The difference between CC and Public Domain. Your creativity when it comes to giving the license-required attribution doesn't in any way affect the product's license status.

I don't mine. I don't plan on start mining until there are small low power FPGA/sASIC/ASIC solutions available that I can fire up and forget. No whining fans, no noticeable heat output.

I don't plan on ever mining for profit. I would run such a system to help support Bitcoin. While I can't quantify any numbers for you, I'm quite sure there are others who - like me - are interested in Bitcoin as a social and political experiment more than as an "investment".

With all that said, without ArtForz or ztex at least considering your numbers to be plausible (Mhash/s as well as price) I belong to the wait-and-see crowd. Impressed and interested, if true.

I'm 40 years old and wrote my first assembler program when I was 12^a. You might want to let this one go, any basic level crypto 101 course will tell you the same things I've posted since they're considered to be common knowledge if you design and implement something with provable security.

"an attacker would have to guess first which salting method was used" is what disqualifies you outright in this argument btw

(I'm leaving this discussion here since I don't think it produces anything of value to theymos and the reasons he had when creating the thread)


a: Since, umm, that's what you had back then if you wanted to do anything remotely interesting.

The LastPass plugin caches locally meaning you have access to your passwords offline as well, and they do not store your actual unencrypted passwords which means you're not "screwed" if they get hacked.

The most obvious attack vector is to somehow modify the javascript that gets sent to your client, or to intercept both your locally entered master password as well as the lastpass-stored encrypted keyfile.

I fully recommend LastPass, even with those two caveats in mind.

(Paying users can also use the mobile client)

If you believe you're able to fool anyone who's read our posts here - fine by me I think you mistake low level microcontroller crypto implementation for "apt-get install apache" though. ("goes down"? really?)

Well. It doesn't require them, although it ends up making things easier for a lot of people. Only one out of all my Bitcoin transactions have been to a "centralized" exchange, the rest have been P2P.

For one thing, since I have been of the opinion that for Bitcoin to succeed people must use it and not speculate in buy-and-hold I've always told people who become interested in Bitcoin that they can get some from me, at market rate. (Which is currently about half of my average acquisition price)

I wish more people did, and I have high hopes for the current bubble deflation to weed out most of the get-quick-rich "it can only get higher" so-called investors.

You shouldn't be too surprised that us who do end up at the forum of the world's first possibly-successful crypto currency.

I spent a few years, as a well paid consultant, designing and implementing crypto security systems on embedded platforms.

You?

(Everything described in my posts would be considered "best practices")


Adding layers of encryption/hashing does not always increase security while always increasing implementation complexity. Your schemes are simply unnecessary, it's better to increase the password entropy.

You call that easy compared to what people already have?

(Oh, and while I know it comes as a surprise to most americans, there's actually like three or four other countries not included in "nationwide")

You're saying you've never played at btcontilt, username Weaver?

The only one I've never seen play at his own site is Josh (StrikeSapphire).

Subforum: Gambling

You have to get the bitcoins first. Until there's a (much) simpler way for the consumers to, as hassle-free as possible, pay using Bitcoin without actually having to have two wallets (their regular currency as well as bitcoins) credit cards will be much easier to use.

Paying using your mobile with NFC is going to become huge during next year. Mobile Bitcoin payments will be no easier than mobile VISA/Mastercard payments.

http://www.google.com/wallet/
http://usa.visa.com/personal/cards/paywave/index.html
http://www.paypass.com/

Yes, that's the "obscurity" part of your reasoning. It doesn't provide any added level of (real) security. When designing a security system all forms of added levels of complexity are risks where there might be edge cases you haven't thought about. You want as few implementation parts as possible, while still giving you a provable level of security.

When someone tells you that you're wrong, it's good etiquette to educate yourself before posting again. The Bitcoin Wallet several of us are using on Android is indeed a network participating client. It's based on BitcoinJ, an Android Bitcoin library.

https://market.android.com/details?id=de.schildbach.wallet

http://code.google.com/p/bitcoinj/

To the actual point of your post, I would agree. For the short term Bitcoin proponents should focus on the usecases where Bitcoin really shines, like international wire transfers (competing with Western Union etc), while building an infrastructure (which Bit-Pay is doing in a wonderful way) where it later can create the same consumer easy of use as credit card payments but with lower merchant fees.

Feel free to write coherent posts. Either the attacker has to guess (obscurity) or not. In any case, you're completely missing the point of salt if you feel that's a suitable place in a crypto system to add stronger complexity.

You might want to re-read the OP with that UK university background in mind.


I'd suggest contacting ztex who's already making and reselling a similar product:

https://bitcointalk.org/index.php?topic=40047.0

http://en.wikipedia.org/wiki/Security_through_obscurity

There's no reason to make the salt a part of the complexity of brute forcing passwords. Educate the users instead. "Password strength" indicators are one of several good ways of doing that.

Yeah it's because while you get a file when right-clicking it's still the same error message and not the actual program.