanges if it happens; even if they don't have full control of their assets, at least they put their assets in local and legal exchanges. Which is actually much riskier than moving your funds in much safer place like cold storage but the problem is not all assets are supported.

I think manual generation of a seed phrase through Dice and adding a passphrase in your own is much safer to use before importing it to a hardware wallet than using the seed generated from the hardware wallet.

Remember how smart hackers are nowadays? We should also evolve to protect our assets.

[TastyChillySauce00]

"The EU is telling cryptocurrency hardware and software wallet providers that they have 24 hours from awareness to report actively exploited bugs or severe security vulnerabilities affecting their products". I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

Shouldn't it be 24 hours to report post mortem instead of actively exploited bugs ? what if the actively exploited bugs is still left unpatched while they're forced to report the bugs and any security vulnerabilities? Wouldn't there be more people knowing the vulnerabilities and also actively exploiting the bugs?

I do believe it should be post mortem report or announcements instead of reporting the exact bug they're working to get patched unless the bug already got patched and they're still within the deadline to make the report. I personally support any active effort to let the user know what's really happening and give no more room for a company to conceal security vulnerability for the sake of saving faces.

[Z-tight]

They get known mostly after exploitation or thorough review, which is different from how attacker with the skills of breaking things will go about it.  

Yeah, but that is exactly what the new rules seek to establish, that these services must report critical vulnerabilities or bugs that have already been exploited, 24 hours after awareness, which is after they have found such vulnerabilities. And the rule also mentions 'critical', so flaws that don't fall under that category do not have to be reported. I don't care about the EU and i know they don't care about crypto customers, but i don't have a problem with this rule.
However, there is also a fine for misleading or fake information:

Supplying incorrect, incomplete or misleading information will also subject companies to an administrative fine of up to 5 million euros.

[Free Market Capitalist]

I think they are quite proactive on this and this is a good development. The EU parliament is working hard and showing that customer's digital assets need to be protected first from the provider of such security services.

It's only a bullshit from EU parliament because they are either stupid in knowledge about security or know about security basics but only do that to play their game and show off like they are actually care about their citizens.

If there is no security bond, there is nothing to protect citizens and users of digital products.

I don't talk down on people or groups for what they are doing with honest intention to safeguard people.

At first glance, I am with hd49728. The thing is, when I see the words “EU” and “protect,” I start to tremble, because they usually go hand in hand with control mechanisms.

However, I have to say that, having read the article—and while I don't have all the details yet—I don't think the initiative is a bad idea. It's even paradoxical, because what the EU wants is to do away with self-custody and regulate all cryptocurrency transactions the same way it regulates bank transactions. But as a consumer protection initiative, it's not bad. 

[zasad@]

At first glance, I am with hd49728. The thing is, when I see the words “EU” and “protect,” I start to tremble, because they usually go hand in hand with control mechanisms.

However, I have to say that, having read the article—and while I don't have all the details yet—I don't think the initiative is a bad idea. It's even paradoxical, because what the EU wants is to do away with self-custody and regulate all cryptocurrency transactions the same way it regulates bank transactions. But as a consumer protection initiative, it's not bad.  

I do not think it matters whether a citizen uses custodial or non-custodial storage.
The most important thing for the regulator is that the citizen declares their assets. If a citizen falls into this trap, there is no way out.
A citizen might forget or lose their private key- let’s assume that happens, but the court will still place a lien on their assets (cars, real estate, bank accounts) to cover that amount.

[Gozie51]

But as a consumer protection initiative, it's not bad.  

This is exactly the point in view because that seem to be their primary obligation. There is no perfect society nor group, not with a capitalist society where biase and self interest for personal gain is the order of the day. But a group must have to protect and proclaim its priority and that is what I think the EU is doing with the protection of customers assets.

Whether they are ass licking may not be isolated to them alone. There is no perfect society.

[BlackHatCoiner]

The EU probably just saw a new way to farm $17 million fines to fund their next endless parliament session.

Jokes aside, 24 hours to report an actively exploited zero-day is absolutely brutal for a tech team. Half the time these companies don't even know they've been breached until a week later when some intern notices the database is crying.

[Z-tight]

Jokes aside, 24 hours to report an actively exploited zero-day is absolutely brutal for a tech team. Half the time these companies don't even know they've been breached until a week later when some intern notices the database is crying.

The rule reads: '24 hours from awareness', that would mean they must make a report within 24 hours of finding out that they have been breached. I think the rule is fair, i don't know why a service would fail to immediately report actively exploited flaws once they find out about it, when it's their duty to warn their customers that an attacker has breached their system.