Gatehub only way to migrate RT? (Stolen XRP)

[TiffanyHayden]

I never migrated my RT accounts. I thought (incorrectly) that they were essentially in cold storage otherwise. In the past, I attempted to create an account with Gatehub, but abandoned the  idea when I got to the part where  documents were required in order to verify ID (I don't have proof of a permanent address).

Last night, I decided to try again after reading @cmbartley's article explaining that Gatehub can also act as an interface to Ripple wallets. I couldn't remember the password for Gatehub from my previous attempt so I started fresh. I didn't realize that you could still migrate old RT accounts with just a user name and password (no secret key required). After successfully migrating a few accounts, I was looking through some of the activity and noticed there was an old RT account that I didn't realize I had sent more than the minimum amount of XRP required. Not a ton. Just 1,000 XRP. I was probably planning on being a goofball with them. The address was named VladimirPutin.

So, I go to migrate the VladimirPutin account on GateHub and it says that it's already been migrated. I look it up on RippleCharts and a week ago the 1,000 XRP were sent somewhere else.

A week ago I also received 3 different texts from 3 different numbers with a message about my "Ripple Code."  These messages looked just like the ones I received from Gatehub last night. My phone number is pretty new and not many people have it. I never use my phone number when signing up for 2FA (and I didn't sign up for 2FA on Gatehub last night, but I did give them my number which ended up being used for 2FA anyway, for some reason). I finally figured out the password to my first Gatehub account I created and it had my old number listed.

I'm confused about what happened to the VladimirPutin account. Is there another way to migrate RT accounts other than through Gatehub? If somebody used Gatehub to migrate my VladimirPutin account for me, does that mean that they also have my new phone number?

(Everything has been moved to cold storage.)

Edited May 12, 2017 by TiffanyHayden

[Guest]

If you know the secret then you should have access... no?

[TiffanyHayden]

Just now, Max Entropy said:

If you know the secret then you should have access... no?

Access to the empty account? The XRP were sent somewhere else.

[TiffanyHayden]

How was Gatehub able to tell that the account had already been migrated? What is it that happens to an account that makes it distinguishable as migrated?

[Guest]

Oh... well then you are cooked Tiff!

This is one of the pitfalls to being your bank. I am not having fun with you but, as you know more than I do... about the Ripple Eco-system. This is bad news.

--

I guess it would be informative to track the recipient address and associated addresses.

Edited May 12, 2017 by Guest

[JoelKatz]

Ouch! You should definitely report this. This is the first case I've heard of involving an account being migrated by someone other than the owner. You can use this form:

https://ripple.com/ripple-theft-report/

This might also be a good time to remind people that if you squirreled away a few hundred or a few thousand XRP somewhere, you might want to make sure you preserve access to them. There was some little only casino that was one of the first to take bitcoins way back when. I deposited three bitcoins and played around a little bit. When bitcoing first went to $1,000, it occurred to me that I never withdrew them. I managed to dig up the deposit confirmation email in my history, download their client, log back in, and get back $3,000 worth of bitcoin.

[TiffanyHayden]

4 minutes ago, Max Entropy said:

Oh... well then you are cooked Tiff!

I'm not worried about the XRP. It was just 1,000 that I had forgotten about. I'm creeped out about my phone number being used. It's a new number. I'm wondering if somebody that I know did this to me.

Edited May 12, 2017 by TiffanyHayden

[Guest]

Well I am beginning to worry about the process required for RT migration, as did not bother to migrate as I knew my private keys, so I may be cooked as well.

[BAX]

3 minutes ago, JoelKatz said:

Ouch! You should definitely report this. This is the first case I've heard of involving an account being migrated by someone other than the owner. You can use this form:

https://ripple.com/ripple-theft-report/

This might also be a good time to remind people that if you squirreled away a few hundred or a few thousand XRP somewhere, you might want to make sure you preserve access to them. There was some little only casino that was one of the first to take bitcoins way back when. I deposited three bitcoins and played around a little bit. When bitcoing first went to $1,000, it occurred to me that I never withdrew them. I managed to dig up the deposit confirmation email in my history, download their client, log back in, and get back $3,000 worth of bitcoin.

Is there a way someone to migrate the old rippletrade account without the secret key?

[TiffanyHayden]

4 minutes ago, JoelKatz said:

This is the first case I've heard of involving an account being migrated by someone other than the owner

Is Gatehub the only way to migrate?

[TiffanyHayden]

3 minutes ago, BAX said:

Is there a way someone to migrate the old rippletrade account without the secret key?

Surprisingly, Gatehub does NOT ask for the secret key.

3 minutes ago, Max Entropy said:

Well I am beginning to worry about the process required for RT migration, as did not bother to migrate as I knew my private keys, so I may be cooked as well.

This was the logic I used as well. It's wrong.

Adding... my accounts with a significant amount of XRP were fine.

Edited May 12, 2017 by TiffanyHayden

[Guest]

So the question may be,.. did Ripple Trade know the secret?

[namini]

I don't know if it has been mentionned, but you can migrate an old rippletrade wallet on gatehub just with the secret key, on wallet page click on "+" at the top of the page, "import" and then enter a random name and your secret key.

 

this is interesting to read too

https://blog.coinbase.com/on-phone-numbers-and-identity-423db8577e58

Edited May 12, 2017 by namini

[Mercury]

9 minutes ago, BAX said:

Is there a way someone to migrate the old rippletrade account without the secret key?

@BAX, deleted the double posting

[JoelKatz]

6 minutes ago, Max Entropy said:

So the question may be,.. did Ripple Trade know the secret?

Ripple Trade can extract your secret given your password. That's how the client works and that's how the migration scheme works. Without the password, the secret cannot be recovered.