Ugh... Are you kidding me? Are there bots prowling the network with a boatload of password-account combinations stored watching the for transactions to known addresses or something?
I got some NXT a long time ago and kept it tucked away, but with the updated client it seems I didn't have a public key, so I sent a message.. easy enough... my balance was there, but I couldn't forge because it was unconfirmed... so I figure this has something to do with old balances being 'unconfirmed' under the updated protocol until it's seen activity.. So I flip my NXT into another account that I used in the past (tx 3603756272827733121), wait for it to confirm, and as soon as it does the NXT has moved on to an account out of my control (tx 10738856805317237622)...!!!
WTF? I sat here waiting for a confirm to flip it right back, and it vanishes before my very eyes! We're talking within 2 seconds of the first confirmation!
If the network is this compromised, how do you ever expect mainstream adoption... I've had an eye on NXT since the beginning and was really into the new look and feel, the asset exchange, etc.. My interest was building in NXT again (initially less than impressed by the distribution, but it seemed a lot of great work had gone into the protocol..) Too bad.. Nxt looked cool, but as it stands I'm out.. Not sure that this can be called a 2nd generation crypto when it's this vulnerable to theft. I'd say the target audience is even more specialized than bitcoin; the average joe can hardly remember "Password1"!
Sorry for your loss. Can you share the password of your second account? I also find it weird that someone compromised your account that fast.
I would rather not share my 'passphrase' or unique key or whatever you want to call it because it has elements of a common password that I use for low security purposes (i.e. one-use account on random forums). It was admittedly a meager 21 chars including dictionary words and spaces.. Much better than a laymans password but not the level of security I usually use (thus why it was a depreciated account/wallet). I haven't been in that account for about 4-5 months and was just using it to bounce my nxt to see if that would get it properly recognized (effective balance was 0 despite having NXT).
The thing that concerns me is that the transaction occurred within 2 seconds of the first confirmation.. It's not like I left nxt sitting around in an unsecure account, this was just a brief bounce to try to 'reactivate' my nxt.
The amount is irrelevant in this case - about 250 nxt (all I had), but the fact that it was so rapidly snagged is concerning to say the least.. it made me realize a major flaw for NXT and the layman.. A bot can easily collect a massive list of account keys and related 'security phrases' via brute force (offline so it's undetected), store these, and watch the blockchain for transactions to accounts that fall within it's dictionary, then instantly log in and with bot-like speed, snipe those NXT on the first transaction...
I really don't see any other way this could have happened.. I was working on something else and came back probably 3 minutes after the block to see the nxt was gone - sent to a so-far unused account. The vulnerability is human error, and seeing as you're looking for humans to use this system, I'd call that a pretty big barrier when it comes to user adoption.. I'm an IT business analyst by trade and that just doesn't fly for me - NXT has a lot of great things that Bitcoin does not, but at the end of the day, it's harder to steal someone's bitcoins because you basically have to steal their wallet.dat whereas with NXT you just need to figure out their passphrase..
In this case the theif used NXT-X6AP-V3S7-RBHA-GQW8Z, which I'm sure will see no activity for some time before it goes through a wash.. I remember from the get-go there were countless issues with theft, looks like this has gotten worse. Enough to scare me off NXT. GL.
